Europe’s complex network of overlapping regulations is hitting startup founders hard and holding back business, according to a new research by startup support organization DutchBasecamp.

Some 79% of tech founders claim they've been hit by regulatory friction over the last year, according to the The Realities of Scaling in Europe report, which was launched in partnership with the Computer & Communications Industry Association (CCIA).

More than half (58%) said they'd delayed entering another EU market, 45% have paused or canceled features, and 44% have experienced delayed or lost deals.

As negotiations on the Digital Omnibus continue, the CCIA warned that many meaningful simplification measures could fall by the wayside, which has the potential to further compound challenges faced by startups.

Some member states are resisting a proposal allowing businesses to report a cybersecurity incident once, rather than separately under seven overlapping frameworks.

Meanwhile, a fix that would establish legitimate interest as a legal basis for responsible AI training has been stripped out.

While postponing certain deadlines has provided some breathing room, many simplifications have been rejected, leaving developers with limited implementation time while essential codes, guidance, and standards are still missing.

“We warned from the start that the Commission’s proposals to simplify the patchwork of EU tech and digital rules were only the bare minimum. Instead of going further, Parliament and Council are now weakening, rejecting, or delaying even the most basic fixes," said Daniel Friedlaender, senior vice president and head of CCIA Europe.

“Europe’s innovators have shown remarkable patience in navigating today’s regulatory maze, but that patience is running out. EU institutions and member states need to wake up: 2026 must bring real improvements for tech companies. Europe knows the problems. If we refuse to fix them, we can’t be surprised if our founders look outside the EU for success.”

Growing regulatory friction

Nearly a quarter of survey respondents said they'd spent more than 30% of their budgets on compliance costs, while 24% are considering or have already relocated their headquarters due to regulation.

In January, the European Investment Bank, with the European Commission, found that roughly one-in-ten EU scale-ups have relocated abroad, with around 85% of those moving to the United States.

The Commission’s Joint Research Center put the headquarters-relocation rate for venture-backed startups at between 3.3% and 4.3%, ten times the rate for comparable non-VC-backed firms.

More than half of founders said they'd steered clear of an EU country because of regulatory concerns, and only 21% said they'd seen no material impact from EU or national rules.

"Europe is already losing tech founders, products, and growth," said Masha Moisseyeva, managing director of DutchBasecamp.

"When 45% of those surveyed have paused or cancelled features, 58% have delayed entering another EU market, and 44% have lost or delayed deals in a single year, the urgent need for regulatory simplification is no longer a theoretical debate about EU competitiveness. The damage is happening now.”

Regulatory confusion is rife

Much of the cost, the researchers found, comes not from compliance itself but from not knowing what compliance will require.

Indeed, founders often cite uncertainty surrounding future EU AI Act obligations before any requirement has formally bound them.

“Founders are not asking the EU to lower its standards. They are asking for clear, workable rules they can rely on across the Single Market," said Moisseyeva.

"Instead, uncertainty and overlapping obligations are dictating what they build, who they serve, and how fast they grow.”

FOLLOW US ON SOCIAL MEDIA

Europe’s long-running struggle to define digital sovereignty – and to turn it into something practical – is reaching an inflection point.

That was the message at this year’s Gaia-X Summit in Porto, where executives and governments argued that the continent finally has the technical foundations for sovereign data sharing.

All it needs now is the political will, economic models, and global partnerships to make it work at scale.

Gaia-X is a Brussels-based industry association bringing together European enterprises, technology vendors, cloud providers, standards bodies, and public sector institutions.

Its purpose is to build a common, verifiable framework: the Gaia-X Trust Framework. This framework is designed to define how organizations can share, store, and govern data in interoperable, sovereign, and audit-ready ways.

The initiative now underpins dozens of projects in manufacturing, energy, aerospace, mobility, finance and healthcare.

Unlike early misconceptions, Gaia-X is not a cloud provider. It sets rules around identity, compliance automation, service labelling, policy enforcement, and interoperability that cloud and data ecosystem providers must adhere to if they want to be considered sovereign-ready.

From pilots to real deployments

Gaia-X CEO Ulrich Ahle opened the Summit by admitting that while conceptual momentum is strong, adoption remains thin on the ground.

Europe has “more than 150 implementation projects in Europe at the moment in preparation,” but “we still have just a handful of operational databases really implementing benefits for their end users,” he said.

To help change that, Gaia-X will release its first multi-provider catalogue: 600 services from 15 providers aligned to four security and sovereignty levels. Ahle also reiterated Gaia-X’s near-term growth target: 1,000 services by the end of the year, scaling to 3,000 afterwards.

The top tier of the catalogue – Gaia-X Label Level 3 – is designed for maximum sensitivity use cases such as aerospace, energy, and national infrastructure workloads. Critically, Level 3 services can only be delivered by providers that have their headquarters in Europe, ensuring they are not subject to extraterritorial laws like the US Cloud Act.

EDF’s nuclear station program illustrates the demand: its data space is “requesting the highest level of security… the Gaia-X label level three. And this highest level security is reality,” said Ahle.

It’s worth noting that the conversation around digital sovereignty in Europe has shifted dramatically in the last two years, driven by one factor: AI systems that ingest sensitive, large-scale operational data.

“Trustful AI needs trustful data. And here, data sovereignty is of utmost importance,” said Ahle.

Hyperscalers: foundational but insufficient

CIOs and CTOs know the hyperscalers aren’t going anywhere. Gaia-X leaders know it too. But the limits of “sovereign cloud” offerings from US players were addressed without ambiguity.

Even when operated inside Europe by European employees, those services “are still under the American legislation, under the Cloud Act,” said Ahle. That constraint may be acceptable for 90% of enterprise workloads, but not for the 10% that carry regulatory, national infrastructure, or safety-critical risks.

Chairwoman of the Gaia-X Board and EVP digital at Airbus, Catherine Jestin, put it more bluntly: “The fact you have not done it in the past doesn’t guarantee that you will do it in the future.”

This is why Airbus does use hyperscaler services – but not for its most sensitive workloads: “I really love to work with AWS, with Google and Microsoft… but not for the most critical applications and services.”

For IT teams, this is the emerging pattern: hyperscalers for scale, elasticity and tooling; sovereign frameworks for critical data integrity, compliance automation, and legal insulation.

When asked whether trust in US providers had worsened under President Donald Trump’s second term in office, Jestin noted, “It hasn’t helped.”

This aligns with the wider shift across Europe. For years, EU member states could not agree on whether stringent sovereignty rules were needed. But now, Jestin said, “we see with the latest publication from the European Commission that’s now… on the top of the agenda.”

CIOs designing long-term cloud strategies could see certifications, service labels, and jurisdictional guarantees increasingly required by regulators and embedded into RFPs.

Operating a data space is not free

One of the most useful insights for IT leaders came from Jestin, who highlighted the hidden operational costs of building and maintaining data spaces – the very reason many sovereign cloud initiatives fail internally.

Running a compliant data space requires organizations to “maintain and support the connectors… to maintain [and] support Identity and Access Management (IAM)… to maintain the contracts.”

Without sustainable economics, she warned, “you just go in a negative spiral, and your data space will not be successful in the future.”

To address this, Gaia-X is working with economists at Paris Dauphine University to model participant roles, orchestrator responsibilities, and cost-recovery mechanisms to ensure sovereignty is engineered as a business model, not just a compliance posture.

The bottom line for CIOs, CTOs, and architects

Gaia-X said it’s not trying to reinvent the cloud. Rather it’s trying to standardize trust, compliance, and verifiability in a market dominated by providers whose legal obligations don’t always align with European sovereignty requirements.

The Porto Summit’s message was that sovereignty is becoming programmable through labels, identity rules, compliance automation, and clearing houses.

Yes, hyperscalers remain essential, but they are no longer sufficient for high-risk workloads. AI governance is elevating data integrity and traceability to strategic priorities.

Economic models for data spaces must be planned upfront, not retrofitted. And geopolitics has entered the IT architecture stack in a way organizations can no longer ignore.

“Technology is ready. It is about adoption… and sustainable operation,” Ahle said.

MORE FROM ITPRO

• So much for data sovereignty — AI infrastructure is dominated by just a handful of countries
• Can the UK achieve AI sovereignty?
• SAP wants to take data sovereignty to the next level with new 'on-site' infrastructure options

A host of key provisions in the EU Data Act will come into effect on 12 September, and there’s a lot for businesses to unpack.

The regulation came into force on 11 January 2024 and while a grace period has been running to ensure implementation, rules under the legislation will be applicable across the European Union (EU) from here onward.

At its core, the EU Data Act will introduce sweeping changes with regard to how data from connected devices and cloud services is accessed, managed, and shared across the union. This includes new rules on data access, service portability for organizations, and contractual fairness.

The potential long-term impact of the legislation cannot be understated, according to Soniya Bopache, VP and general manager for data compliance at Arctera.

“The EU Data Act has the potential to foster a more competitive and equitable data economy – largely thanks to its provisions on data access, fair contractual terms, and cloud switching,” she said.

“For businesses governed by the Act, this isn’t just a matter of compliance, it’s an opportunity to build a more transparent, efficient, and innovative digital ecosystem.”

So what can businesses expect with the EU Data Act?

What industries fall under the EU Data Act?

The legislation applies to a broad range of sectors, spanning areas such as manufacturing, cloud computing, transport, and consumer goods.

Moreover, it’s not limited to the private sector, with public sector organizations also expected to benefit from the legislation, according to Peter Grimmond, VP and head of technology at Cohesity.

“The EU Data Act has huge potential to deliver acceleration of both public and private sector innovation, through increased data democratization and access,” he said.

“For all enterprise and public sector organisations that have a robust, compliant, data classification processes already in place, the act will create an environment of collaboration and innovation where innovation can thrive without compromising corporate resilience or individual rights”

Data Access and Transparency

Data access and transparency is a key focus of the legislation, according to official EU materials on the Act.

Fundamentally, the regulations are designed to “enhance the EU’s data economy and foster a competitive data market” by making data more accessible and usable.

The move comes in the wake of an explosion of connected devices across the union in recent years. These IoT products collect vast volumes of data, which the legislation aims to capitalize on for reuse across the region.

To achieve this, new rules under the act will give users of connected devices - including businesses and individuals - greater control over the data they produce.

Similarly, the Act also includes rules on how enterprises can share data with other businesses. According to Grimmond, this aspect of the legislation could deliver positive long-term benefits for both businesses and consumers alike.

“It will speed the ability for data to be shared from more devices across more organisations, and opens the door for the development of new products, services, and ways of doing business,” he explained.

“Crucially, it does this without undermining the robust privacy standards that are the EU’s hallmark regulatory framework: building on GDPR’s global standard for privacy and aligning with DORA’s focus on digital operational resilience.”

Cloud service flexibility

As mentioned, another core aspect of the legislation centers around data portability, particularly with regard to cloud services. The Act aims to provide enterprises more flexibility in how they engage with cloud providers and, crucially, switching or opting for multiple options.

This aspect of the legislation comes in direct response to growing calls for a more fluid and competitive cloud computing industry in the EU, with enterprises having contended with “vendor lock-in” for several years now.

Running parallel to this frustration has been the rise of multi-cloud and hybrid cloud strategies, whereby enterprises host data on multiple providers, or through a combination of on-prem and cloud-based services.

Yet businesses with one particular cloud provider aiming to switch to another have faced significant costs transferring data. These “egress fees” have become a recurring point of contention and even prompted legal action against major industry providers.

With this in mind, the EU Data Act includes measures that ensure customers can switch from one data processing service to another in a more efficient manner.

Notably, the Act doesn’t specifically rule out vendors charging fees for data transfers. However, it obliges cloud providers to pass on these costs to the customer rather than charging excessive payments.

Some providers have taken steps to adhere to the new legislation. Google Cloud, for example, recently announced it would waive data transfer fees for customers switching to another provider.

MORE FROM ITPRO

• DORA and why resilience (once again) matters to the board
• Everything you need to know about the NIS2 Directive
• What businesses need to know about the General-Purpose AI Code of Practice

A majority of cyber professionals believe responsibility for security and regulatory compliance lies with the board, according to new research.

CIISec’s recent State of the Security Profession report shows 91% of practitioners believe the burden for security lies with the board, and not security managers or CISOs.

Notably, more than half (56%) said they believe senior management figures should “face consequences”, including fines, prosecution, and sanctions, for serious cybersecurity failings.

Just 34% believe the employee who breached policy - if that’s the case - should be held responsible.

Amanda Finch, CEO of CIISec, said the study highlights the need for a more aligned approach to cybersecurity between the board and frontline practitioners.

“If the buck stops with senior management – as the survey makes clear – our profession must take a more collaborative approach to security, ensuring the board is aware of the risks and included in major decisions,” she said.

“This means more learning for cybersecurity professionals, improved understanding of regulations and developing better communication of risk to stakeholders outside of the security function.”

Regulatory concerns drive demand for change

A key factor behind changing sentiment on board-level responsibility comes amidst a period of growing regulatory scrutiny on both sides of the Atlantic, Finch noted.

The introduction of the EU AI Act, DORA, NIS2, and the UK’s Data (Use and Access) Bill, mean practitioners are more conscious of regulatory compliance than ever before.

“It’s important to remember that regulations aren’t imposed to make the security profession more challenging, although sometimes it may feel that way,” she said.

“They have been developed to help address failures from the past, close gaps that have previously been overlooked and establish a minimum standard across the industry.”

Finch noted that while these regulations have created fresh challenges for enterprises and security professionals alike, they serve a vital purpose and therefore require close attention.

“These laws have been introduced to protect citizens, improve their quality of life and ensure that businesses can be held accountable for irresponsible actions,” she added.

“As cybersecurity matures as a profession, we should view increased regulation not as a burden but as a sign of progress.”

Compliance is easier said than done, however. Research earlier this year showed a significant number of companies were struggling to achieve compliance with NIS2 regulations.

Separate research on DORA showed four-in-ten UK financial services firms were struggling to achieve compliance with the legislation ahead of its introduction.

MORE FROM ITPRO

• Why does cybersecurity still struggle with professionalization?
• Cyber professionals call for a 'strategic pause' on AI adoption
• Work-related stress “keeps cyber security professionals awake at night”

More than four-in-ten UK financial services firms look set to miss the deadline for compliance with the new Digital Operational Resilience Act (DORA) tomorrow.

Companies failing to comply with the regulations could face fines of up to 2% of worldwide daily turnover for as long as six months.

However, while nearly nine-in-ten UK CISOs and senior security decision makers believe that DORA will be beneficial, 43% said they won’t be compliant for at least three months.

"The regulatory landscape in the EU is heavily congested with several overlapping standards and laws now in effect," said Richard Lindsay, principal advisory consultant at Orange Cyberdefense, which commissioned the research.

"There is a lot to navigate, and we’re increasingly seeing businesses taking a more reactive approach to compliance requirements once the threat of reprisals becomes tangible."

"However, remaining non-compliant could have severe ramifications, with fines of up to 2% of global annual turnover and the potential of fines of over €1m for individual senior leadership."

The challenges in implementation varied from organization to organization, but included a lack of prioritization, the short timeline involved, a lack of skills, and a lack of visibility over supply chain or third-party partners, each cited by around a quarter of respondents.

To deal with these issues, virtually all said they planned to call on external support.

Budgetary constraints weren't highlighted as an issue, with 84% of respondents saying they had allocated funds ahead of the deadline. Around three-quarters have reallocated funding from other business areas, and around half have pulled in staff members from other projects.

In the longer term, though, two-thirds of CISOs and senior security decision makers believe that DORA will significantly increase cybersecurity costs.

The new regulations include more than 500 individual requirements, with businesses expected to implement essential protection, detection, containment, recovery, and repair measures.

Rules contained in the legislation place a strong emphasis on ICT risk management, incident reporting, operational resilience testing, and oversight of ICT third-party risks.

PwC has estimated that more than 22,200 financial bodies and IT service providers fall under the scope of the act. However, the EU is expected to take a targeted approach to any breaches, focusing on larger players and significant breaches.

New data breach reporting rules introduced by the Securities and Exchange Commission (SEC) last week have been described as “worryingly vague” and may create a harmful operating environment for security professionals, according to (ISC)2. 

Tara Wisniewski, EVP for advocacy, global markets, and member engagement at the security non-profit, challenged the new scheme, warning that many aspects of the new framework are open to interpretation. 

While Wisniewski broadly welcomed the changes, she suggested that the announcement could create confusion for professionals in the industry.  

“While we support the fundamental principles of public disclosure to inform and protect shareholders, customers, and other constituents, the SEC ruling is worryingly vague. It poses more questions than answers, and may create ambiguity for cyber professionals.”

Under the new rules, public companies will be held to a higher standard of reporting, with firms required to disclose security incidents within four days. 

The ‘Form 8-K’ requirement means companies will have to report any security incident they deem ‘material’ within this timeframe and provide information on the timing of the attack, its scope, and the potential impact on the business and customers. 

However, the terminology used by the SEC is a point of serious contention for (ISC)2 and could be left “open to interpretation”. 

This, the organization said, could lead to over-reporting of security incidents, placing greater pressure on overworked staff. Similarly, (ISC)2 warned the framework could prompt a trend of under-reporting, which in the long term might leave cyber security practitioners personally liable for incidents. 

As such, the organization called for a clearer definition of what constitutes an incident under the new guidelines. 

“There are no concrete definitions for which cyber incidents must be disclosed, or what the SEC means by ‘material impact’. There are millions of attempts on businesses daily, some unsuccessful, others partially so,” said Wisniewski.

“Without clearer definitions, the rules are open to interpretation which could either lead to over-reporting, distracting cyber professionals from their main task of network protection, or under-reporting, which could expose cyber professionals to personal liability.”

Overburdened security professionals

Another point of contention raised by (ISC)2 centers around new board oversight requirements outlined in the SEC’s recent changes. Under the new rules, businesses will be required to disclose annual reports on their security risks, cyber strategy, and governance practices.

Annual 10-K reports will be required to outline specific measures taken by organizations to identify and mitigate security threats, as well as insights on executive oversight of company security practices. 

Wisniewski said that these new rules “do not go far enough”, adding that the guidelines are ambiguous and could lead to increased pressure on practitioners as executives rely on staff for advice and guidance. 

As a result, the non-profit has called for the establishment of a “more formal framework for board oversight responsibilities”. 

“The ambiguity only creates more burden for overworked and under-staffed cyber security professionals, as boards and corporate leaders will increasingly rely on them for interpretation of the guidance,” she said. 

“So while we support collaborative efforts to protect consumers, the importance of cyber threats and the complexity of management requires very clear guidelines with detailed definitions so cyber professionals do not inadvertently fall afoul of well-intentioned regulation,” Wisniewski added. 

“Cyber professionals are looking for clarity, and this ruling falls short in that regard.”

Governments could reduce international cyber crime by putting stronger regulations on cryptocurrency, a security expert has said.

Itai Greenberg, chief strategy officer at Check Point, told ITPro that greater government oversight of blockchain technology and transactions would be an immediate way to improve the threat landscape.

“If we put in regulation, we can dramatically reduce the amount of cyber attacks,” he said.

“It would have a direct impact, because cryptocurrency allows people to get dollars without being traced.”

Greenberg acknowledged that the government’s role in enforcing crypto rules can only go so far, and that the blockchain is here to stay.

“It was never introduced by governments, it will not be disappeared by governments.” 

The different blockchains across the world support many legitimate uses, including more secure transactions of finances and synchronization of data in a decentralized format. 

But Greenberg maintained that clearer rules around tracing and taxing when it comes to the blockchain is still needed.

“There are many, many good people around the world that contribute to the success of blockchain and cryptocurrency. What they do not have is the big brother that will tell them how to do it right, and we’re starting to see it now with Celcius, with FTX.”

Because transactions made on the blockchain are irreversible, it can prove difficult to recover funds stolen by hackers, or cryptocurrency that a company sends as ransom to a threat actor.

Cryptocurrency can be difficult to trace, but not impossible. The FBI was able to locate and recoup $2.3 million of the money lost in the 2021 Colonial Pipeline ransomware attack, and law enforcement can obtain warrants to check the digital assets of suspects.

Third-party exchanges can also work directly with government agencies to help them access funds.

But a fully fledged, international scheme to track and tax cryptocurrency would require the participation of world governments, and this could be difficult to secure. 

Nations such as Russia already offer safe harbor to cyber criminals, and could be unwilling to compromise the payment channels of those under their protection.

More comprehensive tax requirements on crypto assets, as well as more stringent enforcement of existing laws, could help to dissuade criminals seeking to use crypto platforms as a basis for obtaining illicit funds.

In recent months, international agencies have become even more aggressive in their pursuit of cyber criminals and ransomware groups in particular.

The US Department of Justice (DoJ) placed a $10 million bounty on a Russian man linked to the groups LockBit and Hive, and has since charged a string of LockBit associates as it embarks on more operations to disable the group.

Greenberg praised this activity, saying the actions further protect the cyber security landscape for organizations and individuals.

Improving cyber resilience

Speaking on the wider strategies that companies can take to be more resilient to attacks, he suggested abandoning the traditional idea of detection and remediation, and to instead invest in real-time prevention.

With increasingly automated attacks such as DDoS bots or even AI-assisted fuzzing, the time delay between detection and response in older systems could mean the difference between resilience and compromise.  

Greenberg acknowledged this can change be difficult to implement. For example, while false positives are acceptable in a detection system they can cause unwanted interference and disable core processes if they crop up in a prevention system.

He said many companies try to estimate how many times per year they will be attacked and that this is likely to be in the thousands, but that some companies fall into the trap of thinking that there’s little difference between 95% prevention and 99% prevention.

“It’s not about the 95% that you block, it’s about what you don’t block. And it needs to go as close as possible to 100%.”

Greenberg also highlighted the struggle that chief information security officers (CISOs) face in optimising their limited IT budgets, workforce, and skillsets.

