NOVEMBER 2026
Briefed
Legal insights from Baker McKenzie to power your business globally
Baker McKenzie’s new Germany Managing Partner, Anahita Thoms, introduces the year-end issue of Briefed In with her take on why economic security is now a governance challenge.
Also in this issue, we explore the forces shaping digital infrastructure transactions, the state of online safety regulations and the global pay transparency landscape. And we consider why minority stakes can trigger major competition concerns and how multinationals are approaching disputes preparedness.
Foreword:
Anahita Thoms Managing Partner, Germany
Data centers have evolved from traditional real estate assets to strategic infrastructure at the very center of the global AI boom. As demand for computing capacity accelerates, securing the power, cooling, storage capacity, data flows and connectivity needed for future expansion is becoming a central concern not just for customers but also for investors, governments and utilities. This underscores not only the strategic importance of digital infrastructure, but also its impact on energy systems, local communities and economic development.
Against this backdrop, the success of transactions in this sector often depends on factors beyond traditional commercial and financial considerations. National security and foreign investment reviews, access to power, export controls, sanctions and supply chain sourcing and resilience are shaping valuation, deal certainty and long-term growth prospects.
For many years, the primary challenges in developing data centers were securing suitable land and connectivity. Today, the focus has shifted to securing reliable power and associated grid augmentation costs. As AI workloads drive unprecedented demand for computing capacity, access to electricity and grid connections has become a critical factor in determining whether digital infrastructure projects can be developed and scaled.
Read more
REMIT II Explained: Expanded scope, enhanced reporting obligations, new compliance risks
The Global Rollout of Online Safety Enters a New Phase
Amid a complex geopolitical backdrop, governments are competing to secure a leading position in advanced technologies as well as being an attractive investment option for training of AI models in data centers. Access to AI chips and other critical components is emerging as a potential constraint on the development and long-term viability of digital infrastructure assets.
Companies are adapting to these dynamics by building greater flexibility into procurement arrangements and investment plans through alternative sourcing, contingency planning and other measures designed to respond to evolving regulatory and trade developments.
Supply chain resilience has become an important diligence and valuation consideration. The expansion of the US Section 301 tariffs to imports from more than 60 economies highlights how quickly trade policy can disrupt supply chains, increase costs and influence the economics of digital infrastructure investments.
Online safety regimes around the world are converging around a common principle: digital service providers are accountable for mitigating online harm. Regulators are imposing proactive obligations on platforms to manage risks, remove or minimize harmful design features, protect vulnerable users, improve transparency and embed safety into the design and operation of their services.
A core principle of this shift is a growing focus on protecting children online. Child online safety previously sat on the margins of platform governance, largely implemented through parental controls and content moderation. That is changing. Regulators are looking beyond the management of individual pieces of content hosted on platforms and scrutinizing the systems, features and algorithms that shape children's online experiences and interactions. The focus is no longer limited to harmful content but extends to whether products, algorithms and user journeys are designed in ways that create or amplify risks in the first place.
In the US, multiple states, as well as Washington, DC, have enacted statewide or local pay transparency laws. The requirements vary: states such as California, Colorado and New York mandate that pay scales or salary ranges are included in every job posting, while other states require disclosure upon request. Ohio has local laws but not statewide law. Some cities have their own requirements. Requesting a candidate’s salary history is now also prohibited in more than 20 states.
Rapid technological innovation and evolving regulations are outpacing the development of organizations’ cyber, data and AI risk frameworks, creating operational risk and cross-border reporting challenges.
More than half of respondents express concerns regarding risk management associated with the implementation of new technology, highlighting the need for adaptable solutions and frameworks capable of accommodating future developments.
43% of respondents cite business disruption in the wake of a cyber incident as another top challenge. Real-world examples illustrate how cyber incidents can lead to prolonged operational downtime and substantial revenue loss, underlining the importance of frequent and nuanced tabletop exercises for incident preparedness as opposed to sporadic or superficial testing.
Lastly, AI-related risks are proliferating, with more than half of organizations citing new regulations (56%), a lack of governance frameworks (54%) and intellectual property risk (51%) among their top concerns when it comes to dispute exposure. As regulatory frameworks continue to evolve, these foundational risks are likely to become an increasingly important source of risk.
1. Cyber, data and AI disputes
As Europe’s largest economy, and one of its most export-dependent, Germany has a strong interest in preserving open markets and global supply chains. Its economic success has been built on international trade, cross-border investment and access to global markets. However, growing geopolitical tensions and concerns over strategic dependencies have prompted German policymakers to reassess how to balance economic openness with resilience and security.
Read more
are considering to use AI tools
Planning
50%
Disclaimers
Privacy & Cookies Statement
Attorney Advertising | © 2026 Baker McKenzie
Catch up on previous issues
In
When national security shapes the deal
Regulatory risk is influencing digital infrastructure transactions well before a deal is signed. Sellers are assessing foreign investment and national security considerations from the outset of a sale process, with potential approval hurdles often influencing bidder selection, digital infrastructure end-use, transaction timelines and execution risk.
