Cyber Law

We help clients align regulatory requirements and controls with practical security governance advisory and legal support under NIS2, DORA, CRA and other relevant cyber security frameworks. 

​

We help you ensure compliance with GDPR and other privacy laws through pragmatic and hands-on support in managing data privacy risks, governance and accountability.

​

We provide practical legal guidance on the AI Act and emerging technology laws – helping clients balance innovation, risk, and compliance.

​

We provide guidance on data laws, including e.g., Data Act, DataGovernance Act, Digital Services Act, to help clients stay compliant, accountable and prepared for change.

​

By integrating legal and risk perspectives into enterprise governance we help clients strengthen accountability, compliance and decision-making in digital operations. This also includes advisory on third-party and supply chain risks to limit contractual, compliance and liability exposure in complex digital ecosystem.​

Strategic direction & oversight
We help you navigate cyber and digital regulation into clear governance structures, oversight models and decision-making frameworks aligned with enterprise risk and long-term strategy.

Cyber risk is no longer only a technical matter; it is a resilience, liability, and reputational issue, with an increased responsibility for the board and executive management.

• Governance and accountability strategy and models
• Regulatory reporting, assurance, and management information, including risk analysis
• Decision frameworks linking cyber risk into strategy and capital allocation

Transformation & resilient operating models
Digital transformation, connected products and AI-driven services are directly impacted by evolving EU cyber and data laws. We help you embed compliance into innovation and operational change, ensuring regulatory requirements are addressed by design and across product and data lifecycle.

• Governance and risk management embedded in digital transformation
• Resilient operating and product lifecycle models
• Privacy, regulatory compliance and security by design across digital services and connected environments

Governance & compliance integration
Risk, compliance and legal functions must ensure that cyber and digital regulation is translated into effective policies and controls. We help you understand applicability of overlapping regulatory frameworks, identifying key risks and prioritizing practical next steps through tailored assessments and gap analyses.

• Gap analysis, action plans and roadmap
• Policy and framework alignment with supervisory expectations
• Control design, documentation, and evidence structures

EU regulation is no longer siloed. Frameworks like GDPR, NIS2, DORA, the AI Act, the CRA, and the Data Act all create overlapping expectations across governance, risk management, incident handling, supply chain oversight, documentation, and lifecycle control.

The real challenge isn’t identifying obligations. It is translating them into one coherent operating model across legal, risk, security, IT, and the business. Those fragmented approaches increase cost, duplication, and regulatory exposure, and they tend to break down precisely when they are needed most: during an incident, an audit, or a regulatory enquiry.

We help organisations align these requirements into a unified, workable framework. This means clear ownership, consistent controls, and defensible evidence that holds across multiple regulatory regimes.

Under NIS2, entity classification depends on sector, size thresholds, and criticality. Under DORA, even indirect ICT providers may fall under scrutiny. The AI Act requires formal risk classification and documentation logic. The CRA applies based on “products with digital elements,” which demands technical-legal interpretation. Scope must be documented in a defensible position paper, not assumed.

We conduct structured applicability assessments that withstand supervisory review and board scrutiny.

Cloud and SaaS environments shift risk from direct control to shared responsibility, layered dependencies, and limited visibility. Regulations like the GDPR, NIS2, DORA, and the Data Act all introduce expectations around data protection, security measures, third-party risk, and control over data access and cross-border transfers.

The challenge goes beyond assessing vendors at onboarding. It is important to understand how data, responsibilities, and risks flow across the entire environment: through configuration, integration, subcontracting chains, and lifecycle changes that often happen without formal review.

In practice, risks often emerge over time rather than at the start.

We help organisations take a structured, end-to-end view of these environments, embedding privacy and security into design, onboarding, and change processes. This includes clear accountability and evidence that stands up to regulatory scrutiny.

The Cyber Resilience Act (CRA) shifts an organisation’s responsibility from point-in-time compliance to full lifecycle accountability for products with digital elements. Security is no longer limited to design or release.

That includes development, testing, deployment, maintenance, vulnerability management, and even end-of-life. The CRA also reinforces expectations around secure-by-design practices, continuous risk assessment, coordinated vulnerability disclosure, and ongoing monitoring during the period a product is supported.

In practice, the real challenge is operationalising these responsibilities across product, engineering, legal, and support functions. Often, in organisations where these teams have never had to work this closely together.