“There are two philosophies here, one that says you split your budget with half in SOC, remediation, engineering people and half in prevention and detection,” he said.

“I would advise a CISO to put as much as they can into the prevention technology. So make it 90% of your budget, because you are no longer in this race of putting people and technology in to deal with remediation.

“Resilient companies will put more in prevention and outsource their remediation and incident response into an MDR service.”

Continental drift is a process that usually occurs over millions of years. Almost imperceptibly slowly, the ground beneath our feet shifts. But the process isn’t always so gradual. Occasionally ruptures in the fault lines between the tectonic plates that comprise the Earth’s crust will violently shake – and force everyone to pay attention. In October last year, something similar happened in the tech industry.

With the stroke of a pen in the United States Department of Commerce, a shockwave reverberated through the global semiconductor supply chain, as new restrictions were brought into force to prevent companies from exporting the most advanced chips to China.

The consequences are far-reaching, and the new rules will fundamentally transform how the tech industry works. After 40 years of frenetic globalization, which saw China become the world’s manufacturer of technology goods, the tectonic plates are shifting as China and the West now drift apart.

Two clashing superpowers

So what motivated the dramatic move? In short, it’s a response to the rise of China as both a military and economic superpower, which has been reshaping the global pecking order since the mid-1970s. “When you are at the top, and you have the second guy nipping at your heels, there is bound to be a bit of friction,” says Professor ManMohan S Sodhi, who researches operations and supply chain management at City University, London.

Since the 1970s, global GDP has increased fourfold in part thanks to China transforming from a largely agricultural economy to a manufacturing and later hi-tech powerhouse. Today, China produces many best-in-class electronics, from drones to Internet of Things (IoT) devices to pretty much any widget you need. Despite COVID-19 woes, with 1.4bn people, China is expected to catch up with the US – which has Washington policymakers worried.

“Both countries are trying to divide up the world,” says Sodhi. “We have two strategic competitors. And maybe the US is right in calling the relationship a ‘strategic rivalry’? “If you were my strategic rival, I shouldn't help you win, right?”

Semiconductors – critical components in modern weapons systems – are at the center of this global powerplay. “They're worried about the fact that these advanced chips can be used in advanced artificial intelligence (AI) computers and military hardware, and on self-guiding rockets,” says Malcolm Penn, founder and CEO of FutureHorizons, a semiconductor analysis firm. “All equipment these days is just a chip with a bit of plastic and tin built around it. All of the skill is in the semiconductor, the rest is just dressing.”

“If you've got the same advanced chips you’re at a level playing field from a military perspective.”

Semiconductors are a strategic asset, in much the same way that hypersonic missiles and stealth bombers were during the Cold War. And what makes it particularly precarious from America’s perspective is the best chips are made in the most awkward place possible.

“Taiwan happens to be a big supplier of vital chips,” says Sodhi. Home to TSMC, the world’s most advanced chip manufacturer, Taiwan has long been a huge point of political contention: China claims the island as part of its territory, but since WWII it has been an independent country in all but name. It’s a democracy firmly within America’s sphere of influence, despite lying only 100 miles off the mainland Chinese coast. There’s a small but non-trivial chance that China may one day invade and try to take the island back.

“If the Chinese take that over, it already has the rare earths [metals used in chip manufacture], so it could be a difficult situation for what we call ‘the free world’, so the tensions are building on many fronts,” says Sodhi.

The soybean struggle

Tension has been building for a long time, but the incident that eventually led to the restrictions being imposed was something much more parochial: a dispute over soybeans. “Basically, you have to go back to Trump,” says George Magnus, former chief economist at UBS bank, and a research associate at Oxford University’s China Centre. 

The scrap began in 2018, when Trump declared a trade war, slapping tariffs on a number of products, including solar panels, washing machines, and soybeans. “There wasn't really a specific technology focus at that time,” says Magnus. “Most people thought that it was a complete waste of time because the only people who really pay for tariffs are consumers.”

The tit-for-tat economic measures persisted and in May 2019 Trump signed an executive order prohibiting the sale in the US of any communications technology produced by “foreign adversaries” – a move aimed at hurting Chinese giants ZTE and Huawei. Equipment made by Huawei, in particular, formed a significant part of Britain’s emerging 5G network. This was seen as a security threat.

There were also dramatic consequences for consumers, as it was this rule that prevented Huawei and ZTE from licensing Google’s homegrown version of Android, significantly hobbling Huawei-made smartphones sold in The West, because they couldn’t offer the Google Play app store or access to other Google services. But this was only the beginning.

“The Biden administration has really taken this to a new level,” says Magnus, with the hammer blow landing in October when US firms were barred from exporting chips to China without a license.

“They really are a very, very sophisticated form of export control,” says Magnus. He explains that, normally, restrictions limit the influence of individual companies – but in this case, America was trying to disentangle an entire sector of the economy from China’s influence.

These bans very much set the direction of travel. Last year, the US also piled on the pressure with the passage of two major bills through Congress. The misleadingly titled Inflation Reduction Act, and the Chips & Science Act, both created new incentives and subsidies for American companies to develop and manufacture chips in the mainland US.

“It's about redesigning global supply chains for technology,” says Magnus. “They do not want Taiwan to be the centrifugal piece of the technology ecosystem in ten years’ time for obvious reasons, and they certainly want to contain or prevent China from taking the lead.”

Leaving Apple exposed

As a result of the growing tensions, it is going to be much more difficult for Western tech companies to do business in China, and vice-versa. “I think it's a huge structural shift – China is huge in the global semiconductor industry,” says Magnus. 

This isn’t because China designs or manufactures chips – only around 16% of chips used in China are homemade. But China depends on companies such as Intel, Nvidia, Dutch firm ASML, which makes the equipment used to make the most sophisticated chips, and TSMC, which has fabs in mainland China. Now, any firm that wants to use US technology in China will require a special license.

“There is a leveling out at the moment because people are concerned about the ongoing risk of having their operations in China, so some of those operations are now moving to other areas of Southeast Asia,” says Mark Lippett, CEO of XMOS, a British company that designs chips for embedded systems.

In fact, the journey from the drawing board in XMOS’ Bristol headquarters to finished products is illustrative of just how entangled Western tech firms currently are with China. “We fabricate, assemble and test chips in Taiwan,” says Lippett. “Then it goes into a contract manufacturer. Those contract manufacturers historically have typically been in China.”

It's in China where chips are then installed inside countless different devices, from set-top-boxes for TV providers to smart speakers. “Chips come out again, either in exactly the same form because they’ve just gone into a logistics warehouse, or they go inside a consumer electronics device that is then going to be resold in the West,” says Lippett. “Unpicking China from this supply chain is non-trivial, and in my view undesirable as well.”

It’s likely that, over the next few years, we’ll see major tech firms relocate manufacturing beyond China. But there’s one tech titan – Apple – that’ll perhaps have the largest headache of all. To an extent unmatched by its peers, Apple is enormously reliant on China. The company might remind us its hardware has been “Designed by Apple in California”, but today more than 95% of iPhones, Macs, and accessories are assembled in China.

“Apple made a bet on China that Samsung didn't,” says Magnus. “If you look at the timeline, Samsung diversified its markets, its manufacturing, and its sources away from China. It's nowhere near as dependent on China.”

And this is set to be a big problem for the company, given the extent to which it has invested in advanced manufacturing and logistics inside the country. “You can't just lift that out and replicate it somewhere else overnight,” says Penn.

Can China catch up?

The flipside to the scramble many Western companies now face is the challenge facing China. Can its own domestic semiconductors catch up with the best of the West, or will President Biden hobble China’s chip-making capabilities? Opinion is mixed.

“The West is quite significantly ahead,” says Lippett. “In terms of the bleeding-edge technologies, China typically lags a few technology [generations] behind in terms of its ability to support domestic manufacture.”

Penn agrees, saying China still has only one option – which is now much more precarious. “In terms of getting chips made, they do what everybody else does and go to TSMC because there is no other choice for anybody, whether it's the West or the East or the man on the Moon, there’s no other place to go.”

What if China wanted to develop its own fabs and build its own chips from scratch? There’s still the significant problem of requiring sophisticated photolithography equipment to etch transistors into silicon. For the most advanced chips, only ASML can do it. But the Netherlands has signaled it’ll impose similar restrictions to the US. China may, therefore, struggle to reconfigure its industry any quicker than it’d take Apple to exit China.

“If they wanted to build their own fabs and could somehow buy or copy or reverse engineer whatever equipment is needed, you're talking a minimum ten years’ timescale for these things to have any serious impact,” says Penn.

In a few years’ time, don’t be surprised if your next laptop isn’t “made in China”, but elsewhere. The aftershocks from the earthquake are still being felt but, save for a major and unexpected reversal in policy, the tectonic plates that hold up the Chinese and Western tech industries are set to drift further apart than ever.

The former CIO at TSB Bank has been fined for his involvement in the company’s 2018 IT migration which saw customers locked out of their accounts. 

Carlos Abarca, who led the botched IT migration, was handed an £81,620 fine by the Prudential Regulation Authority (PRA) for failing to take “reasonable steps” to ensure that the bank supervised its outsourcing arrangements with a third party during the project.

An investigation by the PRA found that Abarca “failed to ensure that TSB had obtained sufficient assurance from the third party” that the IT migration could be successfully carried out. 

Abarca was responsible for TSB’s outsourcing relationship with its main third-party supplier for the IT migration program. 

However, the PRA found that the former CIO failed to ensure the third party’s “ability and capacity were adequately assessed on an ongoing basis”.

Similarly, the investigation concluded that Abarca failed to ensure that TSB had obtained “sufficient assurance” over the third party’s readiness to operate the new IT platform.

Sam Woods, deputy governor for Prudential Regulation and CEO at the PRA, said Abarca was found to have breached the PRA’s senior manager conduct rule 2 and that his conduct during the program “fell below the standard” the regulatory body expects.

“Senior managers have an essential role to play in ensuring that firms manage and supervise outsourcing effectively,” Woods said in a statement.

“In this case, the PRA has fined Mr AbarcA because his management of a key outsourcing relationship fell below the standard we expect.”

In its statement, the Bank of England said Abarca agreed to resolve the matter with the PRA, which resulted in a 30% reduction in the overall fine imposed by the PRA. Without this discount, the financial penalty would have been £116,600.

TSB’s botched migration

The April 2018 migration project at TSB had intended to update its IT systems and migrate data for corporate and customer services to Banco Sabadell’s systems as part of a merger.

Although the migration was initially successful, the platform subsequently experienced major technical issues, resulting in significant disruption to TSB banking services. 

In-branch, telephone, online, and mobile banking services were all severely disrupted due to the failed migration, which affected millions of customers. 

Some customers were left without access to banking services until December that year, and the company was forced to pay more than £30 million in compensation to affected customers. 

The incident also prompted regulatory action against the high street bank. In December last year, the Financial Conduct Authority fined TSB £48.65 million. 

This fine marks the first penalty imposed on an individual involved in the failed migration, according to the Bank of England.

Ofcom has proposed that cloud service providers in the UK be referred to the Competition and Markets Authority (CMA) amid concerns that ‘hyperscaler’ dominance of the marketplace is stifling competition.

Technical restrictions on multi-cloud options, high fees for data transferal, and committed spend discounts imposed by major providers were identified as highly restrictive to businesses using cloud services across the UK, Ofcom said.

The regulator warned that, if left unchecked, competition could “deteriorate further in a critical digital market for the UK economy”.

Ofcom’s referral to the CMA follows an investigation by the regulator, launched in October last year, into competition concerns in the cloud infrastructure services market.

As part of the investigation, Ofcom examined the “strength of competition” in the space to assess whether current market conditions might limit innovation and growth, and inhibit smaller cloud providers from entering the market.

Ofcom said its investigation “provisionally identified features and practices that make it more difficult for customers to switch and use multiple cloud suppliers”.

“High barriers to switching are already harming competition in what is a fast-growing market. We think more in-depth scrutiny is needed, to make sure it’s working well for people and businesses who rely on these services,” said Fergal Farragher, Ofcom's director responsible for the market study.

The regulator aired specific concerns about the practices of Amazon Web Services and Microsoft Azure due to their dominant market positions.

Collectively, the two companies command a market share of between 60-70% while Google Cloud holds between 5-10% of the market.

Ofcom said that although competition between the three hyperscalers is delivering benefits to customers, specific practices employed by major providers are having a significant negative impact on businesses.

Egress fees, charges that customers pay to transfer data out of the cloud, were identified as a particular area of concern for the regulator. Ofcom warned that hyperscalers set fees at “significantly higher rates than other service providers”.

These costs were found to discourage customers from using services from more than one cloud provider, or to switch to an alternative provider.

“Technical restrictions on interoperability” were also a primary concern highlighted in Ofcom’s investigation. The regulator said that leading firms actively prevent some of their services from working effectively with other providers’ offerings.

“This means customers need to put additional effort into reconfiguring their data and applications to work across different clouds,” Ofcom said.

Meanwhile, committed spend discounts, which can benefit customers by reducing costs, were found to be structured in a way that incentivised businesses to use a single hyperscaler for “all or most of their cloud needs, even when better quality alternatives are available”.

“These market features can make it difficult for some existing customers to bargain for a good deal with their provider,” the investigation found. “There are indications this is already causing harm, with evidence of cloud customers facing significant price increases when they come to renew their contracts”.

Business cloud concerns

Ofcom’s statement comes amid a period fraught with growing concerns over cloud expenditure among businesses of all sizes. Cloud costs have increased over the last 15 months, prompting some businesses to reassess their relationship with cloud service providers.

Similarly, others have embarked on ‘cloud repatriation’ projects to move workflows out of the cloud and back into on-prem architectures.

Businesses are also increasingly considering multi-cloud options as a way to diversify internal IT architecture and unlock financial benefits.

Ofcom aired concerns that current constraints placed on customers seeking to use more than one cloud provider “could make it harder for smaller cloud providers to win business and compete with the market leaders”.

“Revenues are already concentrated with a few players, and there is a risk that the features we have identified could lead the market to concentrate further towards the market leaders,” the regulator said.

A score of tech pioneers have signed an open letter calling for a halt to advanced artificial intelligence (AI) development.

The open letter from the Future of Life Institute has received more than 1,100 signatories including Elon Musk, Turing Award-winner Yoshua Bengio, and Steve Wozniak.

It calls for an “immediate pause” on the “training of AI systems more powerful than GPT-4" for at least six months.

According to the institute, the call to action comes in direct response to the rapid acceleration of generative AI technologies currently being rolled out by major industry players such as Microsoft and Google.

The letter argued that while this wave of innovation continues, there is a distinct lack of corporate and regulatory safeguards currently in place to moderate generative AI development, which poses significant risks to society.

“As stated in the widely endorsed Asilomar AI Principles, advanced AI could represent a profound change in the history of life on Earth and should be planned for and managed with commensurate care and resources,” the letter read.

“Unfortunately, this level of planning and management is not happening, even though recent months have seen AI labs locked in an out-of-control race to develop and deploy ever more powerful digital minds that no one – not even their creators – can understand, predict, or reliably control.”

The recommended six-month pause on development should be “public and verifiable”, the institute said, and include collaboration between “key actors” in the tech industry to jointly develop and implement a “set of shared safety protocols for advanced AI design”.

In addition, once implemented, the safeguards should be “rigorously audited and overseen by independent outside experts”.

“These protocols should ensure that systems adhering to them are safe beyond a reasonable doubt. This does not mean a pause on AI development in general, merely a stepping back from the dangerous race to ever-larger unpredictable black-box models with emergent capabilities.”

Responsible AI development

The publication of this open letter follows calls from a range of industry stakeholders highlighting the growing importance of responsible and ethical AI development.

Last week, Mozilla announced the launch of a new open-source AI startup, dubbed Mozilla AI, which aims to bring together developers, researchers, and policymakers to encourage the development of ‘trustworthy AI’.

Mark Surman, executive president at Mozilla, told IT Pro the organisation hopes to position the startup as a counterweight to the dominance of Microsoft and Google, both of which are investing heavily in generative AI.

Surman suggested that the acceleration of generative AI products in recent months poses serious risks to both businesses and society alike, with developers often failing to consider the potential negative impact these technologies can have on individuals and public discourse.

Alongside industry action, the open letter called for AI developers to work with policymakers to “dramatically accelerate [the] development of robust AI governance systems”.

These governance systems should “at a minimum” include:

• New and capable regulatory authorities dedicated to AI
• Oversight and tracking of highly capable AI systems and large pools of computational capability
• Provenance and watermarking systems to help distinguish real from synthetic and to track model leaks
• A robust auditing and certification ecosystem
• Liability for AI-caused harm
• Robust public funding for technical AI safety research
• Well-resourced institutions for coping with the dramatic economic and political disruptions (especially to democracy) that AI will cause

In recent months, the topic of AI regulation has been debated repeatedly. In the UK, policymakers are considering how to forge a balanced approach to generative AI that places a focus on responsibility while enabling innovation and growth.

The UK government’s AI white paper, published today, outlined plans to guide the responsible development of AI while taking a pro-innovation stance.

The government said it will avoid implementing “heavy-handed legislation” that could stifle innovation, instead opting for an “adaptable approach to regulating AI”.

“This approach will mean the UK’s rules can adapt as this fast-moving technology develops, ensuring protections for the public without holding businesses back from using AI technology to deliver stronger economic growth, better jobs, and bold new discoveries that radically improve people’s lives,” the government said in a statement.

Signatories deny involvement

The publication of the open letter has sparked controversy among purported signatories, with some revealing that their names had been added without consent.

Yann LeCun, chief AI scientist at Meta, refuted claims that he had signed the open letter in a tweet today while others have followed suit.

“Nope. I did not sign this letter,” he said. “I disagree with its premise.”

Since its publication, the names of other signatories have begun “disappearing”, according to analysis of the letter from Semafor journalist, Louise Matsakis. However, prominent names including Elon Musk, Steve Wozniak, and Yoshua Bengio still remain, prompting confusion.

Frequent readers will know I’m no great fan of our telecoms and media regulator, Ofcom. In much the same way I’m no great fan of conjunctivitis or being dangled by my ankles from the back of a moving lorry, in fact. So when I find myself feeling sorry for Ofcom, you know it’s being wronged.

Ofcom is being made the fall guy for everything that’s unworkable in the government’s Online Safety Bill, which is nearing the end of its years-long plod through parliament. Ofcom is the go-to answer when ministers are quizzed about how something incredibly difficult will be resolved; it is the arbiter of anything faintly controversial in the bill; it is being tasked with finding technical solutions that haven’t even been invented yet. And when all this goes horribly wrong – which it will – the politicians will shrug their shoulders and point their finger in Ofcom’s direction. This plot is more obvious than a Bond film’s.

If you open a PDF of the draft bill, which is still being amended, and perform a search for any mention of “Ofcom”, you’ll find its name mentioned 645 times. I listened in to a Commons debate on the draft bill in early December, and MPs mentioned Ofcom hundreds of times more, with politicians from all sides urging the government to give the regulator even more responsibility than it’s already burdened with.

Here is just a flavour, a mere smattering, of some of the things that Ofcom is being tasked with in the legislation as it stands today.

• It has the power to require tech companies to remove images of child sexual exploitation using as yet unidentified “accredited technology”
• The same goes for content promoting terrorism; it must ensure that social media platforms and adult websites put in place “robust age verification” using technologies once again accredited by the regulator
• It has the power to fine big tech companies 10% of their annual turnover for compliance failures
• It has the power to take action against “individual directors, managers and other officers” at regulated companies, which it must define itself
• It will also have to step up its current responsibility to improve the public’s media literacy

That is just a soupçon of all the Ofcom responsibilities that are already in draft legislation. Then there’s the stuff that MPs want to be added to the bill. Dame Margaret Hodge wants Ofcom to investigate whether individual executives or algorithms are to blame for harmful material not being removed from the internet. Damian Collins said Ofcom must “play a role” in ensuring social networks take down “Russian state-backed disinformation”. John McDonnell called for Ofcom to assess whether confidential journalist material is being exchanged before it issues a notice ordering a tech platform to monitor user-to-user content.

Again, these are only three examples plucked from a single hour of debate on the bill in early December.

It’s not merely the sheer workload being heaped onto Ofcom’s shoulders that makes this an impossible job, it’s being asked to implement technological solutions that simply don’t exist. Davis pointed this out in a debate over the proposed Ofcom power to force social media companies to monitor encrypted conversations. “The Bill allows Ofcom to issue notices directing companies to use ‘accredited technology’, but it might as well say ‘magic’, because we do not know what is meant by ‘accredited technology’,” he pointed out.

“Clause 104 will create a pressure to undermine the end-to-end encryption that is not only desirable but crucial to our telecommunications,” he added. “The clause sounds innocuous and legalistic, especially given that the notices will be issued to remove terrorist or child sexual exploitation content, which we all agree has no place online.”

Davis hits the crux of the issue right there. Every time the bill defines something we all want to get rid of – child abuse, terrorist materials, racist content – it punts responsibility to Ofcom to work out how to do it. Ministers say they don’t want to handcuff Ofcom by being prescriptive over how to remove this content, but the truth is they just don’t know how to do it. Nobody does.

And so, it will fall to Ofcom, chaired by a 79-year-old broadcasting veteran best known for being the agent for Morecambe & Wise, to work all this out. Not to mention the 644 other things it has to do, at the time of writing.

It’s an impossible job for a regulator that’s not exactly renowned for being nimble in the first place. I wouldn’t wish the job on my worst enemy. Unfortunately for both of us, it’s my worst enemy that’s got it.

One of the more complex corners of the technology industry businesses often refrain from touching is the cryptocurrency market. Built on a principle of a decentralised market, away from the prying eyes of central bodies or governments, and utilising blockchain technology to provide a clear and concise record of all transactions, cryptocurrencies have proved to be eminently investable.