“Regulatory risk is now a key consideration from the outset of a transaction. We're seeing parties address potential foreign investment approval conditions much earlier in the process to improve deal certainty.” - Simon De Young, Partner, Melbourne
Regulatory considerations are also shaping deal documentation. Sale agreements are becoming more detailed in their treatment of foreign investment approvals and the types of conditions that buyers may be required to accept. Longer review periods are also affecting transaction terms, with parties building greater flexibility into deal timelines and focusing more intently on ticking fee arrangements in locked box transactions, covenants regulating the conduct of a target business pending completion of a transaction and material adverse change conditions. Regulators are commonly relying on conditional approvals rather than binary decisions, with requirements that may relate to governance arrangements, access to sensitive operational information, data or cybersecurity controls, as well as senior management or board composition.
National security considerations are also reshaping how transactions are structured. Rather than pursuing outright control, investors may seek exposure through consortiums, minority investments or strategic partnerships that provide access to critical infrastructure while addressing approval requirements.
"People still want exposure to digital infrastructure assets, but foreign investment restrictions may mean they can't take control. That's where partnerships, consortiums and alternative investment structures become important."
- Derek Poon, Partner, Hong Kong
"We are increasingly seeing investors structure digital infrastructure projects as platforms for growth, combining development expertise, operational capabilities and long-term capital to support expansion beyond a single market.”
- Agnieszka Skorupińska, Partner, Warsaw
The heightened scrutiny extends beyond deal structuring into transaction diligence. Investors are placing greater emphasis on data rights, cybersecurity, privacy compliance, supply chain sourcing of equipment and technology and government customer relationships, while preparing earlier for foreign investment and national security reviews that require detailed disclosure of ownership, financing and investment structures. They are also assessing whether a change of ownership could create additional regulatory risk following completion.
Power is the new bottleneck
"For digital infrastructure investors, power is no longer just an operational consideration. Access to reliable and scalable energy supply is increasingly shaping where capital is deployed, how assets are valued and the long-term viability of projects."
Anne Petterd, Partner, Sydney
Reliable power is now a critical diligence issue, with supply resilience, future capacity constraints and long-term energy procurement strategies underpinning a target's value and growth potential.
REMIT II
The growing importance of power to digital infrastructure investment is occurring alongside increased regulatory scrutiny of energy markets. In the European Union, REMIT II expands oversight of wholesale energy markets and introduces a more rigorous framework for monitoring energy market activity.
While REMIT II is not aimed specifically at data centers, it highlights a broader trend: as power becomes a strategic component of digital infrastructure, the regulatory frameworks governing energy markets are becoming more relevant to investors. Long-term energy arrangements, storage solutions and other procurement strategies may carry regulatory obligations that affect operational flexibility and deal risk.
Impact on M&A: As access to power becomes a more important driver of asset value, due diligence may extend beyond energy supply arrangements to include the contractual, governance and compliance frameworks that support a target's long-term energy strategy. Increased regulatory scrutiny of energy markets may also influence transaction structures, governance arrangements and operational flexibility, particularly where long-term power procurement is central to an asset's value proposition.
Partner, Brussels
David Haverbeke
Connect with our energy experts in Europe:
Partner, Brussels
Gregory Lebrun
Partner, Madrid
Antonio Morales
Partner, London
Richard Blunt
The geopolitics of digital infrastructure
Read more
about the US Section 301 tariffs
The surge in demand for AI infrastructure is creating significant opportunities for investors but also introducing new sources of deal risk. As digital infrastructure takes on a larger role in the global economy, power, regulation and geopolitics are playing a growing role in shaping transaction outcomes and long-term value.
Looking ahead
Contacts
Partner, Melbourne
Simon De Young
Partner, Hong Kong
Derek Poon
Partner, Warsaw
Partner, Sydney
Anne Petterd
Despite significant differences in legislative frameworks, regulators across major jurisdictions are increasingly pursuing the same objective: requiring platforms and digital services to identify, assess and mitigate online harms before they occur, particularly those affecting children.
Regulatory shifts underscore a common objective
Contacts
In practice, this would require a robust set of systems and processes, including measures such as age assurance tools, safer default settings for minors, proactive identification and removal of problematic content and conduct, and enhanced reporting and complaints mechanisms. The reforms would also increase scrutiny of algorithms and AI-driven systems that shape users' online experiences, including increasing transparency and user choice in relation to such design features. These proposed reforms sit alongside existing wider online safety initiatives, including Australia's world-first Social Media Minimum Age legislation, which requires the removal of U16 or under 16 accounts from social media services, with significant penalties for non-compliance.
Most significantly, Australia's online safety regime extends well beyond traditional social media platforms. The regime applies across a broad range of digital services, essentially covering all businesses with an online presence of any kind, as well as supporting services such as equipment and hosting providers. As a result, businesses that do not consider themselves technology or social media companies will likely nevertheless find themselves within scope.
