What private equity owners actually need from a portfolio-company board
Longer holds, harder exits and creditor-duty law have changed what a private equity owner needs from a portfolio-company board — and where the sponsor's own role begins.
Insights
Notes on technology law, IT and AI governance, contracts and compliance — written for the people who have to act on them.
Technology due diligence: what the data room won't tell you
A data room is a curated narrative; the evidence is the exhaust — commit history, deployment logs, cloud invoices, dependency manifests. What technology due diligence must look at now that AI-assisted coding, 'AI-powered' claims and EU product law have raised the stakes.
The chairman's view of cybersecurity: five questions to ask before the CISO presents
In 2025 cyber became a profit-and-loss line for European boards. Five questions a chair should ask before the CISO presents — about business interruption, suppliers, decisions and money, not maturity scores.
Earn-outs in technology M&A: engineering metrics you can live with
Delaware's courts have spent two years defining a good earn-out at nine-figure scale, and most engineering metrics fail the test. How to choose a metric that survives integration and can be adjudicated in weeks.
From founder-led to professionally managed: the governance transition
Founders are replaced early and often, yet founder involvement is associated with outperformance. The transition is not 'founder out, manager in' but a re-allocation of authority, information and legitimacy — and the instruments that make it work.
SaaS negotiations: the five terms that actually move risk
Most SaaS negotiation time goes to the liability cap. The money moves elsewhere — renewal, exit, unilateral change, data and termination — and EU law has now legislated the exit. The five terms that actually move risk.
The Digital Omnibus Reopens the GDPR: What It Means for Chapter V
The Digital Omnibus reopened the GDPR's text for the first time since 2018. Chapter V's transfer rules are not formally on the table — but anyone responsible for international data flows should be watching closely.
Transfer Impact Assessments in 2026: Between Paranoia and Paper Exercise
Six years after Schrems II, most organizations treat the TIA as an impossible demand or a template to file. TikTok's €530 million lesson shows regulators expect something in between.
The Latombe Paradox: Why Winning in Court Made the DPF More Fragile
The EU General Court upheld the EU–US Data Privacy Framework in Latombe — but the way it won the case for the Commission quietly mapped every route to losing the next one.
The Invisible Supply Chain: Fourth-Party Risk in AI and Cloud Contracts
You signed one contract. Your service depends on five companies. Regulators — led by the EU's DORA — now expect you to see all the way down the chain, and your contracts are the only flashlight you have.
Negotiating Hallucination Rates: Accuracy Warranties in AI Service Agreements
Your AI vendor's system can be 99.9% available and still be confidently wrong all day. Traditional SLAs were never built for that — and the contracts are only now catching up.
From Pilot to Production: Why Your AI Contract Template Just Broke
The contract that got your AI pilot signed in three weeks is quietly unfit for the production deal you're about to close. Here's what changes when the stakes do.
The EU AI Act after the Omnibus — a short readiness check
A practical AI Act readiness checklist, first published in July 2026 and updated after the AI Omnibus moved the high-risk deadlines to December 2027 and August 2028.
Why we write
A short note on what this blog is for, and what you can expect from it.