The EU’s Cyber Resilience Act (“CRA”) imposes end-to-end, product-level cybersecurity standards, risk management, and oversight obligations on those involved in the manufacture and supply of products with digital elements. It applies broadly to cover essentially all connected software and hardware
Debevoise & Pimpton Data Blog
The Debevoise & Plimpton Data Blog, published by the law firm Debevoise & Plimpton, covers legal developments and regulatory issues related to data privacy, cybersecurity, artificial intelligence, and emerging technologies. It addresses topics such as AI regulation in advertising, right of publicity laws, governance and risk management for AI adoption, and regulatory oversight reports from agencies like FINRA. The blog also discusses privacy enforcement trends, data security compliance, and cybersecurity incident response strategies. It provides insights on the intersection of technology and law, focusing on compliance obligations, risk mitigation, and evolving legal frameworks affecting businesses and financial institutions.
Blog Authors
Latest from Debevoise & Pimpton Data Blog
Does Your AI Need a Boss? The Case for Employee-Style Controls for Agentic AI
By Avi Gesser
Many large companies have spent decades developing controls to manage the risks associated with giving their employees authority and discretion. Those controls include defined responsibilities, technical limitations on access to confidential materials, layers of supervision, required approvals for certain actions,…
Debevoise Wins “Innovation of the Year” for STAAR 2.0
By Avi Gesser
We are very proud to announce that Debevoise has been named the “Innovation of the Year” firm winner at the 2026 New York Legal Awards for STAAR 2.0, our AI-powered client platform designed to help organizations accelerate responsible AI adoption.…
Refining Law Firms’ Crude Oil into Jet Fuel – Leveraging Legal Data for AI
Key Takeaways
- Proprietary legal data is a valuable AI asset—but only after refinement. Law firms and legal functions maintain deep reserves of precedents, work product, and institutional knowledge, but raw legal data is often duplicative, outdated, client-specific, or otherwise unsuitable
…
Federal Banking Agencies Announce Coordinated Approach to Handling Highly Sensitive Information During Examinations
On July 16, 2026, the Federal Reserve Board, the Federal Deposit Insurance Corporation (“FDIC”) and the Office of the Comptroller of the Currency (“OCC”) issued a joint statement and press release announcing a new, coordinated approach to handling highly sensitive…
White House Deputizes Private Companies in the Fight Against Cybercrime
By Avi Gesser
If cybersecurity professionals have been dreaming of “hacking back” and going after the cybercriminals, a new program may appear to offer the solution. It might even feel like a throwback to old western movies where the sheriff slaps a badge…
Bloomberg Law Features Debevoise’s AI Strategy and STAAR Platform
By Avi Gesser
Debevoise & Plimpton LLP was featured in Bloomberg Law for its approach to developing client-facing AI tools, highlighting the firm’s Suite of Tools for Assessing AI Risk (STAAR) and its strategy for leveraging curated legal knowledge to help clients navigate…
The Third Wave of EU AI Act Requirements Are in Force: Transparency Requirements & Supervisory Powers
By Avi Gesser
On 2 August 2026, the third major wave of requirements under the EU AI Act (the “Act”) entered into force. For many businesses, the most relevant changes fall into two key areas: (1) the AI transparency requirements under Article 50;…
What Does Responsible AI Adoption Look Like?
By Avi Gesser
Artificial intelligence is changing how legal services are delivered. At Debevoise, we are using AI to help our lawyers work more efficiently while maintaining the legal judgment, rigorous governance and quality standards our clients expect.
To provide greater transparency into…
The Need for Speed: Why Some Legal Work May Become Too Slow for Clients
By Avi Gesser
In 2026, many companies are using AI to identify opportunities, model risks, summarize diligence, compare precedents, stress-test assumptions, and prepare decision memos in days rather than weeks. But if the final step before action is “send it to outside counsel…