“The level of obligation placed upon each organization is relative to the role it plays in the delivery of online services. For example, a hosting service would have different responsibilities to a social media service provider. The effect of this is that any organization providing a digital service, such as a company website or even perhaps enterprise systems for their employees, may find itself regulated under Australia’s online safety laws—moving away from the traditional idea that only social media companies or digital platforms are captured.”
Adrian Lawrence, Partner, Sydney
John Groom, Partner, London
The EU's Digital Services Act (DSA) adopts a risk-based approach to online safety, imposing obligations on online platforms to identify, assess and mitigate systemic risks arising from their services. The framework places particular emphasis on protecting minors, increasing transparency around algorithms and recommender systems, and strengthening accountability for very large online platforms and search engines.
Rather than focusing solely on harmful content, the DSA requires platforms to examine how services are designed and how features such as recommender systems, content curation tools and user interfaces may contribute to risk. In practice, this may require changes to content recommendation processes for minors, greater algorithmic transparency, stronger privacy protections, age assurance measures and design choices that reduce exposure to harmful or inappropriate content.
“The UK's Online Safety Act reflects a broader global shift in regulatory thinking. Regulators are increasingly focused not only on harmful content itself, but on whether a service's design, features, recommendation systems and governance arrangements create foreseeable risks. For businesses, online safety is becoming a core product governance issue that must be considered from the earliest stages of product design and development.”
As an early mover in the online safety space, Australia demonstrates where regulation is heading globally: broader regulatory scope, greater corporate accountability and a requirement for organizations to identify and avoid or mitigate online harms before they occur.
Under the Online Safety Act 2021, the Australian Government has developed a proposed Digital Duty of Care framework, with draft legislation released in September 2026. The proposed duty would require digital service providers to ensure, as far as is reasonably practical, a “safe online environment” supported by risk assessments, safety-by-design principles and enhanced transparency obligations.
Australia
UK and EU
Elsewhere, the UK's Online Safety Act 2023 introduces a comprehensive framework requiring online services to assess and mitigate risks arising from illegal and harmful content, with a particular focus on protecting children. Regulated by Ofcom, the regime includes obligations relating to risk assessments, age assurance, child safety measures, transparency and platform governance, reinforcing the increasing emphasis on platform accountability and safety-by-design.
Unlike the UK, EU and Australia, the US has not adopted a comprehensive online safety framework. Instead, regulation is developing through a patchwork of federal and state initiatives focused on children's privacy, online safety and platform accountability. As of mid-2026, roughly 20 states have enacted laws specifically regulating minors’ use of social media, a handful of states have enacted standalone age-appropriate design code legislation and several others have incorporated comparable protections for minors into broader state privacy laws.
These laws vary significantly in both their scope and their approach. Some are based on whether a service is directed to children, has actual knowledge that a user is a child, or is “reasonably likely” to be accessed by children. Others target particular categories of services, such as social media platforms, app stores or AI companion chatbots. The relevant age thresholds also vary, with some requirements focused on children under 13, others on users under 16, and still others extending protections to all minors under 18. Parents play different roles across these regimes as well: some laws require parental consent before a minor can open an account or access particular features, while others require parental controls, notices or tools that allow parents to manage a child’s experience.
“The US may have a fragmented regulatory framework, but the enforcement message is increasingly consistent. Federal and state regulators are pursuing both the largest technology platforms and much smaller online businesses, and the consequences can be significant. Any company operating an online service that could reasonably attract teenagers—not just a service designed specifically for children—should be taking these developments seriously and considering youth privacy and safety as part of its core product compliance program.”
Jonathan Tam, Partner, San Francisco
The substantive requirements are similarly diverse. Some states have adopted highly targeted rules governing particular product features—for example, addictive or personalized feeds, autoplay, push notifications, direct messaging or AI companion chatbots—while others take a broader age-appropriate-design approach that requires businesses to assess and mitigate risks across the design and operation of services likely to be accessed by children. Increasingly, these regimes also address age assurance, privacy-protective defaults, targeted advertising, data minimization, risk assessments and the use of children’s data to personalize content.
The result is a particularly complex compliance environment: companies may face different triggers, age bands and substantive obligations from state to state, and a number of these laws remain subject to constitutional challenges or injunctions.
Key trends
Safety-by-design is becoming the norm Regulators are increasingly scrutinizing product features, algorithms, recommender systems and default settings, rather than focusing solely on content moderation.
Child protection is the primary policy driver Many new online safety laws are designed to reduce risks to minors, leading to requirements around age assurance, safer defaults and enhanced safeguards for younger users.
Proactive risk management is replacing reactive enforcement Organizations are increasingly expected to identify, assess and mitigate risks before harm occurs through risk assessments, robust governance frameworks and ongoing monitoring.
Platform accountability is increasing Regulators are imposing greater transparency, reporting and compliance obligations alongside stronger enforcement powers and significantly higher penalties for non-compliance.
