The Convergence of Risk: Cyber, Data and AI Disputes | Insight

Rapid technological innovation and evolving regulations are outpacing the development of organizations’ cyber, data and AI risk frameworks, creating operational risk and cross-border reporting challenges.

Organizations now face a high-stakes and multifaceted risk landscape spanning enforcement, operational, reputational and dispute risk. This reflects headline findings from our 2026 Global Dispute Forecast , where technology and geopolitical pressures were cited as prominently driving disputes risk. In addition, cyber and data topped the list as respondents’ greatest dispute concern. We’ve asked 600 senior decision-makers to now identify what the true challenges are and how they are tackling them. Among other points of tension, we found that over half of surveyed respondents see risk management and governance around AI as major challenges, while growing compliance demands add further complexity.

Explore the full insights below.

The rapid emergence and development of AI and other new technologies are creating new waves of uncertainty around cyber risk readiness. More than half of respondents express concerns regarding risk management associated with new technology implementation, highlighting the need for adaptable solutions and frameworks capable of accommodating future developments.

Differing definitions of “sensitive information” also create shifting goal posts for businesses. 41% of respondents say that handling information sharing between regulators and law enforcement — and complying with increased obligations for organizations designated as critical infrastructure — are major challenges in mitigating potential cybersecurity risk.

Brian Hengesbaugh , a partner in Chicago, points to a recent development in California that underscores a growing regulatory trend whereby governments no longer view cyber preparedness as a “nice-to-have.” "Under the California Consumer Privacy Act cyber audit rules, with its 18 elements, companies must conduct an annual audit and file under penalty of perjury with the California Privacy Protection Agency. Companies that subsequently experience an exploit of a vulnerability that should have been addressed as per their audit report (e.g., failure to implement Multi-Factor Authentication (MFA)) could be exposed to increased regulatory enforcement risk and expanded claims in any consumer and third-party litigation," says Hengesbaugh.

Governments are introducing new regulations requiring organizations to embed cyber resilience into their operations. What that looks like in practice is not always clear. With the rapid evolution of cyber landscapes, the question of effective governance should be firmly on the board’s agenda. Vin Bange , a partner in London, highlights the need for leaders to ask questions that not only cover areas of compliance, best practice and current standards, but more importantly, to focus on questions around what the convergence of these three areas look like in today’s heightened and multi-faceted threat landscape. “There is a clear need for more rigorous testing and assurance against these standards, which themselves are still developing and require ongoing discussion and refinement,” notes Bange. “From a governance perspective, prolonged disruption from a cyber incident means conversations with external auditors, shareholders and investors need to take place.” While it is a positive sign that only 24% of respondents are concerned establishing board-level accountability, the continually changing threat landscape necessitates ongoing conversations. Singapore principal Andy Leck notes: “Regimes are increasingly imposing director and officer liability, including potential criminal exposure for senior management. Such exposure can ultimately lead to an unforeseen and unnecessary drain of talent, resource and funds.” This is echoed by Bange, who cautions that organizations should look at the responsibility of directors with regards to both board notifications and corporate governance.

57% of energy, mining and infrastructure companies cite managing risk arising from the implementation of new technology as their top challenge.

Besides unclear pricing and slow-moving regulations for new technologies, risk management can also be held back by long approval times for infrastructure changes and the difficulty of working with older systems.

Jurisdiction highlight

Respondents in the UK (48%) and the US (47%) are the most concerned complying with increased obligations for organizations designated as critical infrastructure of any other jurisdiction surveyed.

Both the UK and the US are calling for fast reporting of cyber incidents and making boards explicitly accountable. The UK's Cyber Security and Resilience Bill strengthens protections for critical infrastructure. In the US, companies are expected to fully comply with updated SEC requirements.

49% of healthcare and life sciences organizations are concerned responding to regulatory investigation or enforcement action. The expansion of multi-agency and cross-border investigations may be exacerbating this concern, alongside sector-specific triggers such as global clinical trials, specific sanctions or export-control sensitivities and cross-border pricing practices.

Jurisdiction highlight

In the event of a cyber breach, respondents in Germany are more concerned ensuring business continuity (51%) and responding to regulatory investigation or enforcement action (46%). Germany currently has a complex compliance framework, with no single cybersecurity law, and companies face the added pressure of multiple notification obligations across GDPR (General Data Protection Regulation), Bundesamt für Sicherheit in der Informationstechnik (BSI), Network and Information Systems Directive 2 (NIS2) and more.

Healthcare and life sciences companies are the most concerned that a lack of effective frameworks, oversight and guardrails around the use of AI-related systems and data could open their organization up to a potential dispute (62%). In particular, algorithmic errors and AI hallucinations or automation bias may create risks across product liability and medical malpractice. Patient data sensitivity also raises concerns over improper data usage, and re-identification risks even when data is anonymized.

Jurisdiction highlight

Respondents in the US are most concerned a lack of effective frameworks, oversight, and guardrails around the use of AI related systems and data (59%) opening their organization up to a potential dispute. Fragmented guidance and regulation in the US across Federal Trade Commission (FTC), Equal Employment Opportunity Commission (EEOC) and Securities and Exchange Commission (SEC), and state laws create a particularly challenging environment for US businesses.

As regulators address cyber risk as a national security concern and governance structures are tested by more frequent and sophisticated attacks, integrated legal advice can help to address the complex risks posed by emerging technologies like AI as well as regulatory compliance challenges and cross-border obligations. Organizations should:

Our flagship Global Disputes Forecast survey revealed that in 2026, geopolitical flux, technology and supply chain disruption are driving disputes risk externally, while resource constraints mean that organizations must also be intentional and flexible in where they allocate resources.

With robust disputes preparedness key to building organizational resilience, we commissioned another wave of research to delve further into these initial findings. In this series, we explore the intersection of key risk areas and identify how respondents are taking action.

We surveyed 600 senior decision-makers with oversight or key roles in legal, risk, compliance, or tax functions. Respondents included Directors in Legal, Risk, Compliance, or Tax, Heads of Function/Departmental Leaders, and C-suite roles such as General Counsel, Chief Legal Officer, Chief Risk Officer, and Chief Compliance Officers.