Bitcoin has almost become synonymous with cryptocurrencies, and for good reason, after seeing its valuation grow to $48,000 in the wake of the pandemic. As has always been the case, however, its value plummeted again in what’s only the latest twist in a series of rises and falls. The crypto market, at the time, underwent something of an implosion given the raft of negative headlines and incidents revolving around fraud and bankruptcy.

One of the biggest stories that continue to affect the market is the demise of FTX, an exchange that seems to have defrauded its 1.2 million users to the tune of $8 billion. It’s no wonder, therefore, that the UK government has decided to join the US and EU in kicking off legislative proceedings with a view to regulating the cryptocurrency and blockchain world.

Regulation will force crypto to ‘grow up’

For those already invested in crypto assets, regulation could be seen as a dirty word. After all, one of the reasons investors are attracted to these tokens is its decentralised nature. Gabriella Kusz, CEO of the Global Digital Asset and CryptoCurrency Association, however, is quick to temper expectations, saying “this is still an emerging space”.

“Although governments that are balancing innovation with protecting consumers and market integrity, the decentralised nature of crypto is still one of the key components that drive value,” says Kusz. “I think, as we've seen with FTX, there are risks and challenges that centralised digital assets firms need to address in order to ensure protection and advancement of a high-quality digital asset ecosystem.”

Even without those protections, there are great swathes of people who believe in the crypto revolution. Countries like El Salvador and the Central African Republic have adopted Bitcoin as legal tender, and Latin Americans alone accounted for $562 billion of received value from crypto last year. On top of this, the Venezuelan government also attempted to introduce its own oil-backed stablecoin called Petro the nation’s official cryptocurrency.

This relatively mainstream adoption doesn’t make the world of crypto a stable environment, though. Despite these moves – which are sure to send positive signals – over the course of the last 12 months, thousands of dollars have been wiped off the value of Bitcoin.

This volatility is one of the key reasons why cryptocurrencies need a set of governable rules, according to Bittrex Global CEO and general counsel, Oliver Linch. “I think regulation is necessary for crypto to grow up,” he says. “The analogy I really like is looking at the internet in 1995, it was an absolute cesspit. But amongst all the awfulness were things that became Google, Amazon, and eBay.

“Crypto is a bit like that,” he continues. “We need to have a bit of a clearout, get rid of some of the scams, but the way to do that in financial services is through regulation. The individuals who want to get involved in crypto want to do that in an environment where they’re not going to be left to fend for themselves. I wouldn't put my money in an unregulated bank, so why would I put my money in an unregulated exchange?”

What about existing regulations?

The analogy to the early days of the internet is one that Andreas Veneris, professor of computer science at the University of Toronto, also draws. He adds, however, that the crypto market isn’t completely unregulated.

In order to handle money, crypto exchanges have to comply with financial conduct regulations in all major countries to maintain a licence to provide financial services. “Of course, this regulation is more critical than in the early days of the internet, because cryptocurrencies can risk financial stability,” explains Veneris.

“But it's wrong to say there's no regulation. In order to own a crypto share or a token, you have to deposit money into a centralised exchange, which takes your money out into a decentralised exchange. Those money service providers need a money remittance licence, otherwise, they cannot operate.”

It’s clear, though, these regulations aren’t doing enough, and Veneris himself says as much. Yet, headlines of fraud, scams and bad actors also undermine the philosophy behind the crypto movement, which is to open up the financial landscape to everyone, no matter of nationality or credit score and away from the dominant central banks of today. Kusz, however, says the industry should hold itself to account more, adding “when talk turns to the right to self-regulate, I always push back and talk about the responsibility they have to self-regulate.”

Protecting users and customers

The fact is that the window of opportunity for the crypto industry to self-regulate has passed, and governments across the world are looking to establish a regulatory framework to protect users and create a safer environment in which to participate. The UK is seeking to introduce stablecoins, while the Financial Conduct Authority (FCA) has also set out its stall on regulation. This is in addition to the US Treasury calling for stablecoin legislation.

Participation is well underway, according to Kusz, who says we're already starting to see consumer outlets offering payments in Bitcoin. “But the biggest implications of regulation will be for the broader digital assets, and tokenisation in general; NFTs but also stablecoins are areas that are strongly affected by regulation.”

As a result of this regulation, Veneris says cryptocurrencies like Bitcoin “will present an asset that has characteristics like gold”, in which entities can invest and check every six months to see if the value increases.

For Linch, though, the real benefits that cryptocurrency regulation will bring will be linked with the legitimisation of blockchain, given the core technology powering the likes of Bitcoin has often been unfairly tarred with the same brush. Indeed, the ledger technology would allow any nefarious activity to be picked up on and traced to the original offender.

“With blockchain monitoring, banks will be able to carry out anti-money laundering, know your customer (KYC) checks, and combat terrorist financing,” he says. “The transparency of the blockchain means banks can trace Bitcoins all the way back to exactly who mined them in the very first place.

“If we use this technology, we will end up having much cleaner markets, fairer trading environments, and more transparency than we ever could in the traditional markets. In fact, there are some areas where the crypto industry has not only caught up with the big banks – but have exceeded them.”

Experts have urged the UK government to rethink the "tremendous" financial burden placed on network operators in the current economic landscape.

Mobile network operators (MNOs) are currently facing steep costs from a number of different angles, including the data cost of big tech companies, regulatory fees, and national security mandates like the decision to remove Huawei from national 5G infrastructure.

Speaking at a Westminster eForum event, the panel of experts from throughout the sector identified a range of areas which the government could look to overhaul in order to improve business for UK telcos, and by extension boost services for businesses and consumers.

“This is probably a government position, maybe a security position, but there is a tremendous cost to the MNOs,” said Danny Preiskel, senior partner at Preiskel & Co

“It doesn’t seem right to me that MNOs should bear the full cost of this decision.”

The decision to ban Huawei came in 2020, a year after the first 5G networks opened in the UK, and was expected to delay rollout by up to two years.

At the time, a Mobile UK study indicated that the cost to the economy could be £7 billion, and MNOs were threatened with fines of £100,000 or 10% of turnover per day for failing to meet targets.

“The existing market structure is dysfunctional," said Stephen Lerner, general counsel and regulatory affairs director at Three UK. "The market should be allowed to restructure itself, it doesn’t deliver for customer or business ambitions. MNO returns are too low."

In recent months, MNOs have also argued that big tech companies account for a disproportionate share of network traffic to generate their profits, and that they should make set contributions to support infrastructure expansion. Social media firms such as Google and Meta have been particularly criticised.

The fair share argument has gained traction in the EU over the past few months, and the panellists acknowledged that the topic dominated Mobile World Congress in Barcelona.

Various European telcos have urged officials to ensure that big tech companies pay to support the traffic expansion on which they rely.

On 23 February, the European Commission opened an exploratory consultation on the potential for “all players benefitting from the digital transformation to fairly contribute to the required investments”.

“I think that whether it will happen or not, obviously very much remains to be seen," said James Robinson, senior analyst at Assembly Research. "At the moment, the commission has issued this exploratory consultation on the future of the industry.

“The telecoms industry needs to respond to the consultation with a compelling argument for how you would implement fair share and practice, whether it’s direct payments to telcos and then who is responsible for facilitating that? Or you could go down the route of a universal service obligation, with a fund set up as the primary mechanism to receive payments from tech firms.”

Wider financial issues

Annual licence fees (ALFs) were another government requirement that panellists singled out as unfairly limiting competition in the communications market.

First introduced in January 2022, ALFs replaced the fixed-term 2100MHz spectrum licences first agreed on in 2001 with the rollout of 3G. MNOs now enjoy indefinite access to their spectrum licences, but have to pay a yearly fee.

“ALFs serve no purpose other than to generate revenue for the government,” said Lerner.

Lerner argued that the market ensures efficiency on its own, without the need for prescriptive measures and fees on top of already high operating costs.

He cited Ofcom’s own ‘future approach to mobile markets and spectrum conclusions’ paper [PDF] to illustrate that Three and Vodafone earned returns below the cost of capital between 2019 and 2021.

Sophie James, head of telecoms and spectrum policy at techUK, described ALFs as “money that goes into a large pot”, and urged the government to allow MNOs to instead spend this money on national networks, network resilience, and supporting growth in the market.

Lerner also stated that the current level of investment in the market was billions of pounds short of what is needed and argued that its long-proposed merger with Vodafone is necessary to maintain the market.

The Competition and Markets Authority (CMA) will ultimately weigh in on this decision, with Ofcom acting as a source of information but not a decision-maker said Brian Potterill, director of mobile network strategy at Ofcom.

“When Three and O2 tried to merge, Ofcom took a very clear position against this," he added.

"There are two network sharing arrangements in the UK, and our concerns at the time were that the merger would have straddled the sharing arrangements. That was then, this is now. Every merger has to be judged on the merits of the merger at the time."

This article was amended to attribute comments to Stephen Lerner, which had been incorrectly attributed to James Robinson.

The Labour Party will completely overhaul the government’s light-touch, ‘anti-innovation’ approach to digital regulation if it ever came to power.

Chi Onwurah, shadow minister for science, research, and innovation, told delegates at State of Open Con 2023 that a future Labour government would view a stronger regulatory landscape as one that promotes investment and industry-wide innovation.

Onwurah, who was formerly head of telecoms regulation at Ofcom and has a rich technology background, critiqued the failure of successive Conservative governments on shaping key pieces of regulation, branding its agenda as “wholly inadequate”.

She claimed that, due to a lack of regulatory certainty, Britain has the lowest levels of business investment in the G7 and that many startups are either being acquired by foreign entities or are moving abroad due to a lack of finance.

“Successive [Conservative] governments, their legislative and policy agenda on digital – whether it be the 'online harms' bill or AI strategy or security and resilience – lacks ambition or is wholly inadequate,” Onwurah said. “It doesn’t understand and reflect the opportunities of technology.

“One particular reason is successive Conservative governments do not see regulation as supportive of innovation. Regulation can be a barrier to innovation, but also regulation can support innovation – particularly access of smaller, more agile companies to government contracts [and] to marketplaces.

“The government has the wrong-headed idea that regulation is anti-growth and I just wanted to say regulation can be pro-growth and there’s strong evidence that a lack of agile regulation is undermining competition across many sectors of our economy, dragging down innovation and productivity.”

The “new settlement for the digital age” will see ambitious measures introduced on several fronts, with the aim of democratising technology and giving a competitive edge to small and medium-sized businesses (SMBs).

It marks a dramatic shift from the orthodoxy of the incumbent Conservative government, in which industry regulation has often been seen as detrimental to innovation and competition.

Regardless, fears continue to mount over the pace of innovation, particularly in areas such as generative artificial intelligence (AI), and how it’s outpacing lawmakers’ capacity to mitigate any risks.

“When they’re well-targeted, activist regulation can be pro-growth and pro-innovation,” said Onwurah. “So, good regulation can create some virtuous circles, where more people trust and use the systems, encouraging greater investment and, in turn, more adoption across sectors.”

Labour’s digital programme for government centres around several priorities such as opening up data across the business landscape, upskilling workers, diffusing tech across public services, and ensuring 5G potential is fully unlocked.

Other key measures include harnessing data for the public good, building resilient supply chains and embedding AI and data analytics in government.

Digital transformation creates a variety of new opportunities, but unfortunately can also result in the increase of risks, and the more an enterprise can understand the risks it faces - especially as a company-wide initiative - the more successful their digitisation will be.

This special edition guide can help your employees better understand how they can be part of a successful digital risk management strategy, with practical advice on how to apply learnings to real risk management situations.

Download now to learn:

• The basics of risk identification and management
• How to manage digital risk
• As well as five tips for successful digital transformation

Provided by

The UK government has confirmed that the planned changes to the Network and Information Systems (NIS) regulations have officially come into effect, bringing stricter rules and requirements to managed service providers (MSPs).

The updates to the framework come as a response to a public consultation held earlier this year, which highlighted the need to adapt to new and increasingly-sophisticated cyber risks.

The NIS regulations were first established back in 2018 in a bid to improve cyber security for organisations that provide critical services to the UK. Companies that fail to implement adequate cyber security measures can be fined up to £17 million for non-compliance.

Since its introduction, however, cyber attacks have continued to evolve and adapt, an issue highlighted by the likes of Operation CloudHopper, a high-profile attack that targeted MSPs and compromised thousands of organisations through their access to customers’ IT networks.

As a result of such incidents, MSPs have now been brought into the scope of the regulations, as well as the addition of several new restrictions to help maintain supply chain security.

“The services we rely on for healthcare, water, energy, and computing must not be brought to a standstill by criminals and hostile states,” said Julia Lopez, minister for media, data, and digital infrastructure. “We are strengthening the UK’s cyber laws against digital threats. This will better protect our essential and digital services and the outsourced IT providers which keep them running.”

Speaking to IT Pro earlier this year, industry experts unanimously welcomed the government's intention to bring MSPs into the scope of the new NIS regulations.

MSPs play a significant role in the world's IT infrastructure and have privileged access to numerous private sector organisations' IT estates. Compromising an MSP or other privileged organisation can lead to cyber attacks in the supply chain, as evidenced by the infamous Kaseya case in 2021.

The legislation changes form part of the government’s £2.6 billion National Cyber Strategy, which it says aims to take a stronger approach to get at-risk businesses to improve their cyber resilience.

Organisations will need to improve cyber incident reporting to regulating bodies such as Ofcom, Ofgem, and the ICO, and are required to notify their respective regulator of a wider range of incidents that disrupt their service - or ones that have the potential to do so.

“These measures will increase the resilience of the country’s essential services – and their managed service providers – on which we all rely,” commented Paul Maddinson, NCSC director of national resilience and strategy.

Additionally, the UK government will be able to amend and adapt the regulations in future should other sectors and services become essential to the UK’s economy.

Regulators will also be able to set up a “more transparent” cost recovery system for enforcing the regulations, the government says, factoring in wider regulatory burdens, company size, and other factors to minimise the impact on taxpayers.

Carla Baker, Palo Alto’s senior director of public policy UK and Ireland, said the cyber security firm backs the continued development of an “agile policy framework”.

“We welcome the opportunity to engage with the UK government as it reviews the legislation and develops guidance for industry to enhance cyber resilience and combat the risk that malicious actors pose to the UK’s national security,” she said.

Ofcom is set to examine the position of Amazon, Microsoft, and Google in cloud services as part of an investigation into whether the digital communications markets are working well for people and businesses in the UK.

As part of this, Ofcom will launch a market study in the coming weeks under the Enterprise Act 2002 into the UK’s cloud sector. It underlined that the largest providers of cloud services, also known as hyperscalers, are Amazon Web Services (AWS), Microsoft, and Google. The three firms generate around 81% of revenues in the UK public cloud infrastructure services market.

The regulator’s study will assess how well the market is working and examine the strength of competition in cloud services generally, including the position the three hyperscalers hold in the market. It will also consider any market features that might limit innovation or growth in the sector by making it difficult for other companies to enter the market and expand their share.

Ofcom will examine how the market is working today as well as how it expects it to develop in the future, hoping to identify any potential competition concerns early to prevent them from becoming embedded as the market matures. The regulator is hoping to publish a final report, including its concerns or proposed recommendations, within twelve months.

If it finds a market is not working well, it said there can be negative impacts on businesses and ultimately consumers, through higher prices, lower service quality, and reduced innovation. If this happens, Ofcom can make several decisions including making recommendations to the government to change regulations or policy, taking competition or consumer enforcement action, or making a market investigation reference to the Competition and Markets Authority (CMA).

“As the sector regulator, and with our powers to explore potential competition issues under the Enterprise Act, Ofcom’s job is to make sure that communications markets are working well for consumers and businesses,” said the regulator. “That includes keeping pace with disruptive developments in our sectors – such as new and emerging technologies, or changes in commercial models and supply chains.”

Ofcom added that digital innovations also create a risk of new types of harm, so is taking a close look at the sector in line with its duty to promote competition for the benefit of communications consumers.

Ofcom added that over the next year, it will also start a broader programme of work to examine other digital markets, including online personal communication apps and devices for accessing audiovisual content.

“We are interested in how services such as WhatsApp, FaceTime and Zoom are affecting the role of traditional calling and messaging, and how competition and innovation in these markets may evolve over the coming years,” said Ofcom. “We also want to understand whether any limitations on their ability to interact with each other raises potential concerns.”

It will also look at the nature and intensity of competition among digital personal assistants and audiovisual “gateways”, including connected televisions and smart speakers, through which people access traditional TV and radio, as well as online content.

"Ofcom’s probe is welcome news for the UK tech sector. For far too long, the big three cloud providers have dominated the market without necessarily delivering for their users," said Mark Boost, CEO of Civo. "We have reached a point where IT teams view choosing AWS or Azure or Google Cloud as the only option for their organisation, hooked in by the scale and sheer amount of services on offer.”

“I hope that Ofcom’s work will be the start of a process to create a fairer and more competitive cloud market. This needs to be built on the core principles users want from the cloud: a reliable, fairly priced service that is low on complexity and offers the fast launch times essential for the modern developer," added Boost.

If prime minister Liz Truss is serious about another bash at reforming off-payroll and IR35 rules, there will be a long row to hoe, specialists in the contractor and freelance working space argue.

IR35 was previously reformed in April 2021, but the rules remain confusing for many UK-based IT contractors, freelancers and sole traders as well as the firms that hire them. A House of Commons Public Accounts Committee report published in May, for instance, found that public bodies alone owed around £236 million to HMRC for the 2020-21 tax year due to “incorrect administration” of the latest rules.

Truss, who has been crowned the fourth Conservative prime minister in seven years, has pledged a review into the IR35 laws, which have been a bane for many IT contractors.

“The changes that have been made to IR35 are all about trying to treat the self-employed the same as big business," she told the Sun in August. “But the fact is, if you’re self-employed, you don’t get the same benefits as being in a big company. You don’t get paid holidays, you didn’t get those benefits. So the tax system should reflect that more.”

How to reform IR35

Truss' recent remarks may sadly mean little unless her team tackles the complexities of the legislation and its widely reported issues head-on. For instance, what does “mutuality of obligation” really means, asks Rebecca Seeley Harris, Re:legal Consulting taxation lawyer employment status specialist.

“People don't understand what IR35 is ... in relation to employment status,” she says, noting that different pieces of legislation can be involved. “And it has been incredibly difficult for businesses to deal with when you have agencies working with the self-employed. We need clear definitions.”

Ambiguity in HMRC's check employment status for tax (CEST) tool – which can often leave users remaining uncertain of their actual legal status – should also be addressed.

Assorted complications arise from the backdrop of around 100 years of precedent case law – points with which Seb Maley, CEO at consultancy Qdos Contractor, also agrees.

“Current rules should be scrapped in their entirety,” Maley insists. “One key issue is it's based on decades of outdated case law.”

Greater scrutiny, and explication, of links between employment rights and privileges, and more equitable taxation should help point the way towards a fairer system that also ensures organisations and workers fully understand their rights and responsibilities, he suggests.

Further implementing the Taylor recommendations

Maley points out that the – so far largely ignored – 2017 Taylor Review cited that clarification and simplification of employment status and legislation were needed if the system is to be properly reformed for managing independent workers and “newer ways of working”.

James Poyser, CEO at accountancy InniAccounts and founder of offpayroll.co.uk, agrees – although he maintains that binning IR35 isn't needed. What needs fixing, he says, is the tendency for firms to default to PAYE to reduce risk, including by building a less ambiguous, more helpful CEST – one whose results HMRC itself would stand behind.

This would give certainty to the self-employed, as well as the companies that need flexible workers to drive growth and agility. Up to 1.2 million UK workers could benefit, says Poyser, because an effective blanket ban on contractors isn't good for business.

“When economies bounce back, the self-employed can be key to growth and recovery. Encourage HMRC to get together with a group of people, sit around a table, and take this on,” he says, noting that stakeholder expertise is available, including from the House of Lords if not always from the Commons.

Andy Chamberlain, policy director at the association for Independent Professionals and the Self-Employed (IPSE), adds Truss' focus on IR35 could be because the government is “obviously worried about corrosion of the tax base”.

What if more people choose off-payroll work and can pay less tax as a consequence? Changes to the tax system could help, he says.

“Then we don't have to worry about policing this boundary because we've come to a compromise basically – one key issue is the National Insurance (NI) the employer pays,” he offers.

NI could go under the microscope

Part of the solution might be around adjusting NI payment obligations so similar rates of tax ultimately end up in HMRC coffers regardless of employment status per worker. However, devising the right detail for a fairer regime may yet require quite a lot of “careful thought”, admits Chamberlain.

Kate Cottrell, managing director at IR35 and off-payroll investigation specialists Bauer & Cottrell, maintains that a full review is needed, instead of simply tinkering around at the edges, which she thinks is more likely.

“If you start out with a complete mess and on the back of it identify millions in underpaid tax and NI contributions, as in the public sector, any change is fraught with difficulty,” she says. “There are so many things wrong with the off-payroll rules for both public and private sectors.”

That said, provided all parties understand the rules and implement correct contractual terms, accurately reflecting day-to-day working practices, it remains possible to comply with confidence and without resorting to blanket bans or determinations that all contractors fall inside IR35, Cottrell says.

“Contractors engaged by medium and large businesses need to ensure they have Status Determination Statements and that they have had input into the status process. Companies and organisations that use them need to stand back and evaluate what it is they want – a specific project carried out by a professional contractor, or a 'disguised employee'?” she points out. “Don't wait for a review from Liz Truss.”

It’s easy for accessibility on the web to feel like a new phenomenon, but some of the oldest accessibility resources date back more than 20 years. Created by World Wide Web Consortium (W3C), the Web Content Accessibility Guidelines (WCAG) have become integrated into many legislative decisions when it comes to web accessibility, including in the UK.