What this means for business
Online safety must be embedded in product development, governance and risk management from the outset. Organizations that build safety considerations into the design and operation of their products will be better placed to meet evolving regulatory expectations, reduce regulatory risk and adapt to future reforms. In the emerging regulatory landscape, online safety is no longer simply a moderation issue. It is increasingly a core product governance discipline.
Organizations should increasingly assess how recommendation systems, AI-enabled features, direct messaging functions, user-generated content tools, age assurance measures and reporting mechanisms may create or amplify risks particularly for children and other vulnerable users.
Contacts
Partner, Sydney
Adrian Lawrence
Partner, London
John Groom
Partner, San Francisco
Jonathan Tam
Authors
North America
“While there is no federal pay transparency law, companies operating in the US, or considering entering the market, must work through a patchwork of state and local laws. Beyond the financial penalties, organizations that fail to keep pace face reputational damage and losing out on key hires.”
Michael Brewer, Partner, San Francisco
More states are joining the salary transparency movement. From July 2026, all job postings and hiring advertisements in Virginia must include a wage or salary range for the position and employers are prohibited from seeking wage history. Other states have also introduced bills, as the march towards greater transparency continues unabated.
In Canada, the focus on pay transparency has sharpened, with provinces such as British Columbia, Ontario and most recently, New Brunswick, introducing new requirements. For example, employers in Ontario with 25 or more employees must comply with new job posting requirements including salary disclosure, AI hiring disclosure, candidate follow-up timelines and expanded record-keeping.
Europe
June 2026 brought the deadline for EU Member States to transpose the EU Pay Transparency Directive into national law. However, only a handful of countries, including Slovakia, Italy, Lithuania and Greece, have fully or substantially implemented the Directive, with most remaining at differing stages of drafting legislation.
United States
For employers, this means a period of regulatory complexity rather than immediate harmonization. For multinational organizations operating across Europe, the primary challenge will be managing differing national approaches.
“Some countries are likely to go beyond the Directive's minimum requirements, introducing broader obligations, stricter remedies or more extensive reporting obligations, while others may take a more limited approach. This means organizations will need flexible compliance frameworks that allow for local adaptation rather than applying a single standardized approach across all jurisdictions.”
David Diaz, Partner, Madrid
The Directive introduces a range of measures intended to improve pay transparency and strengthen equal pay rights during both recruitment and employment. Employers will be required to provide salary information, including pay ranges, to candidates and will no longer be permitted to ask about salary history. Employees will also gain enhanced rights to request information regarding their own pay and the pay of comparable colleagues.
Another major obligation relates to gender pay gap reporting. Larger employers will need to report on gender pay disparities using defined metrics, creating greater visibility and accountability around pay practices. Where reporting identifies unjustified pay gaps, employers may be required to conduct formal joint pay assessments with employee representatives and develop plans to address any disparities.
The Directive places greater emphasis on employers being able to justify their pay decisions. For many businesses, this will require more sophisticated job architecture, clearer grading structures and better-defined salary bands. The Directive also strengthens enforcement mechanisms, including shifting the burden of proof in some equal pay claims and expanding access to compensation and collective enforcement actions.
Asia Pacific
This year, across the Asia Pacific region, corporates have faced greater accountability for transparency, though most jurisdictions have stopped short of requiring companies to publish salary ranges.
“We are starting to see governments in certain APAC jurisdictions focus on gender pay issues. While reporting requirements differ across the APAC region, the direction of travel is clear: legislatures and regulators are seeking more visibility into gender pay outcomes and placing more scrutiny on employers.”
Jonathan Isaacs, Principal, Hong Kong
In Australia, most private sector employers with 100 or more employees are required to report gender equality data, including remuneration data, to the Workplace Gender Equality Agency (WGEA). WGEA has the power to, and does, publish this data. In addition, Australia’s prohibition on pay secrecy, introduced in late 2022, gives employees the right to disclose or discuss their remuneration terms. Together, these measures create a robust framework for gender pay transparency in Australia. Employers with over 500 employees in Australia are now also required to select and meet or demonstrate improvement towards gender equality targets and have policies and strategies in place to support relevant gender equality indicators.
Effective April 2026, Japan amended its Act on Promotion of Women’s Participation and Advancement in the Workplace, lowering the reporting threshold for gender wage gap disclosures from companies with more than 300 employees to those with 101 or more employees. It also introduced a requirement for companies with 101 or more employees to disclose the proportion of women in management positions.
South Korea, which has one of the highest gender wage gaps among OECD nations, has yet to formally mandate reporting of gender and employment data, though legislative momentum is building. A bill proposing mandatory gender pay gap reporting for workplaces with 300 or more employees was introduced in July 2026, with the majority party targeting implementation by March 2027.
Key takeaways
Act early to strengthen pay governance
Identify representative structures
Stress-test job architecture and equal value methodology
Review data and systems readiness
Audit recruitment and onboarding practices
Consider how to treat non-standard worker populations
Multinationals navigating global pay transparency frameworks should act now to strengthen pay governance, rather than waiting for every aspect of local implementation to be settled. Processes should have enough flexibility to adapt as local rules develop.
