On October 21, 2025, the New York State Department of Financial Services (“NYDFS”) issued an industry letter (the “Guidance”) highlighting the cybersecurity risks related to Covered Entities’ use of Third-Party Service Providers (“TPSPs”) and providing strategies to address these risks. …

On June 12, the SEC withdrew 14 proposed rules stating that it did not intend to issue final rules with respect to the proposals and that if the SEC decides to pursue future regulatory action in any of these areas, …

Deployment of generative AI expanded rapidly across many industries in 2024, leading to broadly increased productivity, return on investment and other benefits. At the same time, AI was also a focus for lawmakers, regulators and courts. There are currently 27 …

Citing the threats posed by foreign adversaries and criminal organizations, and seeking enhanced accountability for companies that provide software and cloud services to the federal government, the Biden administration released a new, sweeping Executive Order (“E.O.”) on cybersecurity, signing the …

The Securities and Exchange Commission announced on November 22 that it filed 583 total enforcement actions in fiscal year 2024 while obtaining orders for $8.2 billion in financial remedies, the highest amount in SEC history.

As November comes to an end, the busy annual reporting and proxy season begins for many public companies. In this Client Update, we highlight key considerations for public companies when preparing their annual reports on Form 10-K or Form 20-F, …

With the Labor Day holiday now behind us, it is a good time to review the SEC’s active enforcement docket and to look ahead to likely areas of continuing enforcement attention as we head into the fall.  The record over …

Last month the new Labour government in the UK announced in the King’s Speech that it will introduce new artificial intelligence (AI) rules alongside cybersecurity and digital information bills. A brief overview of these developments is set out below.

Artificial

The cybersecurity rules that the Commission adopted on July 26, 2023[*] require public companies to disclose material cybersecurity incidents under Item 1.05 of Form 8-K.[1]  If a company chooses to disclose a cybersecurity incident for which it has …

Key Points

• New SEC rules from 2023 require public companies to report material cybersecurity incidents promptly and detail their cybersecurity risk management strategies in annual reports — requirements that increase the risk of litigation over misstatements relating to cybersecurity.
• The

Artificial intelligence (AI)[1] was the biggest technology news of 2023. AI continues to revolutionize business in big and small ways, ranging from disrupting entire business models to making basic support functions more efficient. Observers have rightly focused on the …

The New York Department of Financial Services (NYDFS) has finalized amendments (“Amended Regulation”) to its cybersecurity rule (“Cybersecurity Rule”) that applies to financial institutions licensed by the NYDFS. This comes after a series of proposed amendments (see our client …

On November 14, 2023, the U.S. Securities and Exchange Commission’s (“SEC” or “Commission”) Division of Enforcement (“Division”) announced its enforcement results for fiscal year (“FY”) 2023.[1] Disgorgement and penalties were the second highest in the SEC’s history at just …

The Securities and Exchange Commission announced that it filed 784 total enforcement actions in fiscal year 2023, a 3 percent increase over fiscal year 2022, including 501 original, or “stand-alone,” enforcement actions, an 8 percent increase over the prior fiscal …

On October 30, 2023, the SEC filed a litigated complaint against SolarWinds, a software development company, and Timothy Brown, its chief information security officer (CISO). The SEC alleges that from October 2018, when SolarWinds went public, to January 2021, SolarWinds …