Technology regulation

We are at the forefront of the generative AI revolution, working with major technology clients to bring products to market and helping a wide range of enterprise clients understand and adapt to this transformative technology. Our team advises on all aspects of AI projects, from development and procurement to implementation and use, including IP, data protection, regulatory compliance, and bespoke contracts. In digital health, we focus on the legal complexities of using medical and patient data in AI, offering sector-leading advice at the intersection of Life Sciences and Technology. This is potentially a world changing technology but also an area where general regulations such as GDPR, new laws such as the EU AI Act and sector specific regulations such as those in relation to medical devices mean only a highly knowledgeable, cross-disciplinary team can assist. Find out more about our expertise here.

EU legislation such as the EU Cyber Resilience Act (CRA), NIS2 and sector-specific rules such as the DORA regulation are introducing significant new cybersecurity and cyber-resilience obligations for businesses that develop, supply or deploy software and related services. The Cyber Resilience Act requirements apply to products with digital elements and introduce new obligations around cybersecurity, risk management, vulnerability handling and reporting. We advise businesses on CRA compliance and navigating the Cyber Resilience Act timeline, alongside their wider obligations under EU cybersecurity and resilience legislation. Our sector expertise includes a deep understanding of the selection, incorporation and deployment of open source components and the generation of compliance artifacts and SBOM handling as required by CRA, using management frameworks such as OpenChain (ISO 5230:2020 and ISO 18974. We help downstream consumers and upstream providers with software supply chain management, whether they are manufacturers, importers or open-source software stewards, using CRA-compliance tools such as establishing confidential SBOM transfer protocols or risk-management tools such as FOSS security attestations.

The Critical Entities Resilience Directive also strengthens the physical resilience of critical entities across the EU, sitting alongside NIS2 and extending resilience requirements beyond cybersecurity to a wider range of sectors. In the UK, the Cyber Security and Resilience Bill is set to introduce a new regulatory framework for the cybersecurity and resilience of critical infrastructure and digital services. The Product Security and Telecommunications Infrastructure Act also introduces security requirements for consumer connected devices.

As a cybersecurity law firm, we combine deep expertise in technology, privacy, cybersecurity and cyber breaches to advise both “buy-side” users of technology and “sell-side” suppliers. Our technology lawyers help businesses understand evolving cybersecurity regulations, assess their compliance obligations and manage cyber risk without being exposed to over-zealous interpretations of the rules.

Discover more.

Our competition team is at the forefront of developments arising from the new digital markets competition regime introduced by the UK’s DMCC, as well as the EU’s Digital Markets Act (DMA).

New EU and UK laws, such as the EU’s Accessibility Act, which improves accessibility of some products and services for people with disabilities and the additional consumer protections introduced by the EU’s Digital Services Act and the UK’s DMCC act, have increased regulatory scrutiny of consumer facing terms and conditions. Our team has unparalleled experience of working with global clients providing goods and services online to do so in a compliant yet pragmatic way, as well as representing clients in any regulatory investigations that may arise.

The EU Data Act and the EU Data Governance Act are laws that aim to unlock the value of industrial and public sector data by promoting fair access, responsible sharing, and legal clarity across the European data economy, each with distinct scopes and safeguards. Read more about our data team here, where you can also find out all about our practice in the field of data protection, privacy and cyber risk. 

Our digital health team helps life sciences and technology innovators navigate the legal and regulatory complexities of bringing digital health solutions to market. We guide clients through the regulatory, data protection, IP, and commercial hurdles of digital health, empowering them to deliver groundbreaking healthcare technologies to market with speed and confidence.

Our technology lawyers have deep experience of advising financial services firms on the procurement and deployment of technology and material outsourcing transactions and the thicket of regulatory requirements that must be met in relation to the same. We also deploy that expertise for providers and developers of technology solutions for that sector.

The UK  is leading the world in implementing online safety laws, which is creating new compliance demands for digital platforms. Our Safety Net hub offers practical guidance and resources.

Beyond sector specific liability regimes in relation to food and drink, medicines and the like, we also advise clients on the new product liability regimes arising from new EU and UK laws, in addition to the CRA and DORA, the EU Product Liability Directive imposes new product liability obligations on any organisation that produces software and we are already working with clients on their compliance with this new law.