Skip to main content
Arrow left Back to Main Menu
London Market United Kingdom USA Asia Pacific Canada (English) Canada (French) France Germany Spain Latin America
  1. Arrow left Parent Page
  2. Arrow left Parent Page
  3. Arrow left Parent Page
  4. Arrow left Parent Page

Case Study: When Regulations Tighten and Data Rules Diverge

Global cyber and AI regulation is tightening fast. As lawmakers formalise new expectations around security, transparency and accountability, organisations face a growing, and often conflicting, set of obligations.

The result is a fragmented regulatory terrain: clearer rules, but far more complexity for any business operating across borders.

“Differences in how cyber risk is perceived across regions are often less about the objective threat landscape, which is global and interconnected, and more about experience, exposure, and institutional maturity.

“Guidance and supervisory expectations, especially in regulated sectorsCse St, now emphasise explainability, governance, data integrity, and cyber resilience, even where formal AI-specific legislation is absent.” Nathalie David, Partner, Clyde & Co.

Regulators worldwide are raising the bar on governance, explainability, data integrity and cyber resilience, even where no formal AI-specific law yet exists.

  • Regulatory borders are redrawing operational risk

    Different jurisdictions are now setting their own standards, creating a maze of compliance requirements.

    Europe: Mandatory resilience and strict oversight

    European rules29 focus on digital resilience, supply chain  integrity and rapid incident reporting. Key regulations include:

    • NIS230 – stricter network and information security
    • Cyber Resilience Act31 – hardware and software security requirements
    • DORA32 – financial sector  resilience and operational continuity

    Any business operating in the EU must meet these obligations, regardless of headquarter locations.

  • United States: Disclosure, transparency and data access

    US regulation operates differently:

    • SEC cyber disclosure rules33 – material incidents must be disclosed publicly, within strict timelines.
    • Annual governance reporting – mandatory transparency into cyber oversight
    • US CLOUD Act34 – US authorities can access data handled by US-based providers, even when stored overseas .

    This complicates cross border operations, especially when data sovereignty laws clash.

    US federal obligations for critical sectors

    Additional legislation includes:

    • CIRCIA35  – major breaches must be reported to CISA within 72 hours.
    • CFAA – longstanding federal law governing computer misuse.

  • Geopolitics now shapes tech stacks

    For years the model was simple:

    US builds → Europe buys → efficiency increases.

    Now, procurement includes a new question:

    What if access to essential software becomes political?

    Governments increasingly view data as a strategic asset:

    • They are asserting authority over where data lives
    • They are controlling how it moves
    • They are questioning which laws govern access
    • They are requiring sovereign alternatives

  • A routine incident can quickly turn complex when:

    • Jurisdictions demand conflicting actions
    • Local rules override global policies
    • Data location becomes a liability
    • Technology choices have become geopolitical decisions.

    “The key lesson here is that compliance and resilience are no longer competing priorities. Firms that treat data sovereignty as a core governance issue ... are better positioned to meet cross-border obligations and maintain trust in an increasingly fragmented regulatory landscape.” Ian Birdsey, Partner, Clyde & Co.

The Goal - Make Complexity Manageable, Not Minimal

Complexity cannot be eliminated – but it can be managed. Resilience depends on reducing friction between:

  • Regulatory expectations
  • Operational capability
  • Geopolitical pressure
  • Data sovereignty constraints

The winning organisations will be those who build governance models that expect change, absorb new rules and adapt without disruption.

Where to start:

In a world of divergence, resilience becomes a continuous discipline

The organisations best placed to succeed will be those that:

  • Map dependencies
  • Anticipate jurisdictional pressure
  • Monitor regulatory drift
  • Govern AI systems responsibly
  • Ensure every supplier, and every system, can withstand regulatory shocks

In a landscape defined by accelerating divergence, resilience is not optional: it’s the only way to stay compliant, trusted and competitive.

[29]    EU Cybersecurity Strategy | Shaping Europe’s digital future  

[30]    EU Cybersecurity Strategy | Shaping Europe’s digital future  

[31]  Cyber Resilience Act | Shaping Europe’s digital future  

[32]  Digital Operational Resilience Act (DORA) - European Insurance and Occupational Pensions Authority  

[33]  SEC.gov | Cybersecurity Disclosure  

[34]  Criminal Division | CLOUD Act Resources  

[35]  Federal Register :: Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) Reporting Requirements  

[36]  https://www.moneymarketing.co.uk/news/fca-tightens-reporting-rules-as-cyber-and-third-party-risks-rise

[37]  Cyber Security and Resilience Bill - GOV.UK  

[38]  France to ditch US platforms Microsoft Teams, Zoom for ‘sovereign platform’ citing security concerns | Euronews  

[39]  Justice Manual | 9-48.000 - Computer Fraud and Abuse Act | United States Department of Justice  

Contact us

BROKERS AREA

CLIENT AREA