Practice I — Corporate
Cross-border regulatory architecture and strategic counsel for institutional clients.
AI Act, GDPR, NIS2, DORA, DSA, DMA. AI governance frameworks. Data protection and cross-border transfer instruments. Crisis mediation. Board-level counsel on tech-and-regulation intersections.
01
The 2024–2026 regulatory cycle has redrawn the operating ground for any organisation that processes data, deploys algorithms, or operates critical infrastructure. The AI Act, NIS2, DORA, the DSA, the DMA, and the CRA are no longer prospective. They are operational.
Corporate Strategy & Legal Architecture treats this regulatory surface as terrain. Engagements deliver compliance positions structured for institutional clients: defensible architectures, decision-rights matrices, board-grade documentation. The output is structural, not advisory.
02
Three pillars under one operating doctrine.
01
Risk tiering and governance frameworks for high-risk and limited-risk AI systems under EU Regulation 2024/1689.
02
GDPR audits, DPIA scaffolding, and architecture for cross-border data transfers.
03
Policy mapping for C-level decision-makers operating in complex multi-jurisdictional environments.
03
The instruments. Read fluently.
Regulation (EU) 2024/1689
High-risk classification, conformity assessment, foundation-model governance.
Regulation (EU) 2016/679
Data-subject rights, lawful basis, transfer instruments, accountability.
Directive (EU) 2022/2555
Essential and important entities, incident reporting, supply-chain security.
Regulation (EU) 2022/2554
Digital operational resilience for financial entities and ICT third parties.
Regulation (EU) 2022/2065
Platform liability, transparency obligations, very-large-online-platform regime.
Regulation (EU) 2022/1925
Gatekeeper obligations, interoperability, antitrust adjacencies.
Regulation (EU) 2024/2847
Cybersecurity for products with digital elements; vulnerability handling.
United States, 2018
Extraterritorial law-enforcement access; conflict mapping with EU regimes.
04
From brief to defensible structure.
Written brief evaluated within 72 hours. Mandate scope, jurisdictions, decision authority, and timeline confirmed in a scoping memo.
Regulatory exposure mapped against operating reality. Gap analysis delivered as a structured technical-legal report.
Bilateral contract executed. Compliance architecture, governance frameworks, and decision-rights matrices designed and validated with internal counsel.
Implementation supported by ongoing advisory retainer. Standing access to the Managing Partner for board-level escalations and crisis mediation.