WCAG has changed and been adapted over the years – the highest level of compliance is WCAG 2.1 AA, with WCAG 2.2 currently slated for release in September 2022. They have a long history, though, and are reasonably complicated. We track how WCAG has evolved through the years, and why incorporating ease of use into the fabric of web design is essential for businesses in the modern age.

What are the origins of WCAG?

Geoff Freed has been working in web accessibility since the early days of the movement. He now works as director of Perkins Access Consulting – an arm of the Perkins School for the Blind, one of the oldest institutions of its kind in the US.

Freed served as an expert during the development of the first set of guidelines, before becoming a contributor to the second set. He’s also a co-author on the time text markup language (TTML), which is used by media giants like Netflix and Amazon to provide captioned content. In short, the industry veteran says – in the early days – incorporating these guidelines into any kind of legislation wasn’t on the table.

“When the first version of the guidelines were published, it's not as if suddenly the crowds broke and the sun began to shine through. It's more like in the industry we now had a set of recommendations, which is what they were and remain. We now had a set of formal recommendations that we could say to people, ‘Hey, look there are real practices that you can do to make something more accessible’.”

Has WCAG been integrated into legislation?

Like almost every disability access standard, the worldwide implementation of these guidelines has taken a long and winding road. WCAG was first published in 1999, and is key to the role of the US’ section 508 – which is part of 1973 Rehabilitation Act, which prohibits US federal agencies and contractors from discriminating against disabled people.

Section 508 was amended in the late 90s to add content to the terms covered by the act. In the US, lawsuits have played a key role in advancing web accessibility, often in tandem with Americans with Disabilities Act (ADA) complaints. The same, though, cannot be said of the UK.

In the UK, the WCAG are quasi-integrated into the Public Sector Bodies (Websites and Mobile Applications) Accessibility Regulations 2018. Those regulations came after an EU directive and follow the European standard for digital accessibility called EN 301549, which are harmonised with the WCAG.

Prior to the regulations, much of the web accessibility requirements applicable to Britain stemmed purely from the 2010 Equality Act and 1995 Disability Discrimination Act in Northern Ireland. EN 301549 is what applies to public entities with ISO 30071-1, an international standard, being the code that applies to organisations outside of the public sphere. The latter is not a law, though it does relate to the equality act. Got all that?

Despite the inherent confusion created when accessibility is considered internationally, Freed likens the applicability of WCAG as akin to other tech compatibility issues throughout history. “It means that we avoid the Betamax/VHS problem as much as possible when things are standardised,” he comments.

How much of the web complies with WCAG?

If you’re compliant with WCAG 2.1 AA, then you’re also following the UK’s rules, but with any type of guidelines the inevitable question is: how well are they being abided by? According to US-based Web AIM’s 2022 analysis, 96.8% of the web’s top websites had some form of WCAG flaw on their homepage. The most common being a lack of low contrast text, missing alt text, missing form labels, empty buttons, and missing document language. While these numbers seem daunting – and they are – the report notes that 21.6% had five or fewer errors.

Josh Koenig, co-founder of web operations platform Pantheon, says that accessibility is one of the facets of IT infrastructure that tends to be a casualty of other elements “breaking at scale.”

“What happens to people when they start to reach that scale is that governance breaks down. Once governance breaks down, it's just a matter of time until accessibility goes off the rails somewhere,” Koenig says. He adds that, generally speaking, he sees large companies falling into two camps: those who create access because they’re legally required to; and those who do so because it’s part of their core mission.

Broadly, he sees institutions like universities being more likely to follow accessibility guidelines as opposed to business entities who are rarely, at least in the UK, absolutely required to follow the same level of access as publicly funded entities. More than that, though, Koenig sees an industry that’s foundationally lagging when it comes to understanding accessibility as part of the way of doing business. He would know; Pantheon is used by companies ranging from Google and Harvard, to the United Nations and Doctors Without Borders.

“Our industry – a lot of it is still stuck in this kind of old-world ‘wait for the relaunch’ kind of mindset to make material improvements,” he continues. “That’s not a great way to approach accessibility, because you need to be able to make those incremental improvements; because a lot of these things, they're small. You're not going to fix it with a big redesign, you're going to have to make steady progress on it over time.”

Why 100% WCAG compliance isn’t the end goal

Freed says when he started out in the industry as a captioner in the mid-1980s, teaching about accessibility was part and parcel with his profession. He says providing insight is still key to increasing access on the web today.

“The percentage of websites that are accessible online, and by accessible I don't mean 100% accessible because that's an impossible standard to achieve, but that are accessible by design online is probably a rather small percentage of all the materials that are available. But it's a growing percentage – and education has a lot to do with that.”

Part of the reason 100% compliance isn’t the end goal, Freed continues, is because compliance doesn’t always equal usability. If your website doesn’t have video, for example, then you’re not going to have captioned content. Theoretically, you haven’t checked that box as far as the guidelines are concerned, but your website might be perfectly usable.

“Just because you can't achieve 100% doesn't mean that what you can achieve is worthless,” Freed says. “The goal is not 100% conformance. And one of the reasons I say that is because you can have a website that checks all the boxes for meeting criteria in WCA. But that doesn't necessarily mean that it's usable by everybody.”

Koenig says that, from his point of view, education about accessibility is less about what your average new developer understands about access, and more about how those in management understand its importance. He likens this trend of pushing more and more developers to understand accessibility to “drinking from a firehose of information”.

“It’s more about having accessibility be a part of the practice, which means management needs to be bought into it and everything else,” he says, “and also that your design [begins] with accessibility in mind.

“At the beginning you totally need this way to constantly improve and iterate to keep up because accessibility is a moving target, but also when you eventually do some kind of redesign. If your designers are savvy about accessibility, they can probably improve some things, but this also starts you off in a place where maintaining or continuing to improve accessibility over time is much easier.”

Freed says the industry needs to understand, at all levels, that accessibility isn’t a niche concern. It’s fundamental to an optimal web environment. “Accessibility isn’t just something that developers and designers do, it's something that needs buy-in from the very highest levels of your organisation,” he says. “One way to get that buy-in is to stress that accessible design is for everybody – not just for people who are blind, or people who are deaf or have mobility disabilities. It's for everybody.”

The European Commission’s antitrust enforcers have launched an investigation into Google's app store rules.

The US tech giant's rivals have received confidential questionnaires from Brussels, according to Politico, which centre around queries challenging the billing terms and developer fees for Play Store.

Google’s high developer fees and refusal to allow alternative billing systems to collect payment from users are among the matters being investigated by officials.

The ongoing Netherlands’ investigation into Google's Play Store rules will likely come to a close as the EU examines anticompetitive conduct on an EU-wide scale, sources said. As matters stand, Google faces heightened regulatory scrutiny, with the United Kingdom's Competition and Markets Authority (CMA) also investigating its Play Store.

In a statement, Google said the company had been discussing "a number of things" with the Commission, including recent changes to make Play Store terms and conditions equitable to address allegations of unfair conduct from developers.

As of July 2022, the company had made arrangements to allow select app developers to use alternative billing systems in the Play Store when collecting payments from European users. Google also promised reduced developer fees to comply with the EU’s recently proposed Digital Markets Act (DMA) which prevents large companies from abusing their market power to hinder competition.

Per reports, the DMA will be written into the EU’s rulebook by October, and tech firms affected by it are required to comply from 2024.

The UK government’s regulatory pursuit of big tech companies has stalled once again, and the country is now at risk of lagging behind the rest of the world when it comes to setting the agenda, critics are warning.

Britain has contemplated imposing stronger regulations on the digital sector for years, especially in order to promote greater competition and innovation. After years of rhetoric, the government finally proposed the Digital Markets Unit (DMU) – a new arm of the Competition and Markets Authority (CMA) – in November 2020.

Nearly two years on and several re-announcements later, most recently in May, we’re no closer to seeing the unit get the statutory powers it needs to be an effective force. This is despite the fact it was established last year. The omission of any relevant legislation from the Queen’s Speech means these powers now won’t be granted for at least another year. Without it, the regulator won’t be able to set any statutory rules for the biggest tech firms, nor impose fines if they violate those rules.

Many have been quick to warn this delay will result in significant consequences for UK businesses and consumers. Others, meanwhile, warn it can make it difficult to unleash the full potential of the UK’s most exciting startups if tech giants’ swelling market power continues to create barriers to entry for entrepreneurs.

"The news that the government isn't intending to strengthen the work of the CMA makes no sense,” Heather Burns, head of policy and governance at the privacy-focused network Maidsafe, tells IT Pro. “In failing to strengthen the CMA's work while simultaneously pressing forward with the Online Safety Bill, the government is doing nothing to address the biggest problems at the point of their biggest impact, on one hand, while creating a hell of a lot of new problems for everyone else on the other hand.”

While the DMU currently exists with around 60 members of staff, it has no powers beyond the CMA's existing capabilities. Yet, big tech’s dominance is ever-growing; the COVID-19 pandemic has brought a significant increase in both profits and power, which has led to calls for the stronger policing of these entities.

While authorities on a global scale are reacting to these calls – Europe has reached an agreement on landmark digital rules to rein in online “gatekeepers”, and the US has a package of tech-focused antitrust bills – why is the UK dragging its feet?

Why is Britain so slow to act?

There are likely to be a number of factors behind the government’s change of pace over big tech regulation, including the impact of COVID-19 while there’s no doubt Brexit is squeezing parliamentary bandwidth. That these proposals have effectively been put on the back burner also reflects the fact the government doesn’t see them to be as urgent as the CMA does, according to Peter Broadhurst, a partner at law firm Crowell & Moring.

“It may be that the government is actively slowing the process down in order to leave more time to reflect, consider and consult on what is the right balance between the need – and the cries – to control big tech companies, and a desire to signal that the UK is still a tech and innovation-friendly country,” he tells IT Pro. “The government wants to get that balance right because it wants the UK to be a winner in the competition for attracting tech investment.

“Indeed, the government may think that tech companies will view the delay in launching any specific new laws as a window of opportunity to establish or grow their business in post-Brexit Britain.”

This latter point is one shared by Colin Hayhurst, CEO of Mojeek, a UK-based search engine with a no tracking privacy policy, who believes the government’s stalling could be part of a ploy to attract big tech companies to the country.

"Currently, US big tech EMEA HQs are in Ireland and Luxembourg,” he tells IT Pro. “A big prize for the UK would be attracting Google, Meta, Amazon, Apple, or Microsoft to move their EMEA headquarters to London, where they all have a substantial presence. With Brexit freedoms to reduce regulatory and tax burdens for these companies, perhaps delaying big tech regulation helps to further that aim.

“Meanwhile, the EU will be increasingly seen as hostile to big tech, as they get ahead of the UK with their Digital Markets Act (DMA) and Digital Services Act (DSA).

Another reason for the delay could be that the UK government is biding its time to observe how the EU’s regulations play out. Jean-Philippe Vergne, associate professor of Strategy at the UCL School of Management, tells IT Pro: “One might assume that a Conservative government naturally shies away from regulating the economy further, but a ‘wait and see’ approach has two upsides. First, to distinguish the UK from the rest of the EU, which some might see as a plus. Second, to learn from potential shortcomings of the new EU regulations.”

Does the UK risk falling behind the rest of the world?

The UK was once considered a leader in the growing movement to crack down on big tech dominance. The CMA, for example, was one of the pioneers of regulation, and one of the first competition authorities around the world to start scrutinising the activities of tech companies more closely.

That increase in scrutiny by the CMA, which adopted the view that technology was no longer invariably good for competition and consumers, had a wide-reaching knock-on effect. It arguably brought us to the situation we have today, in which most major antitrust jurisdictions are reviewing their rules and concluding not enough has been done to regulate the business practices of massive tech companies.

While once at the forefront, however, the delay in empowering the DMU means the UK will inevitably be left in the background, according to Broadhurst. “Despite the comments from the CMA that they understand the reasons for the delay, and that this isn’t a big blow, it will obviously be frustrating for them,” he says.

Will Richmond-Coggan, a tech and privacy specialist at Freeths LLP, agrees the UK’s current position could see it become vulnerable. He adds that despite the country’s wishes to set its own post-Brexit agenda, including the new data protection framework in the form of the Data Reform Bill, this situation could force it to rely more heavily on EU legislation.

“The UK can ill-afford for another jurisdiction’s legislation to set the gold standard for big tech regulation in the way that the EU has done with GDPR in relation to personal data,” he tells IT Pro. “In those circumstances, we would be likely to be increasingly reliant on mirroring those rules or finding ourselves entirely out of step with the global tech regulatory landscape.”

What’s next for the DMU?

It remains unclear when powers for the DMU will be legislated, and a spokesperson for the Department for Digital Culture, Media and Sport (DCMS) tells IT Pro it “cannot comment on timelines”. They insist the pro-competition regime will change the conduct of the most powerful tech firms, and that the department will respond to its consultation “shortly”.

This means, for the foreseeable future, at least, big tech firms could be in for a bumpy ride, particularly when it comes to regulatory hurdles surrounding mergers and acquisitions, through to delays or price impacts when looking to sell to buyers from other territories.

Broadhurst, however, believes the CMA is well within its rights to flex its muscles within the framework of the existing rules. “I see no reason why, in a situation where the CMA is being denied the more far-reaching powers that it feels it needs in order to curb what it sees as the anti-competitive power of big tech firms, it would rein in its current interventionist approach where it has such broad discretion."

The UK government has announced its intention to introduce new regulations for artificial intelligence (AI) to plug ‘confusing’ gaps and inconsistencies in current regulatory approaches.

Industry experts, academics, and civil society organisations are invited to take part in a 10-week call for evidence that begins today and runs up until 26 September. The input will help shape the government’s actions in putting its plans into place.

Announcing the news this morning, the Department for Culture, Media and Sport (DCMS) said that it wants the regulations to differ from the EU’s centralised approach.

It plans to introduce a set of rules that can be interpreted and enforced by numerous regulators such as the Information Commissioner’s Office (ICO), Ofcom, and the Competition and Markets Authority (CMA).

The government believes that by pursuing this decentralised model, each regulator will be able to take a “tailored approach” and apply the regulations more effectively in a range of different contexts.

While the final regulations have yet to be codified, the DCMS said the initial approach will require AI developers to adhere to six key principles:

• Ensure that AI is used safely
• Ensure that AI is technically secure and functions as designed
• Make sure that AI is appropriately transparent and explainable
• Consider fairness
• Identify a legal person to be responsible for AI
• Clarify routes to redress or contestability

The principles summarise the approach that was published in full this morning in the government’s latest AI paper.

According to the government’s research, organisations report a lack of clarity in the current regulations which is a particular issue for small businesses that may not have access to the legal support required to interpret them accurately.

The new regulations will also aim to tackle the perceived inconsistencies with enforcement. Different regulators are currently seen as having varying levels of power to regulate AI within their respective remits, which means AI products could subsequently reach the market with different levels of oversight depending on the target market.

The government also acknowledges that current legislation has not been developed with consideration to AI. This means the associated risks with the technology aren’t properly addressed and developers may not be able to innovate in the most optimal regulatory conditions.

The new rules will aim to foster innovation in the AI sector, ensuring the UK continues to grow and compete as a global innovator in the space, while also addressing the widespread issues with the technology such as reliability and unfair biases.

Regulators will be encouraged to consider “lighter touch options” such as offering guidance or creating trial environments so products can be tested before reaching the market.

The DCMS said the UK leads Europe and currently sits third in the world for private AI investment. Domestic companies attracted £3.88 billion in investment last year, it said.

“We want to make sure the UK has the right rules to empower businesses and protect people as AI and the use of data keeps changing the ways we live and work,” said Damian Collins, digital minister.

“It is vital that our rules offer clarity to businesses, confidence to investors and boost public trust. Our flexible approach will help us shape the future of AI and cement our global position as a science and tech superpower.”

Data Reform Bill tie-in

The Data Reform Bill, recently renamed to the Data Protection and Digital Information Bill, is closely linked to the proposed overhaul of the UK’s AI regulations.

The bill is currently going through parliament and aims to offer greater flexibility to the way businesses can use data. The rules will dilute those introduced by the GDPR and domestically by the Data Protection Act 2018 but falls short of abolishing it entirely.

Announcing the Bill last month, the government said it would bring around £1 billion in savings for businesses while eliminating the ‘unnecessary’ red tape and box-ticking exercises that the GDPR’s rules enforce.

Although the new Bill aims to water down the data protections afforded by the GDPR, the government insists it will continue to preserve the privacy of individuals but do so in a way that allows businesses to use personal data more easily for things like scientific research.

National AI Strategy

The new approach to regulating AI is the latest step in the government's National AI Strategy. Initially announced last year, the ten-year strategy aims to keep the UK in its leading position as a global AI innovator.

Effective governance of the technology formed one of the key pillars of the strategy, along with ensuring the technology benefits all areas of the economy.

As part of the strategy, the government also plans to build a National AI Research and Innovation Programme that will provide a platform for collaboration among all the country's leading AI experts and researchers, to boost public sector adoption of AI.

Separate programmes are also being proposed to accelerate the development of AI outside of London and the South East of England.

The Competition and Markets Authority (CMA) has intervened in Microsoft's planned acquisition of Activision Blizzard, citing concerns that the merger could impact competition within UK markets.

Microsoft first announced its intention to acquire Activision Blizzard in January, and, in April, Activision Blizzard’s shareholders approved the deal in a near-unanimous vote. The US Federal Trade Commission (FTC) previously announced it would also assess the deal, and determine whether it constitutes a monopolisation of the gaming industry or would limit competition in the tech sector.

According to the CMA announcement, a phase-one decision is expected by September 1.

The outcome of the inquiry is likely to shape Microsoft’s business strategy going forward. Although much has been made of the impact that the merger will have on the particular market, as it would make Microsoft the third largest gaming company in the world, it can also be understood as a symbolic of the company’s expansion strategy for the next decade.

At $68.7 billion, the merger will be the third largest of the 2020s so far, and Microsoft’s largest to date. It continues amidst widespread coverage of workplace misconduct at Activision Blizzard, alleged to date back some years.

Increasingly, Microsoft has used acquisitions to fuel its expansion efforts, with the most significant examples not coming from the gaming space. Of course, there was much publicity in 2014 around its $2.5 billion acquisition of Mojang, the creators of best-selling game ever Minecraft.

The significance of the company’s $19.7 billion acquisition of Nuance Communications, and the myriad other cybersecurity and cloud infrastructure companies it has purchased in the past five years alone lay out the case for Microsoft’s growing use of its vast wealth to obtain firms in sectors it operates in, or otherwise seeks to.

Any software development firm operating in a field in which Microsoft has expressed interest, be that gaming, quantum computing, or cloud system development, should seriously consider the likelihood that they could be acquired by Microsoft.

In an interview with Axios, CEO of Microsoft Gaming Phil Spencer identified it as critical to Microsoft’s next big goal, the casual gaming market: “The board of Microsoft, on the day that we got approval for ZeniMax, asked, ‘What was next?’ And the constant conversation had always been about mobile and casual.”

The mood of the Microsoft board as relayed by Spencer could be the key element of this quote, with the ‘what’s next’ attitude highlighting real enthusiasm for more such mergers and acquisitions in Microsoft’s immediate future.

The CMA and FTC decisions will make or break this strategy, setting a precedent going forward. Microsoft will either be gifted the opportunity to aggressively expand into other corners of the tech and research sector, or be sent back to the drawing board as their diverse and frequent acquisition strategy is deemed a step too far.

In the past year, the CMA announced an investigation into Nvidia’s planned $40 billion takeover of Arm on competition grounds, given the capacity of an Nvidia-controlled Arm to do damage to the competitiveness of Nvidia’s rivals. The planned merger fell through in early February, with unwanted publicity around the deal greatly exacerbated by the CMA investigation.

IT Pro approached Microsoft and Activision Blizzard for comment.

The UK Government has decided not to introduce regulations for cyber security standards after concluding its ‘Embedding Standards and Pathways Across the Cyber Profession by 2025’ consultation.

Conducted by the Department for Digital, Culture, Media and Sport (DCMS), the consultation ran in partnership with the UK Cyber Security Council, lasting for eight weeks from 19th January 2022.

The investigation engaged with key stakeholders across industry, academia, and the wider UK business and public sector to ascertain how it could support the uptake of the council’s standards.

That included exploring whether there was a requirement for regulation to be introduced to support the Council as it introduces new chartered standards for the industry. It also aimed to determine whether a register for chartered practitioners should be created, be it voluntary or mandatory.

It concluded that no regulation will be introduced at this point, stating that respondents generally opposed the idea of intervention. However, the Government said it will “continue to do all it can to provide support to the Council” and will “engage closely with regulators and industry to secure similar support.”

“I welcome the government’s response to the consultation, and I would like once again to thank all of those who contributed their views,” commented Simon Hepburn, CEO of the UK Cyber Security Council.

“The response allows the Council to take the lead in working with key stakeholders to achieve the aim, set out in the National Cyber Strategy, of creating a world-class, diverse cyber security profession.”

Hepburn noted that the consultation was key in identifying the key challenges faced by stakeholders, enabling the Council to create solutions to help address those issues.

Between now and 2025, the Cyber Security Council will introduce chartered standards that have been designed to align with 16 cyber security specialisms. The Government will then track its adoption and continue to assess whether regulatory intervention is required to support uptake.

As part of these plans, the Council will create a voluntary register that lists individuals accredited as either associate, principal, and chartered level.

“Observations were rightly raised about the complex nature of career routes into cyber security; the myriad of cyber qualifications, certifications and degree standards which exist without any uniform equivalency; and the challenges this creates for employers when it comes to assessing candidate suitability,” Hepburn continued.

“By introducing universal chartered professional standards aligned to 16 recognised cyber security specialisms and working with awarding bodies to align these to existing qualifications, we are confident we can create the clear framework needed to ensure the UK cultivates a world-leading cyber sector.”

