Insights For In-house Counsel - Spring 2024

The EU's Cyber Resilience Act introduces mandatory cybersecurity reporting obligations for manufacturers of digital products starting September 2026, requiring notification of actively exploited vulnerabilities and severe incidents within strict timeframes. Companies must establish procedures to identify and report security events to national Computer Security Incident Response Teams, with potential fines reaching €15 million or 2.5% of global turnover for non-compliance.

The EU AI Act's transparency rules now require businesses using AI systems to disclose when customers interact with artificial intelligence or encounter AI-generated content.

The European Commission has unveiled a European Innovation Act designed to strengthen the EU's innovation ecosystem by addressing two critical challenges: limited access to finance for IP-rich businesses and fragmented regulatory frameworks across Member States. The proposal introduces measures including a common IP valuation framework, streamlined R&D procurement procedures, and harmonized regulatory sandboxes to help startups and scaleups commercialize their innovations more effectively.

September brought significant regulatory developments in AI governance, with new frameworks emerging across the UK, Europe, and the United States. From the UK government's AI Risk Management Toolkit to Florida's unprecedented legal action against OpenAI, regulators and policymakers are working to ensure AI capabilities are matched by robust safeguards and accountability measures.

Legal AI has rapidly proliferated across in-house legal teams, appearing in budgets and workflows everywhere, yet a striking gap has emerged between adoption and effective implementation. While nearly every legal department now uses AI tools, only a small fraction has successfully scaled their deployment, and the vast majority cannot determine if their investments are delivering value.

The Solicitors Regulation Authority has issued a warning notice on AI misuse in legal practice, clarifying what responsible adoption looks like. While recognizing AI's benefits for document review, drafting, and research, the regulator emphasizes that solicitors remain accountable for their work regardless of the tools used, requiring proper governance, human oversight, and professional judgment to manage risks like hallucinated citations and confidentiality breaches.

The EU Cyber Resilience Act (CRA) is an EU product cybersecurity law for connected products (formally, “products with digital elements” under the CRA) commercialized in the EU; it entered into force on 10 December 2024...

Professor Richard Susskind challenges senior in-house legal leaders to rethink AI's role in the legal profession, arguing that while short-term impacts are overestimated, the long-term transformation toward Artificial General Intelligence will fundamentally reshape how legal services are delivered. Can legal departments prepare for a future where AI doesn't just assist lawyers but potentially replaces the traditional advisory model entirely?

This content appears to be a placeholder or test page containing only the text 'OK'. Without substantive information, it's not possible to determine the article's premise, purpose, or subject matter.

The Chancellor of the Exchequer faces the formidable challenge of delivering his first Budget amid economic headwinds, geopolitical instability, and a wave of ambitious government promises. With GDP growth forecast at just 1.1%, inflation at 3.4%, and public sector net borrowing exceeding £115 billion, can he balance fiscal responsibility with pledges to avoid raising Income Tax, National Insurance, or VAT while funding increased defence spending and social care reforms?

What employment and immigration law changes are coming in 2026 and 2027? From new unfair dismissal rights and extended tribunal time limits to enhanced harassment protections and trade union access requirements, this comprehensive guide maps out the key legislative reforms affecting UK employers and workers over the next two years.

The EU Cyber Resilience Act introduces mandatory vulnerability and incident reporting requirements for manufacturers of products with digital elements, effective September 2026. With tight 24-hour deadlines for initial reports and penalties reaching €15 million or 2.5% of global turnover, manufacturers must establish robust incident response procedures immediately.

Cryptoasset firms face a rapidly evolving regulatory landscape as the FCA's authorisation gateway opens on 30 September 2026. With the Financial Services and Markets Act 2000 (Cryptoassets) (Miscellaneous Amendments) Regulations 2026 laid before Parliament and the FCA's finalised PERG 18 guidance published within 24 hours, firms must navigate significant perimeter changes including new stablecoin payment exclusions.

From 2 August 2026, the EU AI Act requires businesses to disclose when people are interacting with AI systems, mark synthetic content for detection, label deepfakes, and inform individuals...

The European Parliament has published its negotiating position on SFDR 2.0, setting the stage for trilogue negotiations between the Commission, Parliament and Council. With the asset management industry hoping for relief from the complexities of SFDR 1.0, the Parliament's proposals claim to simplify the regime while maintaining credibility of sustainability-related investments.

Manchester City successfully challenged Premier League rules on Associated Party Transactions, winning key competition law arguments. Potential rule changes and future legal actions now loom, highlighting sports arbitration's growing significance.

The UK Government is implementing sweeping reforms to late payment laws that will fundamentally change how businesses manage supplier payments. These changes include substantial fines for persistent late payers, mandatory statutory interest rates, and a prohibition on payment terms exceeding 60 days. With enforcement powers granted to the Small Business Commissioner and a new binding adjudication system...

The UK faces an average of four nationally significant cyber attacks per week, yet data centres—the backbone of the digital economy—have remained outside regulatory scope until now. The Cyber Security and Resilience Bill will fundamentally change this landscape, introducing mandatory incident reporting within 24 hours, substantial penalties for non-compliance, and a new regulatory framework overseen by Ofcom that applies to facilities exceeding specific power thresholds.

This update provides a brief summary of some notable recent developments from an international sanctions perspective.