We help organisations embed lifecycle governance models that align product development with regulatory expectations and build the continuous control needed to demonstrate compliance over time.

Clear ownership of data cannot be assumed anymore; it must be actively defined across the entire value chain. Regulations like GDPR, the Data Act, DORA, and the AI Act each reinforce accountability across how data is accessed, shared, processed, and governed, both internally and with external partners.

In practice, this spans ownership of data rights and transparency obligations under GDPR; control over data access, portability, and cloud switching under the Data Act; supply chain accountability and audit readiness under DORA; and defined roles for AI system governance and risk monitoring under the AI Act.

The challenge is bringing all of this together into something that works day to day.

We help organisations build governance models that translate these obligations into clear decision rights, practical responsibilities, and meaningful oversight across the full data and AI ecosystem. Not just on paper, but in how the organisation operates.

Critical ICT third-party arrangements must be documented in detailed registers and subject to oversight. Boards remain accountable for outsourcing risk.

The challenge is operationalising DORA without paralysing innovation.

We assist financial institutions in integrating DORA obligations into procurement, vendor governance, and operational resilience frameworks.

Third-party risk is now a regulated lifecycle, not a procurement step. Frameworks like GDPR, NIS2, DORA, the Data Act, and the AI Act all impose structured expectations on how organisations select, contract, and oversee providers, particularly where services are business-critical, data-intensive, or embedded in automated decision-making.

In practice, many of the biggest risk often materialises before a contract is signed: in assumptions made during selection, gaps left in due diligence, and obligations that never make it into the agreement. For example, DORA sets out particularly detailed requirements for financial entities, including mandatory contractual elements and ongoing oversight of critical ICT providers.

We support organisations in building governance, policies, and processes that make third-party risk manageable, transparent, and regulator-ready, at every stage of the relationship.

In practice, the AI Act requires organisations to treat AI as a structured risk and governance topic, recognising that not all AI systems carry the same level of risk. Use cases must be differentiated, with governance obligations intensifying as systems move from experimentation into production and begin to affect decisions, individuals, or critical operations.

This means AI systems must be classified, assessed, documented, and continuously monitored. For high-risk applications, such as those covering areas such as employment, critical infrastructure, credit, and biometric identification, the Act introduces mandatory conformity assessments and human oversight requirements. In many cases, conformity assessments are also required before such systems can be placed on the market or put into service.

At the same time, effective AI governance goes beyond regulatory compliance. Many organisations are also aligning with international standards and frameworks, such as ISO/IEC 42001, ISO/IEC 23894, and the NIST AI Risk Management Framework, to build more robust and future-proof approaches.

We help organisations build practical, scalable governance models that support sound decision-making today while keeping pace with regulatory expectations as they evolve.

Demonstrating accountability requires more than having controls in place; it requires being genuinely audit-ready. Across frameworks like GDPR, NIS2, DORA, the AI Act, and the CRA, the expectation is that organisations can show, clearly and under pressure, how decisions are made, how risks are managed, and how incidents are handled in practice, not just documented in policies.

This means clear accountability mapping, structured and retrievable evidence, tested incident reporting workflows, coherent crisis communication, and the ability to coordinate across borders when it matters. Regulators and auditors are increasingly assessing response maturity and governance substance, assessing response capability, traceability, and consistency, rather than just the existence of documentation.

We support organisations in building the readiness to demonstrate structured, proportionate, and defensible governance when it counts.

DORA and NIS2 elevate cyber risk from a technical issue to an enterprise-wide governance responsibility. Both frameworks require structured risk management, clear accountability, and the ability to manage and report incidents in a consistent, timely, and defensible way.

NIS2 strengthens expectations on senior management oversight and accountability, including potential consequences for serious compliance failures. DORA introduces similarly robust governance requirements for financial entities, with a strong focus on operational resilience and third-party risk.

This reshapes how organisations identify critical services, assess dependencies, and coordinate response across business, technology, and third parties. Incident governance becomes more formalised, with defined escalation paths, strict reporting timelines, 24 hours for initial notification under both frameworks, and cross-functional coordination that most organisations have not yet stress-tested.

The core challenge is integrating these requirements into existing risk and operational models without creating parallel structures that fail under pressure. We help organisations do exactly that.