By creating this voluntary register, he added that the Council will “help build further recognition, confidence and clarity across the industry” for both employers and employees.

“With the government’s response to the consultation confirming a staged approach is preferred, through which the sector has the opportunity to collaborate in the development of a diverse, accessible and ethical profession, it’s now time for us all to work together to create an environment in which cyber expertise across the UK can really flourish,” he said.

An Australian committee report has outlined that public servants should retain records about government decisions, including messages sent via encrypted messaging or social media apps.

The report was published by the Parliamentary Joint Committee on Public Accounts and Audit this month. Although there are calls to strengthen existing legislation, the report didn’t support any changes or recommendations to the way the government keeps records of its communications.

David Fricker, the National Archives of Australia (NAA) director-general, explained in the inquiry that the Archive Act defines a “Commonwealth record” as being “a record that is the property of the Commonwealth.” He noted, however, that WhatsApp and Facebook are not the property of the Commonwealth. Fricker underlined that the increasing use of third party non-government, non-Australian platforms for the conduct of official business is a pressing issue for the NAA.

“I would like to see our legislation modernised, first and foremost, to embrace a more 21st-century definition of a Commonwealth record, one that incorporates a message sent on WhatsApp, for example,” he said at the inquiry in April last year.

NAA guidance explains that public servants should keep a record of what they’ve done. If encrypted messages are sent through WhatsApp, Signal, or Telegram, then the responsibility is on the user to make sure a copy is saved without encryption and put into the Commonwealth record-keeping system.

However, Fricker underlined that no transfers of social media records from Commonwealth government agencies or ministerial offices have been received by the NAA yet. He added that initial planning discussions are underway with some agencies over this topic.

The director general was asked if there were any penalties in place for entities, public servants, or ministers who failed to supply encrypted messages and keep a record as required. Fricker said that under the Archives Act, the only breach is to engage in conduct that leads to the deterioration, loss, or alteration of a Commonwealth record. If the record is never made in the first place then there isn’t any penalty available through the Archives Act.

Fricker confirmed that advice has been sought on the definition of the Commonwealth record, as in the act the powers in his office are limited to records that are the property of the Commonwealth. NAA has provided advice to the Attorney-General’s department on this matter and is in active discussion to bring the law into the 21st century, he added.

The committee has failed to acknowledge in its findings the evidence received that the Archives has received few or no records of social media or encrypted messages from public servants or ministers, said Julian Hill, Labour minister and deputy chair of the committee.

“Dancing around this evidence and failing to make a finding doesn’t change the fact this is a Government addicted to secrecy, and that the definition of Commonwealth record requires updating to ensure government records made or transmitted via modern forms of communication are captured,” added Hill.

Hill said the committee could have gone further by providing recommendations to the government like providing a more modern definition of “Commonwealth Record” and addressing gaps in rules and policy guidance to make sure encrypted messages and social media that relate to government decision making are retained.

How does this compare to the UK?

Overall, the UK government has supported the use of encryption but has attempted to implement measures that would allow it to bypass barriers to accessing secured data if it needed to. The government has said that end-to-end encryption inhibits law enforcement’s ability to gather data that could lead to the protection of vulnerable individuals.

In April 2021, Priti Patel said that Facebook’s plan to implement end-to-end encryption is likely to jeopardise the progress in fighting online child abuse. The same fears were raised, that the technology could hinder law enforcement efforts to track down and arrest child abusers.

Despite the Australian parliament calling for more transparency when it comes to ministers’ communications, the country also passed a controversial surveillance bill last year. It granted the authorities extensive new powers, more than any of its allies like the UK or US has, which is said to take surveillance of citizens to the next level. Citizens are said to have their communications listened to, data on their computers altered, copied, added, or deleted, and their social media accounts closed and their identities impersonated.

Microsoft has announced a sweeping rebrand of its data governance and compliance products, pulling together data services from Azure Purview and Microsoft 365, to create a unified suite, 'Microsoft Purview'.

Purview will take the names of several Microsoft and 365 products and simply give them a unified identity. For example, 'Microsoft Compliance Manager' is now 'Microsoft Purview Compliance Manager' and 'Office 365 Data Connectors' becomes 'Microsoft Purview Data Connectors'.

The aim is to offer a simplified suite of services that help customers see their assets across an entire data estate, with safeguarding and management tools for cloud endpoints and apps, so that they can manage risks and regulatory compliance as smooth as possible.

Microsoft's thinking is around hybrid work environments which have created gaps and grey areas in data policies and security. Purview addresses those concerns, according to Microsoft, by patching together various tools that protect data for businesses and remote employees.

"Enabling an effective Zero Trust approach requires the ability to govern, protect, and understand data coming from an ever-widening array of endpoints," Microsoft said in a blog post.

Purview will also come with new services and integrations, such as the Data Loss Prevention service for macOS devices, which is now generally available. This adds protection to sensitive files on macOS Catalina (or higher) machines. There is also a 'coauthor' feature for Microsoft 365 applications that use encrypted documents on Android and iOS mobile devices. This also applies to Microsoft 365 apps like Excel, Outlook and Word, as well as Exchange and Teams.

What's more, next month the tech giant will also preview a 'multi-stage' data retention setting within Microsoft Purview Data Lifecycle Management. This will allow labels to be applied to data at the end of a retention period, invoking new retention or deletion setting.

Nvidia and SoftBank have agreed to terminate an agreement for the US company to acquire UK chipmaker Arm due to "significant regulatory challenges".

Instead, SoftBank will look to float Arm on the stock market by 2023, the Japanese firm said in a statement.

Since it was announced in 2020, Nvidia's takeover of Arm has been met with scepticism from various parties within the semiconductor industry. and has also been the subject of regulatory investigations from a number of governing bodies around the world.

The UK's Competition and Market's Authority (CMA) said the deal warranted an "in-depth" investigation because it could potentially give Nvidia the power to restrict access to Arm's intellectual property. Similar concerns were cited by regulators in the US and EU, but with the deal now cancelled, the CMA has stated that it is no longer interested in pursuing an investigation.

Finding a way to appease regulators and also justify the $40 billion price tag has proven "overwhelmingly challenging", according to CCS Insight analyst, Geoff Blaber. He said the deal was also disruptive to Arm and its lucrative ecosystem; its licensees collectively shipped an average of 22 billion chips annually over the previous three years.

"As predicted, opposition was considerable and shone a light on the strategic importance of Arm's technology and the vital need for Arm to remain independent," Blaber told IT Pro.

"The $40 billion price tag was such a sizeable premium that it left Softbank with no plan B. An IPO is the best route forward for the Arm ecosystem and will be applauded across the industry but it's certainly not a positive outcome for Softbank."

Arm to go public

The collapse of the acquisition appears to have resulted in executive changes for Arm, with CEO Simon Segars stepping down, effective immediately, according to a company statement. Industry veteran Rene Haas will now step into the role to lead the company through its IPO, while Segars takes up a position on the board of directors.

"Rene is the right leader to accelerate Arm's growth as the company starts making preparations to re-enter the public markets," said Masayoshi Son, the CEO of SoftBank. "I would like to thank Simon for his leadership, contributions and dedication to Arm over the past 30 years."

The company has previously gone to market, making its initial debut in 1998, but it was brought by investment group SoftBank in 2016. It's thought that SoftBank agreed to the sale of Arm so that it could shore up its finances after sling money on other investments, such as the shared office space firm WeWork and even Uber.

The European General Court has annulled the European Commission's (EC) decision to fine Intel €1.06 billion in 2009, issued after the chip company had implemented a strategy to exclude its competitors from the market.

At the time, the commission ruled that Intel had abused its dominant position in the worldwide market for x86 processors between October 2002 and December 2007. The strategy involved the company giving rebates to computer makers Dell, HP, NEC, and Lenovo for buying most of their chips from Intel, in an attempt to block its rival AMD.

However, the General Court, Europe’s second-highest, ruled on Wednesday that the analysis carried out by the EC was incomplete and failed to establish the requisite legal standard that the rebates were capable of having, or were likely to have, anticompetitive effects. The court has now dismissed the fine against Intel.

“We welcome today’s ruling by the General Court as we have always believed that our actions regarding rebates were lawful and did not harm competition,” said Intel general counsel Steve Rodgers. “The semiconductor industry has never been more competitive than it is today and we look forward to continuing to invest and grow in Europe.”

The General Court upheld the EC’s 2009 decision in 2014 but was told by the European Court of Justice in 2017 to re-examine Intel’s appeal.

The EC is able to appeal before the Court of Justice against the General Court’s decision within two months and ten days of notification of this decision. The EC told IT Pro it has taken note of the judgement and will now carefully study it and reflect on possible next steps.

The decision could boost the confidence of other tech firms who are currently appealing antitrust fines in Europe, including Google, which has appealed to overturn a €4.34 billion fine given to it by the EC in 2018. It was the largest antitrust fine handed out by the regulator, with the EC claiming that the tech giant is abusing its power by forcing smartphone manufacturers to adopt Android and its associated apps.

UK financial regulators are reportedly concerned about the sector's reliance on a subset of cloud computing providers that leaves banks vulnerable to service outages and hacks.

The Prudential Regulation Authority (PRA) is said to be exploring ways to access more data from the likes of Amazon, Microsoft and Google, according to the Financial Times.

Amazon Web Services (AWS), Microsoft Azure and Google Cloud are often listed as the three biggest providers in the world, with each company increasingly active in the financial sector.

All three have made extensive deals with UK banks in recent years, offering services to reduce IT costs by migrating firms away from on-premise to the cloud, where they can capitalise on new technologies such as AI.

The use of cloud computing by UK banks is covered under the PRA's operational resilience framework, however, the use of just a few larger companies is causing concern, particularly given recent outages.

While the PRA declined to confirm the FT's report, a source with knowledge of the situation told IT Pro financial regulators in the UK are now looking at ways to tackle the financial system's increasing cloud service providers, which could see the introduction of additional policy measures, some requiring legislative change.

The PRA is a part of the Bank of England (BoE), which has also expressed concern in this area; in July 2021, the BoE warned that UK banks moving more and more of their administration and account online "could pose a risk to financial stability". It also argued that the market for cloud services was highly concentrated with AWS, Microsoft and Google all enjoying heavy dominance.

Sections of the UK’s government have also questioned how much it depends on the likes of AWS. In February 2021, Conservative life peer Lord Holmes said that AWS represented “the latest iteration of the biggest player”, adding that in regards to cloud procurement, it was being allowed to “eat the largest piece of pie”.

Almost nine in ten Americans believe that a ransomware attack should be treated as an act of terrorism, according to a new poll.

The Mitre-Harris Poll survey, which collected responses from 2,037 US adults in October, found that 77% of people were concerned about ransomware, with 86% of people viewing infections at the same level as terrorist attacks.

The poll also found strong objections to paying the criminals behind ransomware attacks; almost four in five people said that the law should forbid private companies from paying ransoms to hackers.

While the FBI disapproves of ransomware payments and the US Treasury has warned about potential sanction violations, there are no US laws forbidding payments yet.

The survey followed a series of increasingly high-profile ransomware attacks that affected US critical national infrastructure, including those on Colonial Pipeline, JBS Meats, and Iowa's New Cooperative farming group.

The US government is already ahead of the respondents; in June, the Department of Justice elevated ransomware attacks to a similar status as terrorism, and also created a centralized team to coordinate and share information on ransomware investigations. Senators have also proposed legislation that would target foreign nations that support ransomware actors.

The Mitre-Harris Poll survey also found broad unrest about the international race to build better technology, with 55% of respondents advocating for more technology R&D investment to stay ahead of China. 5G and telecommunications technology was a particular area of concern, with two thirds worried about the US using technology developed in China.

In October, the FCC prevented China Telecom from offering telecommunications services in the US amid security concerns.

Artificial intelligence (AI) was another worry, with three quarters of respondents expressing concern that the technology could be used maliciously. The FTC has previously warned companies to use AI responsibly, threatening interference if they fail to do so.

Mitre, which operates the Common Vulnerabilities and Exposures (CVE) database on behalf of the US government, has proposed a Horizon Strategy Framework for science and technology innovation.

Microsoft's $19.7 billion acquisition of speech-to-text specialist Nuance is to be scrutinised by the UK's Competition and Markets Authority (CMA).

The antitrust regulator said on Monday that it will take an initial look into the deal to assess whether a full investigation is needed.

A consultation period is now open, with the CMA inviting interested parties to comment on the matter. The consultation runs until 10 January 2022 and will likely lead to a delay in the transaction or, potentially, a complete cancellation.

The CMA will consider whether the proposed transaction will affect the wider market and, if so, whether it will substantially lessen competition within the UK. The regulator will look to invoke the Enterprise Act 2002 if they deem it worthy of investigation.

Nuance is a US firm based just outside of Boston so any investigation by the UK's CMA will be on the grounds of public interest.

Crucially, the UK government is able to intervene on special public interest grounds in any transaction that meets all the requirements for a "relevant merger situation".

According to UK law, there are two situations where this arises: if two or more enterprises cease to be distinct, or will cease to be distinct, as a result of being brought under common ownership or control.

A deal for Nuance was announced in April and the cost of the transaction is potentially Microsoft's biggest since it brought LinkedIn. The company is a specialist in artificial intelligence, particularly with audio recognition and transcription tools.

At the time, it was suggested that Microsoft would use the deal as a way of expanding into the markets Nuance has a presence in, such as healthcare.

The healthcare market has been a prime investment area for the tech giants over the last few years, with the likes of Apple, Amazon, Google and even Facebook all showing interest in building tools to support health.

Companies could be fined up to £10 million or 4% of their global turnover if they sell digital products that fail to protect consumers from being hacked.

Manufacturers, importers, and distributors of digital tech will be required to make sure the devices meet new security standards under a new law proposed by the UK government - with heavy fines for those who fail to comply.

The Product Security and Telecommunications Infrastructure (PSTI) Bill, introduced to Parliament on Wednesday, will allow the government to ban universal default passwords, force firms to be transparent to customers about what they are doing to fix security flaws in connectable products, and create a better public reporting system for vulnerabilities found in those products.

At present, digital device manufacturers must comply with rules to stop them from causing people physical harm from issues such as overheating, sharp components, or electric shock. But there is no regulation to protect consumers from harm caused by cyber breaches, which can include fraud and theft of personal data.

The bill will give the government new powers to bring in tougher security standards for device makers.

The tougher standards include a ban on easy-to-guess default passports that come preloaded on devices - such as ‘password’ or ‘admin’ - which are a target for hackers. All passwords that come with new devices will need to be unique and immune to resets from universal factory settings.

The new law will also require connectable product manufacturers to tell customers at the point of sale, and keep them updated, about the minimum amount of time a product will receive vital security updates and patches. If a product does not come with security updates, that must be disclosed to the customer.

This will increase people’s awareness about when the products they buy could become vulnerable so they can make better-informed purchasing decisions, according to the government. It's believed nearly 80% of the firms targeted by the bill do not have any such system in place, the government said.

There will also be new rules that require manufacturers to provide a public point of contact to make it simpler for security researchers and others to report when they discover flaws and bugs in products.

This new cyber security regime will be overseen by a regulator, which will be designated once the bill comes into force, and will have the power to fine companies for non-compliance up to £10 million or 4% of their global turnover, as well as up to £20,000 a day in the case of an ongoing contravention.

The regulator will also be able to issue notices to companies requiring that they comply with the security requirements, recall their products, or stop selling or supplying them altogether. As new threats emerge or standards develop, ministers will have the power to mandate further security requirements for companies to follow via secondary legislation.

NCSC technical director Dr. Ian Levy said the bill would “ensure the security of connected consumer devices and hold device manufacturers to account for upholding basic cyber security”.

“The requirements this bill introduces – which were developed jointly by DCMS and the NCSC with industry consultation – mark the start of the journey to ensure that connected devices on the market meet a security standard that’s recognised as good practice,” he added.

The Australian Federal Police (AFP) has suggested it may introduce a "more aggressive" cyber division, after legislation was passed in September granting extensive new surveillance powers to law enforcement agencies in the country.

During a Senate estimates hearing held on Monday, in which senators typically scrutinise how the government is spending taxpayer money, AFP commissioner Reece Kershaw said that the introduction of Surveillance Legislation Amendment (Identify and Disrupt) Act 2021 means it can now proactively target suspected criminals with disruptive operations.

Kershaw highlighted that the three new powers in the Act will significantly enhance how the AFP investigates serious cyber-enabled crime. The new powers allow police to disrupt data by modifying, copying, adding, or deleting it and allow the AFP and Australian Criminal Intelligence Commission (ACIC) to collect intelligence from devices and networks. Lastly, the powers allow the agencies to take control of an online account to gather information for an investigation.

The commissioner said that the police’s investigators are already planning how they might use the new powers in active investigations to identify, target, and disrupt offenders, including those relating to terrorism, drug importations, and distribution of child abuse material.

"At the moment, we're actually going through an internal review of how we can be more aggressive in cyber, and it may mean a mini restructure internally for us to really have what we would call a cyber offensive operation of the AFP, which would actually conduct disruption operations on these individuals," said Kershaw, according to ZDNet.

The commissioner said this includes talking with the Five Eyes alliance about the growth of cyber threats, with Kershaw currently being the chair of the organisation’s law enforcement group.

Encrypted communications platforms are a significant barrier for the AFP, said Kershaw, outlining that transnational serious organised crime offenders rely on encrypted platforms to carry out their criminality.

“This is the next frontier of crime, and the AFP and our partners will work with governments and global law enforcement networks to ensure the long arm of the AFP reaches criminals no matter where they are in the world,” he added.

The AFP's plan for a new cyber offensive arm will have a dangerous effect on people's rights and freedoms in Australia and de-stabilise the open, secure internet we all rely on, said Namrata Maheshwari, Asia Pacific policy counsel, and lead on encryption policy at Access Now.

"This is extremely damaging for privacy and free expression, and undermines digital security for all. The new arm is being built on a flawed foundation: the Identify and Disrupt Bill, which violates human rights; and discussions with the Five Eyes surveillance alliance, which has often called for backdoors to encryption, a measure that would render private and secure communication impossible," she said. "We need rights-respecting frameworks to strengthen cybersecurity, and enhanced surveillance and new 'disruption' tools by law enforcement, as is being contemplated, will have the opposite effect."

Kershaw explained that Operation Ironside was enabled by unique, global law enforcement partnerships, particularly with the FBI, as the AFP provided the agency with the technical ability to decrypt and read encrypted communications in real time.

The operation saw the AFP work for almost three years, leading to the arrest of hundreds of suspected criminals that were tricked into using an encrypted messaging app. The app, codenamed “Anom”, was installed on mobile phones stripped of other capabilities that were bought on the black market. They were only able to send messages to another device that had the app installed, and criminals had to know other criminals to acquire a device.

This automatically-generated transcript is taken from the IT Pro Podcast episode ‘How umbrella companies exploit IT contractors’. To listen to the full episode, click here. We apologise for any errors.

Adam Shepherd

Hi, I'm Adam Shepherd.

Jane McCallion

And I'm Jane McCallion.

Adam

And you're listening to the IT Pro Podcast. It seems that Summer is officially over, so fittingly, we’re talking this week about umbrellas - or more specifically, umbrella companies.

Jane

Now, rather than manufacturing rain deflection devices, umbrella companies act as an intermediary between contractors and their clients. They're commonly used within the IT industry. And if you've been in the game for a while, chances are you've probably interacted with one in some capacity.

Adam

However, concerns have been raised about the conduct and ethics of umbrella companies. Together with Rebecca Seeley Harris, chair of the Employment Status Forum. InniAccounts CEO James Poyser has been campaigning for government action, accusing umbrella companies of dodging taxes, scamming workers and skirting their rights.

Jane

He joins us this week to discuss why this has become such a critical issue and how both government and the private sector can address it. James, it's pleasure to have you back with us.

James Poyser

Indeed, yeah, absolutely. And a lot's happened since we last spoke!

Jane

Just a bit.

Adam

So James, for those who might not be familiar, what is an umbrella company? And why have they become so relevant now?

James

So the easiest way to think about an umbrella company, it's like an outsourced payroll provider. So if you're an IT contractor, you get a temporary contract, the client is going to hand over some money that's, that's gross, that hasn't been taxed. And somebody along the way needs to deduct the taxes, pay a pay slip, pay the money over to HMRC. And if the end client doesn't want to do this themselves, then they can use an umbrella company. And that's essentially what an umbrella does, takes this untaxed income, and passes it on to HMRC, and passes net pay to the contractor. It's slightly different, though, to just being purely an outsourced payroll provider, because when you use an umbrella company, they become your employer. So if you think if you're an end client, this is great because they don't have to deal with any of the complexities of employment law, unemployment issues like discrimination, maternity, pesky redundancy pay, and all of those things. They can hand it off entirely to an umbrella company who take care of all of that for them. And to your question about why is it so relevant right now? Well, if you think about the IR35 change, which I'm sure many of your listeners are aware of, where with IR35, your end client has to determine whether you are an employee who needs to be taxed like an employee, or whether you're actually self employed, and you can take responsibility for your own tax. So you would appoint an accountant and work together to pay the right amount of tax. Now, the challenge with IR35 is that end clients have got to assess each individual contractor to figure out whether an employee or whether they're self employed. And if you're a large bank with thousands of contractors, it's a really big task. So a lot of the end clients are taking the easy option, which is saying, you know what, we're not going to bother doing these assessments, all we're going to do is mandate that everybody uses an umbrella company, so everybody becomes employees for tax purposes. And better still, you know, a bonus for the clients. They don't have to deal with those employment issues. And that's why there's been such a huge influx of umbrella users over the last year or so. And one of the challenges is the umbrella market is unregulated. And even the head of a professional body who represents umbrella companies has described it as the Wild West, it's full of opportunists. And contractors for many umbrellas are seen as a commodity that needs to be exploited. And that's the challenges that we're facing at the moment.