In addition to navigating evolving obligations, these steps will also help companies reduce litigation risk and respond confidently to increased scrutiny from employees, regulators and employee representatives.
Why Minority Stakes Can Trigger Major Competition Compliance Concerns
In Focus: Global pay transparency
Mandates for pay transparency are on the rise, but uneven implementation of legislation and a fast-moving landscape mean that international companies are struggling to adapt. Baker McKenzie’s chairs of Employment & Compensation take a look at the global picture.
Minority investments have become an increasingly common feature of dealmaking, allowing companies to build strategic relationships, access innovation and enter new markets without taking full control. This is particularly evident in sectors undergoing significant transformation, where such investments are often used to test new business models, support collaboration and accelerate growth.
But a minority stake does not necessarily equate to low risk of regulatory scrutiny. Competition authorities are paying closer attention to these structures due to concerns over influence, coordination, data governance and the potential consolidation of market power. In some cases, transactions involving non-controlling shareholdings can trigger formal filing obligations and be subject to detailed scrutiny. Even where they do not trigger formal filing obligations, there is a risk of enforcement action and potentially fines where the non-controlling shareholding is acquired in a competitor, whether in the supply of products or services or in purchasing markets, including for talent.
Understanding where and when those risks arise has become critical given the growing use of minority investment structures. While the trend predates the AI boom, recent market dynamics have accelerated it. Higher financing costs, increased sovereign investment activity and the substantial capital requirements of AI-related projects have led more investors to partner on deals, often through consortium structures involving private equity sponsors, sovereign wealth funds and strategic investors. These arrangements can help align interests, share risk and provide access to capital and expertise, but they may also create competition law concerns where investors acquire governance rights, board representation, access to commercially sensitive information or other forms of influence that go beyond a purely passive investment.
When minority stakes start to look like control
The most common trigger for scrutiny is where a minority investment comes with additional governance rights, such as board representation, veto rights, other governance mechanisms or even just access to information or other economic dependencies that give the investor the ability to influence the target’s strategic commercial decisions on the market.
In these cases, regulators may conclude that the investor has acquired de facto control, even without a majority shareholding. This would bring the transaction squarely within standard merger control rules.
However, competition scrutiny is not limited to these more obvious forms of control.
Below control, but still notifiable
In a growing number of jurisdictions, minority stakes can trigger merger control filings even where no de facto control is acquired.
In these regimes, simply crossing certain shareholding thresholds can be enough. For example:
For companies, this is often the first major surprise, particularly where a transaction is structured as a purely financial or strategic minority investment.
The United States takes a different approach. There is no specific percentage threshold below which acquisitions of voting securities are automatically considered non-reportable. Even relatively small minority investments can raise merger control concerns, and investors should not assume that a specific level of ownership is exempt from scrutiny.
Material influence and lower thresholds for scrutiny
Some authorities capture transactions that fall short of control through more flexible tests.
The UK’s “material influence” test is a good example. It enables the Competition and Markets Authority (CMA) to review acquisitions where a minority shareholding enables the investor to influence the target’s commercial policy, even where that influence is relatively limited. In practice, this can apply to shareholdings below 15%.
The CMA has reviewed partnerships between large tech companies and AI startups, including a sub-1% stake with no special rights, and a minority position without voting rights or exclusivity.
In both cases, the CMA concluded there was no material influence. However, the fact that these transactions were reviewed at all is telling. It signals that authorities are actively monitoring minority investments in strategically important sectors and are prepared to assess them on a case-by-case basis.
Similar concepts can be seen elsewhere in Europe. In Germany, for example, a shareholding below 25% may still be reviewed if it confers a “competitively significant influence.” In the air transport sector, a transaction was reviewed involving a 10% stake, combined with board representation and commercial links.
Enforcement risk beyond filing
Importantly, the risk is not limited to merger control thresholds.
Even where no filing is required, minority stakes can still create competition law risk, particularly where the investor and the target are competitors. Competition concerns may arise even where the investment is entirely non-controlling and does not confer any special governance rights.
A recent investigation by the European Commission in the food delivery sector focused on the role of a minority stake in a competitor. The issue was not the interest itself, but how it was used to:
access commercially sensitive information
influence decision-making
align business strategies between competitors, including in respect of hiring each other’s employees
This marked the first case in which the Commission imposed fines for the anti-competitive use of a minority shareholding. Other investigations are ongoing and so it is unlikely to be the last.
In the United States, Section 8 of the Clayton Act prohibits certain interlocking directorates, meaning a person generally may not simultaneously serve as a director or officer of two competing corporations if the companies meet specified size thresholds and are competitors such that an agreement between them would violate the US antitrust laws. While Section 8 contains several statutory exceptions, including de minimis exceptions based on the amount of competitive sales between the firms, it still warrants attention from a compliance perspective.
What dealmakers need to consider
Against this backdrop, companies need a structured and proactive approach to minority investments:
Assess merger filing requirements early and across jurisdictions Even small stakes can trigger notification requirements depending on local rules.
