Tech & Sourcing @ Morgan Lewis

UK financial regulators recently published their supervisory expectations for critical third party service providers (CTPs) to the financial sector under the United Kingdom’s new regime extending regulatory oversight to CTPs. The final rules align with key themes of other regulatory regimes seeking to reinforce operational resilience (e.g., the EU Digital Operational Resilience Act (DORA)) around risk management, supply chain management, and incident management, among other areas.

The rapid adoption of generative AI (gen AI) is driving increased cloud consumption.

In the case of the ownership of intellectual property (IP) developed by a supplier as part of a service agreement with a customer, should the traditional position that the customer should own all developed IP always be the position agreed upon by the parties?

Our technology transactions, outsourcing, and commercial contracts team on October 30, 2024 held its annual industry summit in New York. The theme this year was Unleashing the Potential of Technology, with a focus on artificial intelligence (AI). Attendees included in-house counsel and sourcing professionals across a number of industries, including representatives from the client and vendor side. The diverse audience led to highly interactive discussions among some of the leading voices in the tech and sourcing fields.

The UK Financial Conduct Authority (FCA) on October 31, 2024 published observations and key lessons from how firms responded to the CrowdStrike IT outage. The outage caused disruption across several industries globally, and the FCA highlights for UK financial services the importance of ensuring operational resilience in order to minimize the potential impact of future events on consumers and markets.

Artificial intelligence (AI) is top of mind for all businesses looking to grow. Economic researchers point to AI as a key factor to boost the economy, and believe that AI could result in billions, if not trillions, of dollars in technology-related spending. However, this potential growth will not be possible in isolation; it requires massive amounts of supporting infrastructure.

Please join us for the next installment of our Startup & Accelerate webinar series, focusing on key artificial intelligence considerations for emerging companies. In this webinar, partner Michael S. Ryan and of counsel Brian P. Slough will explore important legal and technology issues and questions that startups and emerging companies should consider with respect to the development, licensing, and use of AI technologies.

One of the commonly advertised features of AI is that it is beneficial for automation and increasing productivity. When a company considers improving its productivity and employing an AI tool, it will typically go through a contracting process with the service provider and assess the terms of use and associated risks for the business. But what happens if an employee presses on and starts using an AI tool that was not vetted by the company?

As we continue to see AI steadily and increasingly be incorporated into service offerings, businesses should pay special attention to previously “standard” provisions when contracting for the provision and use of services that incorporate AI. This is especially true considering there may be situations where service providers use AI at some point in the workstream without the recipient even realizing.

In our latest blog post on preparing for the EU’s Digital Operational Resilience Act (DORA), entering into force on January 17, 2025, we take a look at second-level requirements under DORA covering the classification and reporting of major information and communications technology (ICT) related incidents. These requirements will need to be addressed through operational risk management frameworks and contract remediation efforts with technology vendors.