Jane

So, I mean, this sounds like it could be quite convenient, especially for the end client and for the umbrella company itself, but to an extent for contractors as well, but you've alleged that some umbrella companies are being used to facilitate unethical business practices. What kind of infractions have you seen in the space?

James

Sure, well, I mean, that there's really, there's the quite egregious stuff that I'm sure a lot of people have heard of. So something that's quite famous is something called the loan charge. So that's one extreme where umbrella companies were paying contractors via loans, and these loans didn't attract income tax and National Insurance. And they sold these schemes to the contractor saying, you know, this is QC approved, or it's HMRC approved; use our umbrella company, and we can help you to maximise, maximise your take home pay, and kind of so so some people went into that with their eyes open, many of the workers were forced into it, their recruitment agents, made them use a particular umbrella company that was using these types of loan schemes because the agent was getting great kickbacks by pushing business in their way. And so that's the kind of the one extreme. HMRC have clamped down on this. The challenge with this so HMRC have gone after contractors who have used these schemes and making them pay back taxes that they've missed plus really, really big penalties on top of that, which have led, i'm sure again, your listeners will know, to a number of suicides on the back of that because this is life changing amounts of money that have been demanded. And one of the challenges there is that the scheme operators themselves, the people who set up these elaborate loan schemes, have never been prosecuted, and they are very rich from the back of selling these schemes. So that's kind of one extreme, and they're still out there in the market. And you know, for each one that springs up HMRC is trying pretty hard to close them down as quickly as they can. So that's, that's the big stuff a lot of people would have heard of, but there's a big problem, which is the things that are lawful, but deeply unethical. So it's things like giving back holiday pay, so you know, an umbrella company who holds back some of your income for holiday pay. And if you don't take that holiday, then they pocket the money. There's things like skimming from payslips. So we know of a few umbrella companies and these are large umbrella companies, these aren't, these aren't tinpot organisations, these are large umbrella companies where their pay slips don't add up. And each week you're out of pocket by, you know, five to 20 pounds a week. When you multiply that through 10,000 contractors with that umbrella company, it's a lot of money. Some of the umbrella companies will sell bogus products without you knowing, such as one umbrella company sells a very poor imitation of income protection insurance. But they've structured it in such a way that they don't have to be FCA, FCA regulated to sell it and they just add it onto your pay slip without you knowing. Overcharging National Insurance. So making you pay more National Insurance than is due but then paying the correct amount to HMRC and keeping the bit in the middle. Overcharging the apprenticeship levy, right down to things like forcing people to opt out of regulations that are designed to protect them and making that a condition of employment. So you know, these schemes are absolutely rife. And these are all, you know, it's just the sum of these little skims and scams, that make umbrellas so profitable. It's got so bad. So last week, the TUC called for an outright ban on umbrella companies. And they turned around and said, these scandalous workplace practices have no place in modern Britain. So it is a really big problem.

Jane

Do you know what, it' s funny, especially listening to the first part of the problem with the loans.

James

Yeah.

Jane

It really reminds me of the sub-postmasters and Horizon, which has only recently been resolved, that it was the subpostmasters who were, you know, fined and put in jail, rather than the company that developed Horizon, or indeed the Post Office itself, not that we want to put the whole Post Office in jail. But it's, it sounds very similar to that kind of thing. And the impact that it's having on people's lives sounds very similar.

James

Indeed, yeah, it's one thing to talk about, you know, I suspect if you're, if you're, you know, working in IT, and you're earning £500 a day, you probably won't attract much sympathy from the Daily Mail, if you got caught out with one of these, one of these schemes. But let's say that you are, you know, a minimum wage worker, you're a bank nurse or care worker who has been pushed into one of these schemes without knowing it, and then you're on the hook for back taxes, and a large penalty as well. That's when it's, you know, it's really, it's quite, quite troublesome.

Adam

So, as you've mentioned, this affects a wide variety of different kind of job roles and industries. But why is it such an important issue for IT professionals in particular?

James

Okay, so it's a good question. In our experience of working with, with IT professionals who are contracting and consulting, there's kind of there's a couple of camps, you're either, you know, you're a high earner, you know, so you might be, you know, think about the kind of the in demand roles, that moment, things like, you know, cybersecurity, cloud architects, that people where it's, you know, it's, it's, it's rocking horse teeth, trying to find people to do those roles at the moment. So they're commanding, you know, good, good daily rates. And from an umbrella point of view, you're very rich pickings, because let's take somebody who was earning £500 a day, you would probably pay an umbrella company about £900 a year, in fees, so that that's your cost that you would pay over. But from you, an umbrella company, we did our calculations, and they can lift about £3,200 a year on top of that, without you knowing, and that's money from you, from HMRC. So, you know, when you talk about those big numbers, there's a big opportunity there. And if you do fall in that category, so if you are in one of these, you know, a fortunate position where you're a high earner, and you've got in demand skills, my advice to you would be to work really, really hard to push to get yourself outside IR35. So you don't have to go near an umbrella company at all and you can take responsibility for your income and paying the right amount of tax and making sure that nobody has got their fingers in the till on the way. So that's the, that's the first cohort of IT workers. The second one are if we look at people who are in roles where there's a lot of supply, so let's think about something like first line IT support where there's a lot of people out there and a lot of the work there is temporary. It's contract-based. A lot of people who are willing to fill those roles. And the challenge with that, because there's a lot of supply, those kind of workers are ripe to be exploited. And that's where things like recruitment agents say, you have to use an umbrella company, and you have to use this specific one, so you don't even get a choice about the umbrella company that you use. My advice, if you're in that position, push really hard, because if you are, if you're a lower paid worker, push really hard to see if you can get a fixed term contract employed directly with the end client, you can still go through a recruitment agent, so that bit's absolutely fine. But you can push hard and say, Actually, I want to go on the books at the end client, and they can employ you as a temporary worker, and it means that you're in a market that's gonna be regulated when it comes to payroll, and you're gonna have more rights and protections. If they can't do that, push your recruitment agent, and ask to go on the agency payroll instead of going on to an umbrella. The thing is with this, so a lot of agents will offer payroll, but you've got to remember the commercials here. If a recruitment agent puts you on the payroll, you suddenly become a cost centre, they've got to run the payroll, they can't charge you for that; it's a cost to them. If they push you down the umbrella route, then the umbrellas will pay referral fees and kickbacks to the recruitment agent. And then you become a profit centre. So that's why a lot of recruitment agents are reluctant to support agency payroll, because they see you as a means to generate more profit.

Jane

If you find yourself in this situation, is it worth just walking away? I know everybody wants work, and nobody likes to have no income. But you know, if you're going to end up worse off for it, is it worth if they're just really pushing you to go to an umbrella company and they're just not having it any other way, should you just walk away?

James

I mean, it's a, it's a good question. It's, it depends, doesn't it? Because it depends on your personal circumstance. It depends on the skills that you've got, it depends how many roles are out there that you could, that you could, you could fill. And this is the challenge isn't it, if you don't have any options, then it's kind of, it's a red flag for being exploited. Because you know, you your power has kind of diminished if you don't have that ability to walk away. But just keep in mind some of the risks that if you do get pushed into one of these rogue schemes, that you're on the hook, you know, it's not going to be a recruitment agent, or the umbrella company who HMRC are going to be knocking on the door for - it's going to be you. So you need to go into it with your, with your eyes open.

Adam

So James, you've called, along with your colleague Rebecca Seeley Harris, for more regulation to address the issue of umbrella companies and the lack of regulation in this space. Can you tell us a little bit more about some of the recommendations that you've made?

James

Yes, yeah, absolutely. And I think a lot of people will be very surprised to learn that this market isn't regulated. It's absolutely bonkers when you consider how many people are employed by umbrella companies, we're talking hundreds of thousands of people in many different industries. And it's not regulated. So myself and Rebecca have put a paper forward to the government, which is basically a blueprint on how to get from where we are today, to get to a place where this market is regulated. And some of the recommendations that we've got are things like, you know, fixing holiday pay, so making, you know, giving absolute clarity about expectations around holiday pay, to stop that pocketing of holiday pay. Making sure that pay slips are clearer to stop those skims and scams. And, you know, use an umbrella company, your pay slip's in two parts. One is a pay slip that you would recognise as an employee. And you never see any problems there. Because there's a good amount of legislation that covers that bit. There's also a second part to your pay slip, which is called something like a reconciliation statement or whatever term they want to use. And that's completely unregulated. And they can put what they want on there. And we want to see regulation that tidies that whole thing up. So you can see that money when it comes in from your end client, right the way to when it goes into your, into your bank account, and everything that happens along the way. From a regulation point of view, there's a few different government bodies at the moment that look after the temporary workforce market. And what we called for is the setting up of a single enforcement body to look after this entire market and umbrella companies. The great news is the government has already responded to that and said, Yes, we are going to do it. So they are charging ahead and getting a single enforcement body together. So that's one government organisation that will take responsibility for this market and the regulation of it. And then underneath that, there's some things that we want to do in terms of strengthening existing regulations, bringing things in and just tightening up and tidying up this market. So it's things like stopping recruitment agents forcing workers to use an umbrella as a condition of employment, that is not okay. Making the kickbacks that go from umbrella companies to recruitment agents illegal because that really does drive a lot of these behaviours. The stopping advertising contracts at an inflated rate. And so you know, there's something that's very, it's quite bonkers. It's quite unique to IT as well. When we talk about these umbrella rates, it's that daily rates are advertised before any tax, and it wouldn't happen anywhere else. If you, if your teenage kids are going to get a job, a temporary job flipping, flipping burgers at McDonald's, it would be a gross rate of pay, you know, after all the employment taxes have been paid. But for some reason, it's kind of okay in IT to advertise these rates before things like employers National Insurance and the apprenticeship levy are taken off. So those are the kind of things we want to see stopped, and for a fair rate of pay to be advertised, and things like the loan charges. So as we said, right at the start of the podcast, at the moment, the individuals, the taxpayers themselves, the IT contractors are on the hook for loan charges. And what we want to see is to make the promoters responsible for any tax issues, not the individuals.

Adam

The thing that I keep coming back to throughout all this is the 1920s and 30s. In the US in America, this, this kind of has the air of the kind of situation that you used to get with like railroad workers, and the kind of railway robber barons, you know, the idea of being forced to work for one specific umbrella company, as a condition of employment is crazy to me.

James

Yeah. I mean, and the fact that they, you know, in many places that they exist in the first place is a little bit bonkers, because there's plenty of ways out there to pay people fairly and to make sure they're protected. And it feels like that's the kind of economy that we, that we should have, and we should be proud of is where temporary work is absolutely fine. And people, you know, both, both, both ends of the spectrum can benefit from that, be it the end client or the workers themselves. But let's just make sure it's fair, right, let's make sure that people aren't getting exploited along the way. And that's one of the challenges with this not being regulated is there's just too much opportunity for, for exploitation. And, you know, it kind of, it feels like, so there's a chap called Matthew Taylor, who wrote a report on modern Britain and, and working and the future of working in the UK. And, you know, there's this, there's this real opportunity for the UK to be really famous for things like having a really flexible, contingent, temporary workforce that allows us just to move quickly, be very agile and get things done. Yet that hasn't translated into into legislation. I feel like you know, our contractors and consultants and temporary workers, they should be celebrated. And they should be protected, because I think it gives a great, as an economy, it gives a great advantage against many other developed economies. But unfortunately, legislation isn't keeping up with this. And this is the problem we're facing today.

Jane

Yeah, and that's a good point. Plenty of people in IT, indeed, in journalism, nursing, whatever, choose to become independent contractors, because that suits them better as well. And like you say, for companies, it suits them better. So it does seem to me as well, a little bit, a little bit mad. You know, we're kind of undermining the fact that there is something that could be really good with something that feels almost like a pyramid scheme.

Adam

I mean, the irony is, for me, a lot of contractors, you know, become free agents and freelancers, specifically to get away from restrictive employment conditions and to have more freedom in who they work for, how they work, all of that kind of stuff. So for them to get kind of almost accidentally sucked into these exploitative situations seems very unfair.

James

Yes. Yeah, absolutely. And, you know, it's, I think, sometimes you can't help but feel that if you looked at it through the lens of HMRC, they would assume that every single IT contractor became a contractor with one objective in mind, which is to dodge tax. And, you know, if you spend time talking to IT, to IT contractors, it's absolutely not the case. It's things like, you know, you know this well, so, you're a technical specialist, and you realise, if you stay as a perm, you're going to have to become a manager, and that really isn't your jam. So you're going to become a contractor, you're going to become a consultant, you want to work on a variety of different products, you want more flexibility, work life balance, perhaps you've got kids who need a bit more help at home. So you can work that three day week and have a couple of days at home, and still earn the same as if you're a permanent employee. There's all these, there's many, many reasons why people move into becoming a contractor or a consultant. And let's just make sure it's fair, right? It's not okay for people to make that decision. And then for somebody in the supply chain to think it's okay to exploit them. And that's the problem that we've got today.

Adam

So, James, how can both employers and contractors spot a good umbrella, an umbrella that isn't going to take advantage of them, that isn't going to place these restrictions on them and dip their hands into their pockets?

James

Yeah, that's, I mean, it's a really good question. I mean, the good news is there are lots of umbrella companies out there so there is a lot of choice. The bad news is it's very difficult to sort the wheat from the chaff, particularly if you're standing there as an outsider, you know, I've been in this market for, you know, 15 years now. And I can tell you who some of the really good guys are. But that's just through developing personal relationships with them. And so I think it's a good starting point. So you can, you can consider some of the professional bodies, there's two professional bodies, that look after umbrella companies. The thing to bear in mind with these, though, are that the professional bodies are there to look after the umbrella companies, not you as a consultant or contractor. So it's a good starter for 10. But don't think by any stretch of imagination, because an umbrella company's got a badge, that they're always going to act in your best interests. So instead, I think it's really worthwhile reaching out and talking to umbrella companies directly and having a few conversations. And there's so much choice out there that if something smells wrong, then you can walk away, if you just get the slightest whiff of suspicion, then walk away from that umbrella company and start asking around and go to a different umbrella company. And the things that you ought to look out for are, ask them for an example payslip and see how things are broken down. Ask them about their holiday pay, and how that works. Go out there and ask them about recruitment agent referral fees, because the good umbrellas will put their hands up and say, You know what, we don't like doing it, but we do it. And this is how we approach it. And if they skirt the question altogether, then that's a big, big red flag for me. Certainly, you know, with your recruitment agent, if they're asking you, if they're recommending umbrella companies, if they're a member of a recruitment professional body, they, they're obliged to be transparent. So you can ask your recruitment agency, okay, so you're going to recommend these, these umbrella companies to me, what's in it for you. And if one of those umbrella companies is paying more in commission to that recruitment agent than you're paying them as a fee, then that's a massive red flag, because the only place that can come from is from these skims and scams that we've, that we've, that we've mentioned. And the, you know, again, I don't, I don't want to name any names in terms of who you should go for. But in my experience, the, the big guys are generally best avoided, and go out there for the smaller, independently owned companies, there's a number of firms out there, who are people who've worked in the umbrella industry for a long time, and don't really like what they've seen and thought, you know what, I'm gonna do this, do this differently, and go out there and set up my own umbrella company. A lot of smaller umbrella companies are owner managed. So pick up the phone, have a chat to them. Take a look on LinkedIn. So a lot of the umbrella companies, the smaller umbrella company owners are active on LinkedIn, and you'll very quickly be able to figure out what's going on. Are they giving out good solid advice? Or are they just delivering a constant sales pitch? And you'll soon figure out who the good guys are and and who's worth avoiding.

Adam

Am I right in thinking that Off-Payroll includes a section for kind of comparison of umbrella companies, for contractors to share their experiences?

James

So the moment Off-Payroll has got a section on umbrellas, but we're specifically on there talking about how they worked through Coronavirus and the the job retention scheme. However, in the second half of this year, we are about to launch a new feature, a new section. And for each umbrella company, we're coming up with a checklist of about 30 items that covers a lot of the things that were discussed in this podcast. So yeah, stay tuned, we're a couple months away from getting that over line. It's an IT project, after all! So we're running a little bit, a little bit behind. But hopefully yes, that will help to bring a bit more transparency to the market and help people to find the good umbrella companies.

Jane

So obviously, you know, most of the client companies want to behave and act ethically as well. What can they do to make sure that any umbrella company they are using or working with is behaving in an ethical way as well?

James

Yeah, I mean, it's a great question. I think it varies from organisation to organisation, so many organisations know what's going on in their supply chain. And for many others, an umbrella company is very, very far down supply chain, they just don't have a visibility of it, because it might go through two or three different recruitment agents, and then to the umbrella and then to the end worker. And so many organisations in our experience don't actually have that much visibility because they don't have day to day contact with umbrella companies. But they need to think quite carefully about that, for two reasons. One's very tangible and one's a bit more intangible. Let's talk about something very tangible, which is something called the Criminal Finances Act. So if you're an end client, and somebody in your supply chain is carrying out tax evasion, you're on the hook for it. So as an end client, you are criminally liable if you do not prevent an umbrella company from carrying out tax evasion. So to put your hands up and say I knew nothing about it guv doesn't wash so end clients have actually got to think very carefully about what's going on and who they've got in their labour supply chain. And the second part is more about the, the kind of, the Corporate Social Responsibility risk. So is this really a market that you want to be part of when you're seeing workers exploited, the skims, the scams, the commissions that have been paid to recruitment agents. Some of the umbrella companies out there have links to organised crime...

Adam

Really?

James

Yeah, did I not mention that?

Jane

When you were talking about, when you, Adam, raised, you know, kind of like a flashback to 100 years ago, I was thinking, wow, this sounds like a protection racket as well.

Adam

Yeah, it really does!

James

Yeah, yeah, there is, there is that yeah, that goes off, particularly in offshore tax jurisdictions. There's, there's quite a big operation going on, at the moment, in the Isle of Man, where umbrella companies are implicated in that. And it's kind of organised crime, you know, it's not, it's not some guy on the street, you know, flogging you car stereos, you know, it's far more sophisticated than that, involving things like VAT fraud. You know, but but it but it's happening, it's going on out there because, you know, the money involved is is huge, right? You know, when, when you've got, you know, a thousand IT contractors earning £500 a day, it's, it's quite a tempting proposition to have your, have your fingers in the till, so that that's why these things happen. So that's, you know, that the risk to an organisation, think about that corporate response and social responsibility and who you want to be. And some end clients are getting this right, and what they're doing is realising that they need to audit their labour supply chain from end to end. And there is a very large online retailer, for example, who are getting this right, so they use umbrella companies throughout their supply chain, but they partner and they select the umbrella companies, they do a thorough audit of everything, they make sure their workers are protected. And we've seen things like you know, so throughout Coronavirus, the employees of the umbrellas working for this particular end client, very well protected, very well looked after throughout the, throughout the pandemic. So you can do things correctly, it is possible to have an umbrella in your supply chain, and to be a good, honest, ethical employer, as well. And if you just kind of sit back, sit there at arm's length and say, it's something that happens further down supply chain, it's the recruiters problem, then you need to be very, very careful that you don't end up with a few problems in the future around the Criminal Finances Act.

Adam

I mean, fundamentally, you should treat your labour supply chain the same way you treat any other supply chain, you know, if you know, if you don't know what's going on throughout it, there's a huge amount of risk of kind of, of suppliers, doing, you know, unscrupulous things, skirting regulations and saying, Oh, no, you know, we, we had no knowledge of it, you know, Your Honour. Yes. Doesn't, doesn't always wash. And you know, even if you managed to dodge, you know, the legal ramifications and managed to dodge prosecution, it's not gonna look great from a reputational perspective, you know, organisations might think twice with, about partnering with you, if you are one of these companies that kind of distances themselves from what happens in their own supply chain.

Jane

So we've laid out quite a dire landscape here. Are things improving? Or are they likely to get worse, before they get better? Are they going to get better?

James

I have seen no sign of improving as of yet. And obviously, myself and Rebecca are pushing for regulation. And the government is saying yep, we're setting up a single enforcement body. But the machine that is government takes time, it is going to be many years until the cavalry arrives with the legislation to sort this out. So, so don't count on something happening from a legislative point of view anytime soon to fix this market. So then it's down to the power of the contractors. And we've seen this with Off-Payroll. So contractors who are avoiding unfair clients, clients who can't deliver fair IR35 determinations. And I think we're going to see the same thing start to happen here. The IT contractor community is very tightly knit, contractors know one another, they ask each other for recommendations. And if one of them has a bad experience with an umbrella company, it's going to be on that WhatsApp group, it's going to be shared. And those those kind of things will start to ripple through the the IT contractor community. And hopefully, conversely, the recommendations for the good umbrellas will also go out through the, through the community as well. So whilst I don't think the legislation is going to have a big impact, I think probably what's going to happen is that as the number of people who are using umbrella companies starts to increase. I think the story won't go away. I think we'll hear more and more about the problems that are going on, contractors coming out with specific examples and saying yes, you know, I was impacted by that as well. I've lost out on £2,000 of holiday pay because of this industry giant who pocketed it. So I think we will see more of a grassroots approach to umbrella companies and helping people to find good umbrella companies. This is obviously great for the IT world, because we're talking about mainly professional people, well connected in a place where they've got a choice and they can do something about it. But we still need this legislation to protect people who aren't in a position to have those choices.

Adam

Well, I'm afraid that's what we've got time for this week. But James, thank you for coming back to join us.

James

Thank you.

Jane

You can find links to all of the topics we've spoken about today in the show notes and even more on our website itpro.co.uk.

Adam

You can also follow us on Twitter at @ITPro as well as Facebook, LinkedIn, and YouTube.