Look beyond shareholding percentages Authorities will consider governance rights, board representation (including whether cross-directorships between competitors are created) and commercial relationships.
Balance commercial objectives with regulatory implications Be prepared to consider slightly reduced governance rights, if commercially acceptable, that would otherwise entail lengthy and costly regulatory delays.
Evaluate the competitive relationship between the parties Investments in competitors, or within the same supply chain, carry heightened risk.
Consider the need and/or wisdom of putting guardrails in place Particularly to allay any concerns over access to sensitive information as between players in the same industry.
Plan ahead Future increases in shareholding, through share conversions or incremental acquisitions, may trigger additional merger filings and expose earlier transactions that were not notified.
Contacts
Partner, Washington, DC
John J. Fedele
Partner, London
Luis Gomez
Partner, Palo Alto
Aarthi Belani
Senior Associate, Hong Kong
Vivian Tsang
Power, Policy and Geopolitics: The forces shaping digital infrastructure transactions
The Convergence of Risk: Today's pressures, tomorrow's disputes
Disputes are running continuously, concurrently and at a pace that few organizations can comfortably manage. In this environment, a purely reactive approach is no longer enough, particularly as the risk of business disruption grows, external pressures intensify and organizations grapple with limited resources. Recognizing that robust disputes preparedness is key to organizational resilience, we commissioned a wave of research to dive deeper into our initial 2026 Global Disputes Forecast findings. We asked 600 senior decision-makers across the globe for their views on navigating cyber, tax, trade, antitrust and investigation risk.
Key actions
Prepare for cyber incidents through robust governance, business continuity planning and investment in resilience.
Enhance governance and risk management frameworks for AI and emerging technologies, ensuring compliance and effective oversight to address regulatory gaps.
Remain current with evolving legal requirements and cross-border reporting obligations and facilitate timely, accurate regulatory responses during a cyber incident.
Obtain legal guidance early in developing business continuity, preparedness and resilience strategies to break down siloes across departments.
Regulatory complexity, heightened government enforcement and persistent uncertainty are converging to drive tax dispute risk to new levels.
Respondents in tax roles identify a dual-edged challenge when it comes to external tax dispute exposures: keeping up with complex and swiftly changing regulation, whilst also preparing for increased scrutiny and enforcement by tax authorities. All of this is occurring within an environment shaped by continued uncertainty and geopolitical pressure.
The systemic nature of tax disputes requires organizations to be prepared when potential issues inevitably arise. Yet managing tax disputes across borders is made more difficult by internal limitations such as resource constraints (43%). That can in turn exacerbate external challenges, such as coordination difficulties (41%) and jurisdictional complexity (40%), according to tax respondents.
34% of respondents in tax roles also say that documentation gaps are a challenge when managing a cross-border tax dispute, which is significant given the importance of documentation in audits and compliance.
2. Tax disputes
Key actions
Centralize oversight across jurisdictions to ensure consistent audit responses.
Track and leverage existing audits and documentation with appropriate safeguards.
Close documentation gaps proactively with defensive files and contemporary documentation—before the audit, not after.
Global antitrust regulation is increasingly complex and fast-moving. Heightened scrutiny by competition authorities and the increased number of active merger control regimes across jurisdictions have the potential to extend deal timelines and complexity and raise the risk of disputes.
In the medium-term, antitrust regulation is expected to have widespread consequences, with 87% of respondents anticipating at least a moderate effect and half expecting a high to very high impact over the next five years. As a result, antitrust considerations are becoming embedded in strategic decision-making, influencing mergers, acquisitions and competitive positioning.
Around the world, competition authorities are also responding to residual impacts from AI. Data-based pricing and AI tools can inform commercial decisions, which could in turn affect competitive terms. 32% of survey respondents are concerned that their implementation of AI could open their organization up to an potential dispute.
From new merger control regimes to uncertainties around how AI will reshape antitrust laws in the long-term, the landscape is ultimately giving way to longer deal timelines, more intense reviews, increased costs and even blockages.
3. Antitrust disputes
Key actions
Consider deal feasibility first and foremost.
Plan for delays and obstacles, factoring in extended time frames and additional costs associated with increased scrutiny and requirements.
Map future complexities and balance short-term needs with long-term planning. Expertise in global remit and attention to the nuances of local regimes can make a difference.
Organizations around the world are taking steps to more effectively respond to geopolitical shifts and build their operational resilience.
Investment in supply chain resilience is most prevalent (64% have invested in this area), as business leaders increasingly prioritize supply chain diversification over operational simplicity to bolster their resilience. Maximizing the effectiveness of potential tools and other investments requires top-down support. 61% of respondents are investing in their governance and leadership, recognizing the crucial role this plays, though only 38% are spending to bring in more risk analysts, trade specialists and geopolitical advisors.
Keeping up with the pace of change (44%) and jurisdictional complexity (42%) were cited as the top challenges in managing customs and tariff disputes, reflecting the fragmented and fast-moving nature of global trade policy. Strengthening internal capabilities through thoughtful and targeted resource allocation and addressing documentation gaps well before a dispute arises are critical to improving overall dispute readiness.
