Cybersecurity obligations depend on the organisation, sector and product. NIS2, its national implementation, the Cyber Resilience Act and GDPR can apply to different actors and events. A software manufacturer’s product-security duties are not identical to a customer’s duties as an operator. Contractual incident notices may also have shorter deadlines than statutory reporting.
How we approach the matter
We determine scope, map reporting routes and coordinate legal response with technical investigators. An incident plan should preserve evidence, identify decision-makers and distinguish verified facts from working hypotheses. Supplier terms should support timely access to information and remediation. Product teams need processes for vulnerability handling, updates and the security lifecycle, with the applicable phase-in dates checked.
Aligning contracts with the technical service
Read the main agreement together with its specification, service levels, security schedules and data-processing terms. Define what the supplier must deliver, how performance is measured and which dependencies remain with the customer. Conflicting documents can make an otherwise clear commitment difficult to enforce. Contractual allocation of tasks also needs to respect any statutory duties that remain with the relevant party.
Disruption, change and exit
Prepare for more than normal operation. The contract should address changes, incidents, unavailable services and an orderly end to the relationship. Practical arrangements include contact points, access to necessary records, export formats and transition assistance. Before termination or migration, assess technical dependencies and preserve relevant evidence. A recovery plan and an exit plan serve different purposes and should both be workable for the actual service.
Four practical examples
The following scenarios illustrate typical legal questions. They are not descriptions of client mandates or promised outcomes.
Ransomware incident
A company loses access to key systems. We support the reporting assessment, evidence preservation and contractual communications alongside technical response.
Exploited vulnerability
A manufacturer discovers active exploitation of a software flaw. We assess CRA reporting and user-information duties using the available technical facts.
Supplier notification
A service provider reports an incident without sufficient detail. We use contractual cooperation rights to obtain information for the customer’s own assessment.
Security procurement
A buyer needs evidence of a supplier’s controls. We translate the operational requirements into audit, remediation and incident terms.
Preparing your enquiry
A short description of the project or dispute, the parties involved, relevant countries and any deadline helps us identify the next step. Preserve the relevant contract, publication or technical records. Please avoid sending highly sensitive material until a suitable communication channel has been agreed.
Discuss your matter with our team · Media law overview · Disputes and enforcement