Jane

If you're enjoying the IT Pro Podcast, don't forget to subscribe and if you can, leave a rating and a review wherever you listen to podcasts, and we'll be back next week with more from the world of IT. But until then, goodbye.

Adam

Bye.

For many IT professionals, the decision to move from a permanent position to a contractor or consultant role has given them more flexibility, better earning potential and a healthier work-life balance. There are those, however, who use legal loopholes to prey on IT contractors, lining their own pockets by cheating both them and HMRC out of rightful earnings.

In this episode of the IT Pro Podcast, we’re joined by James Poyser, InniAccounts CEO and founder of OffPayroll.org, to discuss the role that umbrella companies play in the IT industry, and why regulation is needed to stop unscrupulous umbrellas from dipping their hands into the cookie jar.

Highlights

“One of the challenges is the umbrella market is unregulated. And even the head of a professional body who represents umbrella companies has described it as the Wild West; it's full of opportunists. And contractors for many umbrellas are seen as a commodity that needs to be exploited.”

“When we talk about these umbrella rates, it's that daily rates are advertised before any tax, and it wouldn't happen anywhere else. If your teenage kids are going to get a temporary job flipping burgers at McDonald's, it would be a gross rate of pay, after all the employment taxes have been paid. But for some reason, it's kind of okay in IT to advertise these rates before things like employers National Insurance and the apprenticeship levy are taken off. So those are the kind of things we want to see stopped, and for a fair rate of pay to be advertised.”

“The IT contractor community is very tightly knit; contractors know one another, they ask each other for recommendations. And if one of them has a bad experience with an umbrella company, it's going to be on that WhatsApp group, it's going to be shared. And those kind of things will start to ripple through the IT contractor community. And hopefully, conversely, the recommendations for the good umbrellas will also go out through the community as well.”

Read the full transcript here.

Footnotes

• IR35 news: HM Courts & Tribunal Service faces £12.5 million IR35 bill
• IR35 insurance: What is it and do you need it?
• The IT Pro Podcast: IR35 - what happens now?
• What is IR35?
• IT Pro 20/20: How regulation is shaping innovation
• Most tech workers plan to leave their roles in the next 12 months
• Blaze your career path with these seven high-tech freelance jobs
• IT Pro Panel: The truth about talent

Subscribe

• Subscribe to The IT Pro Podcast on Apple Podcasts
• Subscribe to The IT Pro Podcast on Google Podcasts
• Subscribe to The IT Pro Podcast on Spotify
• Subscribe to the IT Pro newsletter
• Subscribe to IT Pro 20/20

The government has launched a long-term strategy to encourage more private sector investment in the UK as it attempts to meet an annual target of £22 billion on research and development (R&D).

This new strategy centres on devising ‘innovation missions’ to better understand the main issues confronting the UK that the government wants to tackle, in partnership with the private sector, in the coming years.

The National Science and Technology Council will identify these objectives, which will be matched with a number of strategic technologies that prioritise, and build on, existing R&D strengths. These technologies include advanced materials and manufacturing, AI, genomics, engineering biology, electronics, photonics and quantum, clean technology, and robotics.

Four principles will guide the roadmap, the government has explained. They comprise unlocking access to investment, fostering a positive environment for innovators, ensuring that institutions promote R&D across the whole of the UK, and stimulating innovation that plays to the UK’s strengths.

“The countries that secure leadership in such transformational technologies will lead the world, enjoying unrivalled growth, security and prosperity for decades to come – and it’s our job to ensure the UK keeps pace with the global innovation race,” said business secretary Kwasi Kwarteng.

“Through this long-term plan, we want to rekindle our country’s flame of innovation and discovery, helping businesses to seize the vast opportunities that innovation can bring. If we get this right, we can build the foundations for the new industries of tomorrow, and ensure British firms are at the front of the pack to turn world-leading science into new products and services that are successful in international markets.”

The announcement follows a series of funding rounds the government has led in recent weeks, including a £375 million fund for 'game-changing' startups this week, and the creation of an £800 million 'high risk' scientific research agency in February.

Much of these announcements have seemed random and uncoordinated, however, which is an issue that abiding by a unified, pan-industrial, long-term strategy will hope to address.

Through the strategy, the government hopes to achieve a raft of objectives, including introducing new High Potential Individual and Scale-up visa routes and reducing complexity for companies by developing an online finance and innovation hub. This is in addition to the headline figure of £22 billion annual public R&D investment.

The government will also publish a new action plan on ‘standards for the fourth industrial revolution’, conduct a review of the R&D landscape, and ensure government procurement allows for a route to market for new products and services.

To kick start the strategy, five pioneering projects will receive a share of £127 million through the Strength in Places Fund, delivered by UK Research and Innovation (UKRI), in the North, the Midlands, Scotland and Cumbria, Wales, and Northern Ireland.

The UK government has signalled its intent to shake up the regulatory landscape overseeing the tech industry in the UK by stripping back “cumbersome and confusing policy” and cutting down on “red tape”.

The so-called Plan for Digital Regulation puts forward a vision in which innovation and economic growth will be prioritised when new policies are proposed and older pieces of legislation are reviewed.

When considering new legislation, policymakers must follow three guiding principles that comprise this framework. These include actively promoting innovation, achieving ‘forward-looking and coherent outcomes’ and exploiting opportunities, and addressing challenges in the international arena.

“How we govern digital technologies is one of the most pressing issues of our age,” said the government’s digital secretary Oliver Dowden, “Today we are setting out a pro-growth vision to shape the future.

"Our principles-based approach will ensure innovation is embedded in any new regulation, and we will look to reduce red tape to enable our vibrant tech sector to thrive."

The government’s desire to promote innovation, for instance, will see “unnecessary regulation and burdens” removed, with non-regulatory measures such as technical standards considered as a priority. Policymakers must also ensure that new regulations complement rather than contradict existing or planned regulations.

Finally, new proposals must always consider the UK’s international obligations, including trade deals and future arrangements, and the impact of regulations developed by other countries.

The government, under Boris Johnson, has signalled time and again its intent to strip back regulations governing the tech industry, particularly in the way that figures close to the prime minister have castigated GDPR.

A taskforce commissioned by Downing Street branded the EU’s data protection regime, which was baked into UK law, as “prescriptive and inflexible” just last month. It proposed scrapping the rules and replacing them with a new framework that doesn’t stifle growth, and promotes innovation.

The language used in this report mirrors that pushed by the Department for Digital, Culture, Media and Sport (DCMS) in its Plan for Digital Regulation. This suggests that already established legislation such as GDPR and the Data Protection Act (DPA) 2018 will be reviewed under the purview of this plan.

"Creating a framework for digital regulation that promotes innovation is a global challenge. If the UK can get this right, we can drive discussions at the international level and build on our reputation as a leading digital economy,” said the CEO of the trade association techUK, Julian David.

"The Plan for Digital Regulation is a strong start and shows the government’s commitment to creating a coordinated, proportionate and innovation-focused regulatory system.

"We look forward to working with the government in making this plan a reality by building a partnership with the sector to dig into the detail and turn these strong core principles into a forward-looking framework that reinforces the UK’s position as a top tier destination for technology companies."

The government has invited contributions from the industry as well as the general public in a consultation on what this framework should look like specifically.

In principle, the government is also hoping to deliver a joined-up approach to regulation. This model will see the Competition and Markets Authority (CMA), Financial Conduct Authority (FCA) and Information Commissioner’s Office (ICO) avoid regulatory overlap and cooperate much more deeply on regulatory matters against tech giants.

This article originally appeared in the May edition of IT Pro 20/20, available here. To sign up to receive each new issue in your inbox, click here.

In April, the European Commission (EC) unveiled plans to regulate artificial intelligence (AI). The first-of-its-kind rulebook includes bans on practices that “manipulate persons through subliminal techniques beyond their consciousness”, as well as the use of AI for mass surveillance by law enforcement and government-conducted social scoring, such as that currently employed in China.

While the move has been roundly applauded by privacy advocates and has been widely regarded as a welcome step in the right direction, the new regulations could also create sweeping changes for businesses that could seriously disrupt how they operate. Given that, in 2019, almost 40% of businesses used some kind of AI or machine learning technologies – a figure that has likely grown as a result of pandemic-fueled digital transformation – huge swathes of organisations could be forced to conduct risk assessments, or to continuously review AI systems.

Not doing so will have similar consequences to the General Data Protection Regulation (GDPR), which became the de facto privacy standard for many of the world’s largest companies after it came into effect in May 2018. Those that break the AI rules face fines up to 6% of their global turnover or €30 million, whichever is the higher figure.

Risky business

At the macro level, the EU’s new rules take aim at “high-risk” AI systems, such as facial recognition, self-driving cars, and AI systems used in the financial industry. In these areas, those deploying AI systems will need to undertake a risk assessment and take steps to mitigate any dangers; use high quality data sets to train the system; log activity so that AI decisions can be recorded and traced; keep detailed documentation on the system and its purpose to prove compliance with the law to government regulators; provide clear and adequate information to the user; have “appropriate human oversight measures”; ensure a “high level of robustness, security and accuracy.”

While this list of steps has been applauded by those with a keen eye on privacy, it’s unlikely they’ll be welcomed so fondly by those who have to ensure these measures are put in place. Ilia Kolochenko, CEO of ImmuniWeb, a global application security company that develops AI and ML technologies for SaaS-based application security solutions, believes the stringent requirements will be “arduous to implement it in practice.”

“For instance, assessment of high-risk AI systems will be a laborious and costly task that may also jeopardise many trade secrets of European companies,” he tells IT Pro. “Moreover, most of the AI systems are non-static and are continuously improved, thus new regulation will unlikely provide even a 90% guarantee that the system will remain adequate after the audit.

“Furthermore, the requisite explainability and traceability of AI output is oftentimes technically impossible. Finally, isolated AI regulation leaves the door widely open for traditional software offering the same capacities in high-risk areas of operations. In a nutshell, this timely idea certainly deserves further discussion and elaboration, however, practicality will be the key to its eventual success or failure.”

Guillaume Couneson, partner at law firm Linklaters in Brussels, thinks there could be other consequences for organisations operating in high-risk areas, and artificial intelligence technology itself.

“If inappropriately calibrated, this approach could stifle innovation and create barriers to the adoption of AI in the European Union,” he says.

“It will be important to keep flexibility on the categorisation, not only to add new high-risk uses in the future, but also to take out certain uses that would no longer be considered high-risk, for example because the use of an AI system in practice has evidenced that certain anticipated risks have not materialised or because individuals have become more accustomed to a particular use of AI systems.”

Black-box backlash

While the EU’s regulations take aim predominantly at those involved in the creation of high-risk AI systems, it’s unlikely that just these companies will be affected. With the use of AI and ML technologies becoming ever more prevalent, it’s hard to find businesses that are not relying on an algorithm for important decisions: Whether you qualify for a mortgage, how much we pay for our flights, what kind of advertisement we're shown and even the quality of customer support we receive.

Many of these organisations will be using a black box solution – a system that can be viewed in terms of its inputs and outputs, without any knowledge of its internal workings – which often means organisations are unable to connect the dots of how these machines reach certain decisions.

Andre Franca, director of applied data science at deep-tech company causaLens warns: “If organisations are not able to understand how the machine reaches a decision, this can lead to disastrous and unfair outcomes. The regulation is pushing organisations to become more accountable for the AI machines they are deploying, which is pivotal as AI becomes more prevalent across industries.

"With fines of up to 4% of a firm’s global annual turnover, it's imperative that organisations are able to understand how their AI models work to prove compliance to regulators and the board. Despite criticisms of the proposal being vague and ambiguous, set recommendations and criteria offered by the European AI Board will mean businesses need to look at their existing AI models and what needs to be changed in order to comply.

“For businesses using causal AI – which by its nature is a glass box solution, allowing businesses to look under the bonnet and have full control, visibility and transparency of their model – they can breathe a sigh of relief that they have the necessary information, if the board or a regulator comes knocking.”

Watchful AI

Naturally, some industries will undoubtedly be under more scrutiny than others – and not just those developing the AI systems in question. This will be largely determined by the amount of personal and sensitive data they process, which means sectors such as healthcare, transport, essential public services could be among the hardest hit.

Franki Hackett, head of audit and ethics at AI and data specialists Engine B, tells IT Pro: “The level of personal and sensitive data used is often going to be the thing that determines the impact of these proposals, and a lot has already been said about how companies offering financial services, or healthcare, might be affected.

“Companies whose entire business model relies, for example, on scraping and re-using photographs from social media without explicit permission to develop face recognition algorithms will have to make big changes,” she added. “Others who use personal data to offer, for example, financial services might need more robust governance structures, and still others will find they’re not really affected at all.”

Similarly, Camilla Winlo, director of consultancy at DQM GRC, believes there will be a huge number of sectors impacted by the AI regulations, from educational establishments and the emergency services to hardware manufacturers and border control. She advises that, while the rules are unlikely to come into force for some time yet, businesses need to start taking the appropriate steps now.

“I would recommend that for the organisations that are likely to be affected by the regulation to review their data protection impact assessments (DPIAs), supporting documentation and controls in light of the requirements, and to consider whether there are any gaps that will need to be filled,” she tells IT Pro. “This should be welcomed by the organisations in question, as it will improve their products. The rules are all about ensuring that products are attractive to potential customers, socially useful and minimise the risk of unwanted outcomes – all things any organisation should want, with or without a regulation.”

GDPR 2.0?

It remains to be seen whether organisations will welcome these changes, as many are likely fearful that it will arrive as GDPR 2.0 – forcing them to deal with unfamiliar rules and regulations, with the threat of a hefty fine if they fail to comply.

However, the regulations' arrival after GDPR could make the new rules easier to deal with, particularly for those businesses with stringent data privacy protections in place.

Emma Erskine-Fox, associate at UK law firm TLT, says: “Businesses that already have robust governance frameworks in place for GDPR compliance purposes will likely be at an advantage compared to those that are ‘starting from scratch’, but nevertheless, the new requirements will add another layer of complexity for all organisations dealing with AI technology.

Similarly, others don’t think the AI rulebook will be as big a disruption to businesses as GDPR.

Henrik Nordmark, director of science, data and innovation at data science company Profusion says: “These changes aren’t too much to ask. One of the reasons GDPR is a big ask is because every organisation, small or large, deals with data and they need to all do so safely.

“However, at the risk of oversimplifying things, these new rules on AI mainly impact those creating new AI systems. Most companies will need to do their due diligence in terms of selecting AI products and services from reputable companies, but will not necessarily be engaged in creating their own AI. And if they happen to be a company that is AI-centric, then they should definitely be thinking about the risks on society of what they create and how to mitigate those risks.

“This is analogous to safety laws that we put in place for pharmaceutical companies so that their inventions are also safe.”

Welcome to issue 17 of IT Pro 20/20, distilling the most important themes of the previous month into an easy-to-read package.

In this issue, we once again look at how regulations are shaping the development of technology. Our lead story is a deep-dive into the EU's recent attempts to create a GDPR-like framework for AI, and what this might mean for businesses across the bloc.

Keeping with that theme, we also explain how altcoins work and how they fit into a market likely to face tough new rules in the coming years, and also examine the ways in which businesses can walk that fine line between privacy and personalisation.

Also in this issue, you'll find an in-depth analysis of IBM's recent pivot to the cloud, and a look at why Formula 1 teams are so enamoured with big tech.

The next IT Pro 20/20 will be available on 30 June – previous issues can be found here. If you would like to receive each issue in your inbox as they release, you can subscribe to our mailing list here.

In the race to stay competitive, artificial intelligence (AI) – particularly machine learning (ML) – has massively expanded. Businesses and organisations can see their competitive advantage means analysing the vast datasets they have collected to reveal value.

However, the speed at which AI is evolving has led to questions over whether these systems are being set up correctly and whether the actionable outputs from the AI are accurate. What’s more, as AI tools can often be described as ‘black box’ technologies, can governance ever be adequately applied?

It's critical as the first step with AI governance to define what we mean by this term. Governance is often associated with compliance and even policing. Here, how the AI is being used and how these systems are applied to specific datasets must be clearly defined.

Speaking to IT Pro, Simon McDougall, deputy commissioner of regulatory innovation and technology, Information Commissioner’s Office (ICO), explains that context and use cases are vital to defining whether an AI system will be accurately governed.

“Today, we have off-the-shelf AI, which is often offered as a cloud-based service, so one area that is vitally important to understand is actually the procurement of these systems. Is the business buying the right system for them? The issue is that the buyers of these services may not be fully aware of the risk of bias. How important explainability is, and context and use cases, are vital to understand if the AI is to be used correctly,” McDougall says.

This concept of explainability, where the outputs from any given system must be fully explained, has become increasingly important in discussions about ethical AI and is central to AI governance. Businesses and organisations – especially within some highly regulated industries – need to be able to explain how their AI is operating to their regulators.

In its report on the future evolution of AI governance, KPMG found that 87% of IT decision-makers believe technologies powered by AI should be subject to regulation. More telling is that 94% of the same group state businesses should consider AI governance within their enterprise's broader ethical responsibilities.

Michelle Lee, AI ethics lead in the risk analytics team at Deloitte, tells IT Pro the practical application of AI governance is still a challenge for many businesses. "While some companies have introduced ‘trustworthy’ AI principles, many are still struggling to roll-out these principles into concrete operating models and processes,” Lee says. “It’s important to have a systematic way of assessing the competing objectives in AI – such as privacy, performance, and the ability to explain their processing – as well as trade-offs they may need to make to ensure the technology works effectively and delivers results.”

Responsible AI

The field of AI is very new and as a consequence, how these technologies should be governed and regulated is also in development. This was highlighted by the Committee on Standards in Public Life report that concluded the development of risk-based governance for AI should be a priority.

How governance in the AI space should be approached has parallels with GDPR: The regulation establishes in law the concept of the data controller and accountability, both of which can be applied to the burgeoning AI industry.

Businesses should practice their usual due diligence assessments when considering the purchase of any AI system. Understanding how the systems work and, critically, which training datasets were used, will all lead to higher confidence levels in the system's outputs and deliver robust governance by extension.

Svetlana Sicular, Gartner’s vice president of research, says that good AI governance is multifaceted. "Governance policy is only part of AI governance. It also includes standards, guidelines, best practices, and often, education that is commonly known as responsible AI education and data AI literacy,” she explains. “Additionally, AI governance is about how to best organise for AI from the responsible AI and AI ethics perspectives.”

Sulabh Soral, chief AI officer at Deloitte, warns that particular care should be taken to prevent AI systems unintentionally learning bias. “Within AI governance and framework development, there is a growing awareness of ‘vulnerability and bias mining’, particularly due to the experiences with social media,” Soral says. “As most organisations digitise and embed AI within apps to manage customer engagement and personalisation, they will invariably face the challenge of how to control their algorithms from learning psychological or primordial vulnerabilities and biases.”

Watching the machines

The responsibility for AI governance rests firmly with the business using the technology, as McDougall states: “Who has responsibility for how these systems are set up and then deployed is not a complicated question for the ICO. For us, GDPR contains the concept of data controllers.

“Ultimately, the business or organisation that uses these machine learning systems is fully responsible for setting up and then applying it to the dataset. The buyers of these systems have to perform their due diligence. They have to ensure they own their decisions. The responsibility for this isn't with the vendor.”

Sicular, meanwhile, says that AI governance should be a business-wide initiative and not simply an IT exercise. “The AI community increasingly speaks about responsible AI that applies to organisations, people and society. AI governance is a mechanism to implement responsible AI. It should take into consideration the interests of [these groups]. And of course, it should apply to data science where it balances the guardrails with the data science freedom that is necessary for AI creativity,” she says.

Any AI strategy a business is developing must have governance at its foundation. As AI – and particularly ML – proliferate, how these systems are governed will increasingly be a critical component of their successful deployment.

There must be some level of pragmatism, too. It’s almost impossible to completely remove bias, for example, but governance should be about recognising and managing the levels of bias. The same can be said for the level of ethics or the level of explainability that an AI system has.

McDougall concludes: “We live in a world that is risk based. If a business thinks it has solved the issue of bias with its systems, I would argue, that is the moment their systems are at the most risky for any end user. I would be more comfortable with an AI vendor that states their systems are not perfect but can show a level of risk that their systems could be biased in some way is acceptable.”

Customer-facing services that have a machine learning element must have a level of trust by their end-users. Increasingly, showing that good governance has been used – particularly in sensitive areas such as healthcare and finance – will become a prerequisite for many of these systems.

Your company deals with sensitive information — all companies do. Whether it’s customers’ private information, your company’s financial records and accounts, or that new top-secret project you don’t want getting out just yet, keeping your data secure is a top priority. Unfortunately, it seems to be getting harder all the time.

We’ve seen many major data breaches at many big name companies, including T-Mobile, Microsoft, and General Electric. Even the Internal Revenue Service (IRS) fell victim to a major data breach.

It doesn’t matter if you’re in charge of a Fortune 500 company or a small business, you must protect your data. While there's no foolproof way to secure all of your sensitive data, these steps can help prevent a data breach.

Data breach defined

Although the exact definition can vary between regulators, a data breach usually occurs when any unauthorised party gains access to confidential information.

The term usually covers everything from one of your own employees logging into a file without permission, to cyber criminals hacking into your systems and taking the personal information of employees and customers.

Normally a breach also involves the failure of a security layer, which results in the accidental or purposeful destruction, alteration, theft, or disclosure of protected data. It is considered a breach if an unauthorised individual simply looks at the data. The consequences can be severe for business, regardless of its exact nature.

The consequences of a data breach

The consequences of a data breach can be as varied as the different forms of breaches themselves. It could be as small as a single employee finding out his peers’ salaries and threatening to sue for higher pay. Alternatively, it could be as severe as cyber criminals or hackers accessing your system’s files and encrypting them before demanding a ransom.