Lastly, supply chain resilience and risk management are top priorities for respondents, reflecting the central role of supply chains in both operational continuity and dispute exposure, with even minor disruptions having the potential to create significant downstream impacts.
4. Trade and geopolitical risk
Key actions
Accept and account for the reality of risk and balance this with risk mitigation through the right expertise and targeted tools.
Consider governance structures around customs, tariffs and supply chains to more effectively manage potential legal risk.
Layer risk monitoring and intel with strategic expertise and focus on tabletop and scenario planning exercises to build organizational risk muscles.
Cross-border complexity is exacerbating investigation risk across cyber, data, AI, trade and tax. Respondents tell us they struggle to navigate different legal systems and enforcement approaches, which can drive up costs and increase operational complexity.
In the cyber space, for example, data governance challenges and cross-border evidence management raise the risk of investigations related to data handling and privilege. Additionally, increasing coordination among regulatory agencies is leading to simultaneous demands and complex settlements, which require a consistent global approach from multinationals.
Investigative processes often run in parallel with, or directly trigger, litigation and disputes, as findings uncover potential legal breaches that prompt claims, regulatory scrutiny or defensive actions. Slowed decision-making and prolonged organizational exposure during high-stakes incidents can lead to material business continuity risks, a key area of concern flagged by 43% of respondents.
Ultimately, the ripple effects of a single investigation mean that reactive action alone is not enough. Robust leadership and continual investment in preparedness are necessities—even in the face of stretched resources.
5. Investigations risk
Key actions
Organizations should focus on:
Front-end readiness via investigation playbooks, escalation triggers, cross-border privilege strategy and crisis communications protocols.
Evidence control via rapid preservation, lawful data review workflows and a single-source-of-truth case narrative.
Internal capability via closing internal gaps such as documentation and resourcing, strengthening internal processes, investigation readiness and cross-border coordination.
Continual investment via allocating resources (either human and/or technological) to improve regulatory intelligence and agility, real-time regulatory tracking, scenario planning and cross-functional coordination.
Outcome management via coordinated regulator engagement, settlement strategy and litigation containment across jurisdictions.
Country Spotlight: Germany
While Russia's invasion of Ukraine intensified concerns around strategic dependencies, it reinforced a broader trend designed to strengthen economic resilience that has been shaping trade and investment policy across Germany and the EU for several years. Key measures include:
Enhanced investment screening under the Außenwirtschaftsgesetz (AWG) and Außenwirtschaftsverordnung (AWV), administered by the Federal Ministry for Economic Affairs and Energy (BMWE).
Strengthened export controls under the EU Dual-Use Regulation (2021/821), with expanded catch-all provisions.
The Foreign Subsidies Regulation (FSR), which became fully applicable from October 2023, adding a new layer to cross-border M&A and public procurement.
The Critical Raw Materials Act, establishing benchmarks for domestic extraction, processing, recycling and non-EU supply of strategic raw materials The European Chips Act, creating a framework for increasing EU semiconductor manufacturing capacity and monitoring supply chain resilience.
The European Chips Act, creating a framework for increasing EU semiconductor manufacturing capacity and monitoring supply chain resilience
These developments bring far more than compliance obligations. Companies operating in sectors such as advanced manufacturing, semiconductors, pharmaceuticals and critical minerals must now consider how economic security risks could affect investment decisions, sourcing strategies, supply chain resilience and long-term growth plans.
The Critical Raw Materials Act, for example, seeks to strengthen the security of supply for resources that are essential to Europe’s industrial and technological ambitions, while also creating new supply chain transparency requirements for companies in strategic sectors. Similarly, the European Chips Act reflects growing concerns around semiconductor dependencies and hosts some of Europe’s most important semiconductor manufacturing investments.
“A cross-border acquisition, technology licensing arrangement, joint venture, public procurement bid or relocation of production capacity can no longer be assessed only by reference to tax, antitrust and commercial considerations. Export controls, sanctions, investment screening, foreign subsidies, forced labor rules and supply chain due diligence now need to be integrated from the outset. This requires a focused governance model.”
Anahita Thoms, Managing Partner, Germany
Acceptable risk versus strategic vulnerabilities
Companies cannot control geopolitical events, but they can control how they identify risks, allocate accountability and make decisions. When organizations lack the governance structures needed to identify, assess and respond to these risks, external threats can quickly become strategic vulnerabilities.
This approach also changes how directors should think about fiduciary responsibility. Protecting long-term shareholder value increasingly requires an understanding of both market dynamics and geopolitical dependencies. A board that carefully monitors financial exposure while overlooking critical supply chain vulnerabilities is operating with an incomplete picture of enterprise risk. Economic security therefore expands, rather than replaces, traditional governance responsibilities.
Where governance gaps create risks
Four interconnected risk categories emerge when governance frameworks fail to keep pace with the evolving economic security landscape:
Heightened enforcement focused on export controls, sanctions and other economic security measures, combined with overlapping and sometimes conflicting regulatory regimes, can create significant legal, financial and operational exposure.
