A connected business needs a connected governance view.
An organization's obligations do not stop at its headquarters. Customers, employees, data flows, products and third parties can create different questions across markets. I help make those questions concrete and coordinate the technical and operational work needed to address them.
Selected examples are provided below to orient the discussion. They are starting points, not an exhaustive legal opinion or a substitute for jurisdiction-specific analysis.
United States
Practical cyber, AI and data-governance support for regulated and growing organizations, including supplier and customer diligence.
Selected regulatory anchors
Cyber: New York Department of Financial Services (NYDFS) Part 500, Federal Trade Commission (FTC) Safeguards Rule, Securities and Exchange Commission (SEC) cyber-disclosure rules.
AI: Colorado Artificial Intelligence Act, sector guidance and National Institute of Standards and Technology (NIST) AI Risk Management Framework as an operating benchmark.
Privacy: California Consumer Privacy Act / California Privacy Rights Act (CCPA / CPRA), Gramm-Leach-Bliley Act (GLBA), Health Insurance Portability and Accountability Act (HIPAA), and other state privacy statutes where applicable.
Starting questions
Which entity and activity are in scope? What information, model output and delegated action create the exposure?
Europe
Coordinate technology, privacy, security and AI-governance research with the appropriate jurisdiction-specific legal analysis.
Selected regulatory anchors
AI: European Union (EU) Artificial Intelligence Act, including provider, deployer and General-Purpose Artificial Intelligence (GPAI) obligations where relevant.
Cyber: Network and Information Security Directive 2 (NIS2), Digital Operational Resilience Act (DORA) for financial entities, and the Cyber Resilience Act (CRA).
Privacy: General Data Protection Regulation (GDPR), cross-border transfer rules and ePrivacy requirements where communications or tracking are involved.
Starting questions
Where are customers and affected people? Which entity supplies or uses the system? What crosses borders and who owns the evidence?
Japan
Support headquarters and cross-border teams connecting technology risk, supplier assurance, data handling and operating responsibilities.
Selected regulatory anchors
AI: Ministry of Economy, Trade and Industry (METI) / Ministry of Internal Affairs and Communications (MIC) AI Guidelines for Business and sector-specific supervisory guidance.
Cyber: Basic Act on Cybersecurity, Cybersecurity Management Guidelines, and Financial Services Agency (FSA) cybersecurity and outsourcing expectations where relevant.
Privacy: Act on the Protection of Personal Information (APPI), including cross-border transfer requirements and handling rules for personal data.
Starting questions
Which activities touch United States or European markets? Who owns the cross-functional response, supplier coordination and the retained evidence?
Language and professional boundaries
This release is in English. Japanese and Italian site editions are planned. Language support, local counsel, invoicing, tax treatment, personal-data obligations and delivery location must be confirmed for each engagement. No local legal practice, tax opinion or global compliance certification is implied.
My background includes cross-border legal-technology and cybersecurity work. The engagement begins with your organizational profile and objective, not a one-size-fits-all list of regulations.