Team size: 50 (now includes compliance)

What are the key projects you have been involved in over the past twelve months?

Over the past twelve months, the regulatory burden across our EU footprint has intensified rather than plateaued, though its shape has shifted. NIS2 and DORA have moved from transposition to active, live enforcement across member states in 2026, meaning our team now runs concurrent incident-reporting and third-party risk obligations under both frameworks simultaneously, rather than preparing for them sequentially.

At the same time, the EU AI Act’s high-risk obligations, originally due from 2nd August 2026, have been pushed back to 2nd December 2027 under the EU’s Omnibus package. Our focus this year shifted from imminent enforcement to structured readiness: building governance, documentation and risk-classification processes ahead of the new deadline. That recalibration itself added work, since EU standards bodies were behind schedule on the harmonised standards needed for a presumption of conformity, forcing our team to run parallel compliance tracks rather than a single sequential rollout.

Beyond the regulatory workload, the year also included M&A activity, including acquisitions and disposals across key markets, and litigation, including a published settlement with the Dutch AP (Autoriteit Persoonsgegevens).

Can you describe an instance where your legal advice directly influenced business strategy or commercial objectives?

One clear example from the past year involved the EU AI Act’s high-risk compliance timeline. When the Omnibus package began moving through the EU legislative process, the business initially planned to accelerate a full AI governance build-out to meet what was then an August 2026 deadline for high-risk systems, committing significant budget and headcount toward that date.

My government affairs team tracked the Omnibus negotiations and the delays in the harmonised EU standards that AI providers needed for conformity assessment, and concluded the deadline was highly likely to shift. We advised the business to hold off on the accelerated spend and instead adopt a phased, lower-cost readiness programme, sequencing governance and documentation work against a revised 2027 timeline rather than the original 2026 date.

That advice was validated when the EU formally confirmed the high-risk deadline had moved to 2nd December 2027, roughly sixteen months later than originally planned. As a result, we avoided a costly, rushed compliance sprint, redirected that budget toward NIS2, CCD2, CRA and DORA obligations (which remained on their original enforcement track and represented the more immediate regulatory risk) and gave the business a materially longer, more realistic runway to build AI governance properly rather than reactively.

What key trends should in-house counsel be monitoring over the coming months?

Looking at the next six to twelve months, DORA and NIS2 have become the dominant pressure points, not the AI Act. Both frameworks are now in active, live enforcement across EU member states, meaning our team manages concurrent incident-reporting obligations, third-party risk assessments and operational resilience testing simultaneously rather than sequentially.

The AI Act, by contrast, has receded slightly as an immediate concern following the Omnibus package, which pushed high-risk system obligations from August 2026 to December 2027, giving organisations a longer runway to build governance properly rather than reactively. That said, this recalibration itself created work: the shifting deadline forced legal and compliance teams across the sector to re-sequence programmes mid-stream. I expect the next six months to be dominated by NIS2/DORA enforcement actions and supervisory scrutiny, while AI Act work shifts into structured, lower-urgency preparation.

How has the role of general counsel evolved, and what are the most important attributes for the modern in-house lawyer?

I previously named business understanding, communication, relationship-building and AI fluency as the core attributes of an effective general counsel, and that framework still holds. But my view on AI fluency has sharpened considerably this year.

A year ago, AI fluency for a GC largely meant understanding the AI Act’s obligations well enough to advise on compliance timelines. Now, with the Omnibus delay giving high-risk obligations a longer runway to 2027, AI fluency has shifted from urgent compliance literacy toward strategic judgment: knowing when regulatory deadlines are genuinely fixed versus politically fluid and advising the business accordingly rather than reacting to every legislative headline.

The GCs who added the most value this year weren’t the ones who moved fastest on AI Act build-outs, but those who read the legislative trajectory correctly and helped their organisations avoid wasted spend on premature compliance sprints. That kind of regulatory foresight — reading not just the law as written, but where it’s heading — has become as important as the underlying legal fluency itself.

Beyond your legal role, is there a cause or initiative you are especially passionate about?

Boxing remains a significant part of how I think about resilience, and this year that lesson has felt more relevant than ever. The sport teaches you to stay composed and read your opponent’s next move rather than reacting purely to the last punch thrown, which mirrors how I’ve approached this year’s shifting regulatory landscape.

Rather than reacting to every AI Act headline as it broke, staying disciplined about reading the underlying legislative trajectory paid off when the Omnibus delay was ultimately confirmed.