1. Regulatory and compliance risk
Commercial decisions that appear routine can quickly become politically sensitive when they involve critical technologies, strategic infrastructure, state-linked investors or concentrated supply chain dependencies.
2. Geopolitical and strategic dependency risk
Human rights, forced labor and environmental issues within supply chains can trigger trade, customs, sanctions, procurement and reputational risks alongside sustainability concerns.
3. Supply chain and human rights risk
Expanded foreign investment screening and other regulatory reviews can delay, reshape or block transactions, requiring dealmakers to assess economic security considerations much earlier in the deal lifecycle.
4. Investment and transaction risk
areas for action
5
Identify dependence on key suppliers, technologies, markets or resources and assess concentrations of risk. Supply chain mapping is not only a compliance exercise—it is a strategic data asset.
1. Map critical dependencies
Look beyond direct suppliers to understand exposure across the wider ecosystem, including critical inputs, logistics routes and technology providers. Supply chains are complex ecosystems, not linear chains.
2. Increase supply chain visibility
Consider geopolitical, regulatory and national security developments alongside commercial and financial factors when evaluating investments, transactions and growth opportunities.
3. Embed economic security into decision-making
Bring together legal, compliance, procurement, sustainability, technology, risk and business teams to assess interconnected risks and support informed decision-making.
4. Strengthen cross-functional governance
Use scenario planning to test responses to sanctions escalation, export restrictions, supplier disruption or geopolitical shocks. Make resilience a prerequisite for sustainable performance.
5. Plan for disruption
“The companies that will be best prepared are not necessarily those that localize everything or withdraw from complex markets. They will be those that understand their dependencies, can distinguish acceptable risk from strategic vulnerability, and have the governance structures to act before pressure turns into crisis.”
Anahita Thoms, Managing Partner, Germany
Economic security is not about withdrawing from global markets or eliminating risk entirely. It is about building the visibility, governance and resilience needed to respond effectively when conditions change.
Power, Policy and Geopolitics: The forces shaping digital infrastructure transactions
The Global Rollout of Online Safety Enters a New Phase
In Focus: Global pay transparency
Why Minority Stakes Can Trigger Major Competition Compliance Concerns
The Convergence of Risk: Today's pressures, tomorrow's disputes
Economic Security: A governance challenge
Back to top
Economic security has moved from a regulatory compliance exercise to a complex governance challenge for businesses. Companies must now ensure that their governance frameworks can identify interconnected risks, assess strategic trade-offs and support long-term decision-making. At the same time, export controls, sanctions, investment screening regimes and supply chain due diligence requirements are increasingly shaping critical investment, sourcing, technology adoption and market access decisions.
For decades, economic security was largely considered the responsibility of governments. National authorities managed trade policy, protected critical infrastructure and screened foreign investments. Corporate leaders, meanwhile, focused on growth, operational efficiency and regulatory compliance.
That distinction has disappeared. Today, boards are increasingly expected to oversee risks that extend well beyond financial performance, including geopolitical instability, supply chain dependencies, technology transfers, cybersecurity, sanctions and access to critical resources. These are no longer isolated operational concerns; they are strategic issues that shape a company's resilience, reputation and long-term value.
For boards and CEOs, one of the most significant risks may be the failure to recognize how quickly a ‘normal’ commercial matter can become politically sensitive. A supplier relationship, minority investment, technology transfer, public tender, data-sharing arrangement or logistics route may appear routine until it intersects with critical infrastructure, dual-use technology, state-linked capital, forced labor concerns, sanctions circumvention risk or strategic dependency.
As we explore in this edition of Briefed In, economic security is one of many critical considerations influencing businesses' strategic decision-making. We hope this issue provides you with the practical guidance and forward-looking insights you need to confidently navigate what's next.
Anahita Thoms, Managing Partner, Germany
“The concept of Wandel durch Handel—change through trade—shaped Germany’s entire approach to economic relations, including with Russia and China. It was the belief that deeper economic ties would encourage openness and stability. That model is now under profound strain. What changed perceptions in Germany fundamentally was Russia’s full-scale invasion of Ukraine in February 2022. German energy dependency on Russian gas, and the speed with which that dependency was revealed as a strategic vulnerability, became a watershed moment in the German political and policy debate.”
Anahita Thoms, Managing Partner, Germany
Partner, San Francisco
Michael Brewer
Partner, Madrid
David Diaz
Principal, Hong Kong
Jonathan Isaacs
25% in Austria, Germany Japan, South Korea and Israel.
20% in Brazil—or as low as 5% where there are horizontal or vertical overlap
33.3% (one-third) of voting shares or capital in Taiwan.
Economic Security: A governance challenge
Read more
about the implementation of the EU Pay Transparency Directive
Read more
about the EU Pay Transparency Directive
Agnieszka Skorupińska
Addressing these risks requires a governance-led approach. Business leaders should focus on five priority areas: