Technology Law Shorts - November 2026

• Technology and M&A: our new report on why technology now sits at the heart of deal value, and what that means for due diligence and deal terms

• AI and litigation: our four-part series on how AI use is shaping evidence, privilege and contractual risk

• EU Cyber Resilience Act: incident reporting is now live, and we set out what manufacturers need to have in place

• AI-enabled cyber threats and global AI regulation: lessons from a reported autonomous AI attack

• Regulatory round-up: our round-up of AI regulatory developments across Asia-Pacific, Europe, the UK and the US

For global technology businesses, the key takeaway is to ensure that technology, data and AI risk is addressed early and embedded in core governance, rather than treated as a compliance afterthought. In commercial contracts and procurement, businesses should secure robust due diligence and clear contractual protections in transactions, and close gaps in AI risk allocation between the protections available from upstream model providers and the commitments given to downstream customers.

Commercial technology developments: what do I need to know?

Global: Technology, AI and M&A: legal risks move centre stage

On 7 October 2026 we released our new report Technology, AI and the changing legal landscape of M&A. Technology is now a key driver of M&A across all sectors, with buyers increasingly valuing data, IP, digital infrastructure, specialist talent and AI capabilities alongside traditional assets. Our report highlights that technology is reshaping deal valuations, due diligence, deal structures and post-acquisition integration, and is driving increased scrutiny of issues such as data ownership, cybersecurity, AI regulation, IP rights and cross-border compliance.

Impact: Businesses pursuing acquisitions, investments or disposals should ensure technology, data and AI-related risks are assessed early. Robust due diligence and clear contractual protections are becoming critical to preserving deal value and securing regulatory approval.

Deeper dives: Cross-border technology M&A: global opportunity, local legal risk How data, AI and digital regulation are reshaping M&A risk

Global: AI and Litigation

What is the role of Gen AI in litigation? Our series of articles examines how legal, regulatory and judicial thinking is evolving, and what in-house legal teams can do now to govern AI effectively.

A clear message is emerging: the way in which a business governs and contracts for its use of AI can have a direct bearing on its litigation risk. Courts are scrutinising AI use more closely, while AI-generated content, prompts and chat logs may become relevant evidence or be subject to disclosure, without necessarily attracting privilege. The use of public AI tools may also create risks where confidential information or trade secrets are entered into them.

Impact: Businesses should therefore treat AI governance as part of their wider dispute-risk framework, with appropriate controls over AI use, data handling, confidentiality and human oversight.

Our technology partner Nichola Donovan comments: “We are seeing contractual risk allocation around AI become an increasingly important area of negotiation, with no settled market position across many of the key risk areas. The challenge can be particularly acute where third-party frontier models form part of the underlying technology stack and suppliers seek to align their downstream commitments with the protections available to them upstream. This can create gaps in the contractual risk chain, which become particularly significant when an AI-related failure or infringement claim arises and the parties need to establish responsibility and available recourse.”

Deeper dives: What is the role of Gen AI in litigation? Part 1, What is the role of Gen AI In Litigation? Part 2: AI, Legal Advice and Privilege, Using AI as a strategy tool – Latest case law from the US highlights disclosure risk: Part 3, Part 4 of What is the role of Gen AI in Litigation Series

EU: Cyber Resilience Act: Single Reporting Platform goes live

The EU’s Cyber Resilience Act (CRA) sets a mandatory cybersecurity framework for products with digital elements. It covers smart devices, routers, software and connected industrial systems, and applies to products placed on the EU market, regardless of origin. The rules are being phased in over three years. From 11 September 2026, manufacturers must report actively exploited vulnerabilities and severe incidents affecting the security of their products to EU authorities, via the new Single Reporting Platform, within tight deadlines. This applies to products already on sale, not only new ones. The remaining rules take effect on 11 December 2027, when products must be built to be secure, carry the CE marking, and come with security updates.

Impact: Review whether your products fall within the CRA’s scope, nominate individuals responsible for reporting, and test internal incident detection, escalation and reporting procedures to ensure you can meet the 24-hour early warning and 72-hour notification deadlines. Manufacturers selling connected products in the EU need robust cybersecurity governance and reporting processes now to reduce future compliance, enforcement and reputational risks.

Deeper dives: Executive Compliance Guide: Cyber Resilience Act | Navigating EU Law, EU Cyber Resilience Act: Single Reporting Platform Goes Live, EU CRA Reporting Obligations - Mini Guide

US: AI-based vulnerability testing: a new cybersecurity expectation

A reported autonomous AI cyberattack on Hugging Face in July 2026 highlights how advanced AI systems can identify, chain and exploit vulnerabilities at machine speed without human direction. AI-enabled vulnerability testing and incident response are increasingly becoming part of a reasonable cybersecurity approach, with regulators already signalling greater expectations around AI-driven cyber resilience and governance.

Impact: The incident is a timely reminder for all businesses to review whether their cybersecurity, incident response and AI governance frameworks are equipped for AI-enabled threats. It also provides food for thought for those investing in agentic AI on what contractual protections should be included from the outset. Failure to adopt available AI-assisted defensive tools may become harder to justify following a cyber incident.

Deeper dive: AI-based vulnerability testing to compete in the digital arms race

Global: AI regulatory update

In the October edition of our global AI bulletin, we looked at:

• Global – Organisation for Economic Co-operation and Development (OECD) publishes paper on agentic AI deployment and governance gaps

• Asia-Pacific– China’s AI Safety Governance Framework, Hong Kong’s agentic AI privacy guidance, Australia’s frontier AI cyber threat guidance for boards and Singapore’s personal data guidance for generative AI

• Europe – Ireland’s AI supervision insights report, EU AI Act enforcement and transparency rules, the launch of the AI Gigafactories procurement call and the EU Digital Omnibus on AI

• UK – The challenges of agentic AI in cyber defence, UK Parliament calls for comprehensive AI legislation, the FCA’s frontier AI cyber resilience review and the Government’s announcement of a new AI Taskforce

• US - New York begins RAISE Act implementation, California enacts child-safety AI laws, creates AI verification and auditor frameworks and launches an AI Cyber Defense Program, while New Jersey targets algorithmic pricing

Further AI deeper dives:

The Race for Power - Meeting the global energy demands of AI data centres

Linked In post - agentic AI as a revenue generation tool

When must advertisers disclose the use of AI?

The EU Digital Rulebook in Motion

Hong Kong: PCPD issues further guidance on best practices in the use of agentic AI

Singapore: PDPC Publishes Advisory Guidelines on Use of Personal Data in Generative AI

AI Governance Bill: Malaysia’s Next Step Towards the First AI Rulebook

California modifies AI transparency law weeks after it took effect: What SB 1000 changes and why it matters

Hidden instructions, compromised results: Reducing the risk of prompt injection in legal AI

With thanks to the following key contacts who contributed to this edition in addition to those featured below:  

• Nichola Donovan
• Judith Vieberink
• Madhulika Kanaujia
• Jessica Jesson
• Angela Kindness
• Sara Ellis
• Jonathan Botham