If you follow recent news, you might have seen a variety of data breaches making the headlines which often involve accessing customer data, like addresses, names, social security numbers, and even credit card numbers. These breaches can cost the companies who are affected millions of dollars in lawsuits and lost business.

After a breach has occurred, detecting, defining, and recovering from the incident can be a long and slow process for an organisation. Although the consequences of this kind of leak can be brutal for larger corporations, they can be the death knell for a small business. The best strategy is to be prepared if it occurs and prevent it from ever happening.

10 steps to keeping your data safe

While there is no surefire way to eliminate all data breaches, these nine steps will help your business prevent catastrophic leaks.

1. Hire a professional

You probably have a financial controller or accountant in charge of payroll and accounts payable. Why would you not have a specialized IT security person to safeguard the entirety of your business?

Technology changes quickly, and you need someone dedicated and accountable who can find your vulnerabilities and help you shore them up. This IT watchdog can be your best bet in defending your business from external and internal data breaches.

2. Separate your business and personal accounts

Keeping your business and personal accounts separate should be obvious, but we’re not talking just about bank accounts and credit cards. This separation also goes for all of your accounts, including email and data storage. Keep them separate and have unique passwords for everything.

The last thing you need is someone hacking into your personal email and suddenly having access to sensitive business data.

Make sure everyone in your company follows this practice too. It only takes one small mistake to expose the whole company.

3. Checkout FINRA

The Financial Industry Regulatory Authority (FINRA) is a government-authorized nonprofit organization that oversees US broker-dealers and has a pretty good handle on what it takes to have top-notch cybersecurity.

It has put together a Small Firm Cybersecurity Checklist that’s a handy tool for any business looking to up its cyber security game. It’s free to download and could help you secure some aspects of your business you hadn’t thought about before.

4. Restrict access as much as possible

As much as possible, limit each employee's access to data. That means any employee who doesn’t need access to a program or data file doesn’t get access.

By all means, provide each employee with the permissions she needs to do their job, but limit anything that isn’t necessary. The fewer people accessing data, the lower the risk of a breach—accidental or otherwise.

5. Minimize your data

Think of your business as your home, and all that data is the stuff in your home. The more things you have cluttering an area up, the harder it is to keep track of the important stuff. It’s time to clean up.

Eliminate old programs or data files that serve no purpose. Team up with your IT security officer to establish the proper procedures for identifying and eliminating unnecessary files.

Keeping your data tidy can also help you identify a breach problem sooner too.

6. Encryption

Today’s technology offers plenty of avenues for encrypting your data. Use them. Don’t just encrypt data sitting in files; use encryption for files on the move through email and other means.

7. Educate your employees

One of the most common ways data breaches occur is through an honest employee mistake. You must teach your employees how to create unbreakable passwords and how to identify potential phishing scams and other security threats.

Train, test, and educate your employees on the importance of information security. It can be a tough job to get your employees on board with cyber security training, but it’s essential.

8. Get the C-suite on board

Cyber security awareness and understanding must start at the top. If the company’s executives don’t fully understand the threat and consequences, it will create a difficult hurdle for each step of the process.

Cyber security is an investment, and like any investment a company makes, the C-suite needs to see the benefit before they’ll be willing to pay for it.

9. Don’t ignore hard copies

Data breaches don’t always happen online. Printed documents can cause equal damage in the wrong hands. Keep all sensitive files in a locked cabinet and designate a gatekeeper who only gives access to those who truly need it.

Also, invest in a quality crosscut paper shredder to properly destroy any documents you need to eliminate.

10. Have a data breach response plan

While preventing a data breach is always the number one goal, your company needs to have an action plan for handling a breach. The ability to quickly detect a breach can save millions of dollars in some situations.

Talk with a cyber security professional and establish steps to identify, contain, and then recover from a data breach.

Data protection is an ongoing process

Once you’ve completed all 10 steps, get ready to do them all over again. Technology changes quickly, and cyber criminals are continually finding new ways to break into sensitive information and profit from it.

If you want to avoid becoming a victim of the next big data breach, stay one step ahead of the game. Companies that become complacent with their cyber security end up being vulnerable to attack.

The sale of financial products tied with cryptocurrencies or other cryptoassets will be restricted from next year, the UK’s financial watchdog has announced.

Due to the scope for market abuse, as well as extreme volatility in price movements, the Financial Conduct Authority (FCA) has deemed products linked with cryptocurrencies ill-suited for retail consumers due to the harm they may pose.

From 6 January 2021, the sale of any financial products linked with ‘cryptoassets’, i.e. cryptocurrencies such as Bitcoin, Ether or Ripple, will be prohibited. This isn’t to say that cryptocurrencies will be banned in the UK, rather it affects selling derivatives and exchange-traded notes, which track cryptocurrencies, to investors.

This ban follows a regulatory review of cryptocurrencies launched by the financial regulator more than two years ago.

“This ban reflects how seriously we view the potential harm to retail consumers in these products. Consumer protection is paramount here,” said interim executive director of strategy and competition of the FCA, Sheldon Mills.

‘Significant price volatility, combined with the inherent difficulties of valuing cryptoassets reliably, places retail consumers at a high risk of suffering losses from trading crypto-derivatives. We have evidence of this happening on a significant scale. The ban provides an appropriate level of protection.”

Among the reasons for the ban, the FCA has also cited the fact it’s difficult to reliably link cryptocurrencies with any inherent value, as can be done with fiat currencies, in addition to markets being prone to high price fluctuations. There is also a high prevalence of market abuse and financial crime, such as cyber theft, connected with cryptoassets.

Consumers, meanwhile, do not have an adequate understanding of such financial assets, and the FCA has not found evidence for a legitimate investment need for consumers to invest in these products in the first place.

The FCA’s stance has drawn varying perspectives from companies both in favour of the ban, as well as against the trading restrictions.

Danny Scott, CEO of CoinCounter, a Bitcoin exchange service, stressed the FCA is not banning cryptocurrency trading, rather specific financial products such as contracts for difference (CFDs), and options for futures.

These high-risk-high-reward products might normally incur some risk and fluctuation in value, but might be rendered significantly more volatile if linked with cryptocurrencies instead of other kinds of financial asset.

“Recently the UK FCA introduced an option for Bitcoin and cryptocurrency companies to register with them as a first step towards forming a regulatory framework around such assets,” he said.

“They’re comfortable with these assets and seemingly have a pro stance, they’re just not comfortable with companies packaging them up in traditional trader focused products that the everyday person doesn’t understand, yet has easy access to via some services - hence the announcement today.

"From our current understanding, this doesn’t affect Bitcoin exchanges like ourselves, but it will affect companies such as Revolut and eToro that offer a CFD rather than the asset itself.”

The move is not universally supported among those within the financial and crypto communities, with Global Digital Finance (GDF), an industry body that promotes the adoption of best practices for cryptoassets, against the move.

“I am surprised by today’s announcement from the FCA,” said executive co-chair of GDF Lawrence Wintermeyer.

“The regulator says part of its decision was influenced by a lack of consumer understanding around these products, but I am not convinced they are really any different to other similar alternative asset products that have not been banned for sale to the UK’s many sophisticated retail investors.

“Also, the industry has appropriateness and suitability tests to assess whether they are right for individual retail investors interested in using them.

"I also disagree with the regulator’s view that there is no legitimate investment purpose for cryptoasset derivatives. In the same way that you may hedge against a position in fiat currency, one may wish to hedge against exposure to cryptoassets. This ban kills off what could have been a new investment opportunity for sophisticated retail investors. It also sends a negative signal regarding the UK’s stance on cryptoassets.”

Welcome to the ninth issue of IT Pro 20/20, our digital magazine that brings all of the previous month's most important tech issues into clear view.

Given all that’s going on in the world right now, it’s easy to forget that technology is still evolving. Whether it’s changes to how we work, how we interact with the world, or how we communicate with one another, the next decade will likely be drastically different to the current one. It's this idea that is at the core of this month's issue.

In the first of our three exclusive features, we take a look at the role of augmented technology in business, and how transformative the technology has already been. Unlike the much-hyped virtual reality (VR), augmented reality (AR) has proven to be an exceptionally powerful tool for many roles across a business, from front line workers to executives in a boardroom.

Elsewhere, we examine the surge of interest that many 'touchless technology’ companies have enjoyed ever since it became apparent how dangerous the coronavirus truly was.

We also examine a technology described as the most serious AI threat we face today – deepfakes. What danger does this tech pose to society and is it really a threat to our democracy?

We appreciate you taking the time to download IT Pro 20/20, and we hope you enjoy this month’s future tech-themed stories.

The next IT Pro 20/20 will be available on Friday 30 October – previous issues can be found here. If you would like to receive each issue in your inbox as they release, you can subscribe to our mailing list here.

Google has responded to the European Commission’s public consultation regarding the Digital Services Act, submitting a 135-page document which points out the need to clarify the EU’s expectations towards tech companies.

In the submission, Google urged the European Commission to avoid a 'one-size-fits-all' approach, as well as elaborate on the responsibilities to which the tech industry will have to adhere if the legislation is passed.

The Digital Services Act, which was first unveiled in 2019, is expected to provide the EU with a raft of legal powers to influence how social media platforms govern hate speech, extremist material, and political advertising.

The legislation would directly impact Google’s video-hosting service YouTube, which has been criticised in the past for spreading harmful conspiracy theories, fake news, and hate speech.

In the document submitted to the European Commission, Google agreed that tech companies should act fast in order to immediately remove or disable access to harmful or illegal content. However, the tech giant also raised the concern that hosting platforms may be forced to prioritise speed over cautious decision-making.

In a blog post announcing the submission, Google’s SVP of Global Affairs Kent Walker said that the Digital Services Act “should reflect the wide range of services offered by the tech industry”, as opposed to adopting a common approach for every company.

“No two services are the same and the new act should be rooted in objectives and principles that can be applied, as appropriate, across this broad, diverse ecosystem. This will ensure that everyone - platforms regulators, people and businesses - are responsible for the parts they play,” he said.

Walker added that Google is “committed to providing greater transparency for our users and governments so that they better understand the content they are seeing and how to notify us of concerns”.

“The DSA should support these kinds of constructive transparency measures while ensuring that platforms can continue to protect user privacy, ensure commercially sensitive information is not revealed and prevent bad actors from gaming the system,” he said.

The consultation period for the Digital Services Act is set to conclude on 8 September.

Uber and Lyft have ten days to file an appeal against an injunction from a California court ruling which says the companies' drivers aren't contractors but employees.

The case centres on Assembly Bill 5, a law passed last year that requires companies to consider drivers or other gig workers as their own employees rather than contractors, which is a designation that should now only be used for tasks deemed outside the usual course of business.

For Uber and Lyft, driving is clearly a core part of their ride-share businesses, but they have long argued they offer a platform for workers to operate rather than directly employing drivers.

In May, a lawsuit was brought against Lyft and Uber for failing to reclassify their workers as required by the new regulation. The lawsuit was brought by LA, San Diego, San Francisco and state attorney general Xavier Becerra.

This latest ruling, by Judge Ethan Schulman, grants a request for an injunction against the companies, stopping them from classifying their workers as contractors. According to Reuters, the judge's decision said it was overwhelmingly likely that the plaintiffs could prove that classification was contrary to the new law, and said Uber and Luft and been "brazen" in their refusal to meet such laws.

"It's this simple: defendants' drivers do not perform work that is 'outside the usual course' of their business," the judge wrote in his ruling, referencing the requirements of the Assembly Bill 5 law.

"Defendants' insistence that their businesses are 'multi-sided platforms' rather than transportation companies is flatly inconsistent with the statutory provisions that govern their businesses as transportation network companies, which are defined as companies that 'engage in the transportation of persons by motor vehicle for compensation'."

The gig-economy giants disagree, and Lyft and Uber both plan to appeal. “Drivers do not want to be employees,” Lyft said in a statement sent to Reuters.

"The vast majority of drivers want to work independently, and we’ve already made significant changes to our app to ensure that remains the case under California law," an Uber spokesperson said. "When over three million Californians are without a job, our elected leaders should be focused on creating work, not trying to shut down an entire industry during an economic depression."

Yesterday, the company's CEO Dara Khosrowshahi called for regulation to create driver benefit funds, claiming drivers want the flexibility of contract work. "Uber would not be as widely available to riders, and drivers would lose the flexibility they have today if they became employees," he wrote in a column for The New York Times.

Alongside an appeal, Uber and Lyft will have another chance to push back against the law classifying drivers as employees, with the benefits and protections that entails. In November, Californians will vote on Proposition 22, which would label as contractors any drivers for apps such as Uber and Lyft.

“Ultimately, we believe this issue will be decided by California voters and that they will side with drivers," the Lyft spokesperson added.

If there’s one thing that’s almost guaranteed to have me howling like a dog with its tail slammed in a car door, it’s politicians trying to get a handle on technology. The House of Lords Select Committee on Democracy and Digital Technologies is a panel formed predominantly of peers with little or no expertise in technology, chaired by Lord Puttnam – the film producer best known for Chariots of Fire. A great man, doubtless, but about as qualified to head up a digital technology committee as I am to direct the next Bond film.

Puttnam and co have spent the past two years “considering democracy and digital technologies” and have reached a set of conclusions that anyone faintly qualified could have told them at the outset. “The digital and social media landscape is dominated by two behemoths – Facebook and Google”. Well, hold the front page.

“They largely pass under the radar, operating outside the rules that govern electoral politics” – ah, you’ve noticed Mr Trump won the election, then? “Platforms like Facebook and Google seek to hide behind ‘black box’ algorithms which choose what content users are shown” – computers, innit?

However, if the committee’s conclusions win it the Basil Fawlty Lifetime Achievement Award for the Bleeding Obvious, then the recommendations are something to behold. Take the first one off the rack, for example, in which their Lordships recommend that “the relevant experts in the ASA, the Electoral Commission, Ofcom and the UK Statistics Authority should cooperate through a regulatory committee on political advertising”.

Wow. Talk about gathering the four paper tigers of the apocalypse. The ASA spends its entire, futile existence banning adverts that stopped running months ago, so slow is it to react to complaints. And long-term readers will know of my overwhelming scorn for Ofcom’s painful inability to regulate the broadband market, to the extent that we’re now almost rock bottom of the OECD league table for fibre-broadband adoption. The Electoral Commission, meanwhile, has achieved the rare feat of uniting both Leavers and Remainers in calls for it to be scrapped; at least the UK Statistics Authority could keep a detailed track of how ineffective the other three are. Asking these four to regulate something as fast-moving as social media is like asking Sir Bobby Charlton to man-mark Raheem Sterling.

Then there’s the recommendation that “the Government should establish an independent ombudsman for content moderation decisions to whom the public can appeal should they feel they have been let down by a platform’s decisions”. Got the hump that Facebook has removed a post about how irredeemably inept your local MP is? Then write to the independent ombudsman and wait nine months while yet another overworked, understaffed quango manages to get your complaint to the top of the in-tray, by which time the whole thing will have blown over.

The problem with appointing a panel of clueless peers to oversee new technology is that they will come up with 20th-century solutions to 21st-century problems. They’ve wasted two years on this nonsense and achieved nothing. I’m angry and you should be too – it’s your money they’ve wasted doing it

Regulations in many countries require organisations to secure and encrypt any communications with their customers. The downside: those organisations now have to grapple with threats that hide within encrypted traffic.

This whitepaper takes a snapshot of regulations and compliance in the US, Europe and APAC, and identifies how organisations can protect themselves from malware by decrypting and inspecting traffic, while also adhering to privacy regulations by letting encrypted traffic pass through.

Download it now to ensure your business secures compliance.

Three UK watchdogs have joined forces to manage the regulation of digital services to ensure they act in a way that's fair for businesses and consumers.

'The Digital Regulation Cooperation Forum' aims to pull together the expertise of the Information Commissioner's Office (ICO), the Competition and Markets Authority (CMA) and Ofcom.

The forum's aim is to ensure online services work well for consumers and businesses in the UK, particularly where data, privacy, competition, communications and content interact. The three regulatory bodies will use the forum to coordinate action and support the development of informed and responsive regulation.

"We are in an era of digital innovation and ambition, so it's crucial that regulators work together to find a balance between effecting compliance and encouraging change in the online world," the ICO's executive director for tech and innovation, Simon McDougall, said. "The Forum will help us pursue joint projects and research, and we look forward to sharing knowledge and best practices."

The forum has set out six objectives for the ICO, CMA and Ofcom to work on, the first being to collaborate on a unified approach to the development of regulation, and the second being to inform regulatory policy making by using their collective expertise to explore emerging policy challenges.

The forum is also tasked with pooling regulatory knowledge and resources together to ensure all parties have the skills and expertise needed to carry out their jobs within the digital market. It will also develop a shared understanding of digital trends to anticipate what future regulations will be needed, as well as promote innovation through shared knowledge and experience.

The last goal is to strengthen international engagement with other regulatory bodies across the EU and the rest of the world. The members of the forum will also "engage" with the government and relevant members from the Department of Culture, Media and Sport.

This article originally appeared in May's edition of IT Pro 20/20, available here. To sign up to receive each new issue in your inbox, click here.

While the world grapples with the fallout of the COVID-19 coronavirus pandemic and the shift to mass remote working – also dubbed the ‘distributed workplace’ – other trends are bubbling under the surface. The growing use of artificial intelligence (AI) in businesses of all stripes is no secret, but there are another three technologies – distributed ledger, extended reality, and quantum computing – that are becoming increasingly influential as well.

While SMAC – Social, Mobile, Analytics, and Cloud – has already changed the relationships service providers have with their customers over the course of recent years, DARQ, as these newer technologies are collectively known, looks set to become even more transformative.

With all these technologies, and AI in particular, becoming mainstream, do we need a new form of regulation to ensure DARQ technologies are used legally, fairly and ethically?

“The digital change is not wafting like a gentle summer breeze over the beaches of Malta,” says Felix Hufeld, president of the Federal Financial Supervisory Authority. “It’s sweeping over the industry like a storm and is shaking up business models, companies and even entire markets.”

Regulators have already seen the rapid growth of FinTech, with new companies innovating outside of traditional banking and financial services. This has raised concerns that their regulatory regimes won’t be able to keep up with the pace of development.

Here, some form of automation could deliver a regulatory environment fit for a world dominated by DARQ technologies. A late-2019 survey carried out by the Bank of England and Financial Conduct Authority found 57% of regulated services use AI for risk management and compliance.

Susannah Hammond, senior regulatory intelligence expert at Thomson Reuters, tells IT Pro: “Traditionally, regulators [of financial services and data protection technologies] have sought to be technology-neutral when it comes to their rules and requirements, and have focused on the outcomes of the use of any technologies.

“The emphasis is on senior managers understanding the new technologies, their limitations, any new risks which may arise (e.g. bias in machine learning, etc.) and the checks and balances to ensure that the technology is, in practice, working as intended. Equally, there is a focus on the resilience of IT infrastructures both in terms of ensuring good customer outcomes and cyber hygiene.”

DARQ offers businesses the tools they need to develop new personalised experiences for their customers. Each element of DARQ will independently usher in new opportunities and ways of working, but it's the convergence of these technologies that really drives innovation – what Accenture called the “reimagining of entire industries.” Indeed, according to Accenture 89% of businesses are already experimenting with one or more DARQ technologies. For example, Volkswagen is using quantum computers to develop intelligent traffic guidance systems.

Using AI as a component of service automation for instance, opens up questions of accuracy and accountability. At the moment, the focus is on financial services as they expand and accelerate their use of technologies such as machine learning and biometric identification to combat fraud. When other DARQ technologies are added to the mix, this heady cocktail of data becomes difficult to police. Here, RegTech (Regulation Technology) could offer a solution.

Technology to police technology

The RegTech industry is expanding. According to KPMG, RegTech’s predicted share of all regulatory spending by 2022 will reach 34%, with the management consultancy defining RegTech 3.0 as a move from ‘know your customer’ to ‘know your data.’ This shift is critical to understand as all of the DARQ technologies are developing to create highly personalised services – all of which will need a degree of regulation.

The initial focus has been on how technologies such as AI are being applied to financial services and the businesses that supply them. RegTech, though, is expected to increase in importance as regulators realise they need new platforms to ensure DARQ technologies remain compliant.

“With regards to AI or quantum, regulations will be crucial for the wider adoption of these technologies as they will provide protection to consumers. This will allow the public to trust that they can safely rely upon these services,” explains Benoît Sauvage, director of regulatory strategy at Deloitte.

“The main issue is that regulations do not yet fully comprehend these technologies. For instance, for AI, it is expected that regulations demand to explain the algorithms and show how results can be ‘overridden’ or stopped. For quantum there might be a need to adapt cybersecurity rules and data protection rules,” he adds.

Businesses and regulators alike are considering how automated systems could help them keep pace with the technological change that will only accelerate when DARQ is considered.

Removing human compliance officers from the decision-making processes is risky, as many of the DARQ technologies are often a black box. RegTech will evolve and become an essential tool. Compliance officers will have little choice than to use these systems if they are to understand the avalanche of regulation that DARQ will attract and how these regulations impact their businesses.

Brave new worlds

Businesses are striving to implement more automation and DARQ will help them achieve those goals. However, these technologies can seem opaque to the uninitiated and how machine language systems arrive at a conclusion must be explainable. Here, ensuring bias isn’t present in the system is vital and must contain some form of oversight.

However, as François-Kim Hugé, a partner at Deloitte tells IT Pro, it’s important not to forget the importance of human input.

“The advent of RegTech does not mean the end of the compliance officer,” Hugé explains. “We are still far from a global compliance solution that can anticipate, understand, interpret and implement the ongoing avalanche of regulations impacting all businesses. This means the profile of compliance officers will need to adjust to this new digital reality where new solutions and new ways of working are created daily.”

All of the DARQ technologies are on an accelerating upward trajectory, although not all of them will develop at the same pace. Already we see the first widespread applications of AI – particularly machine learning – whereas other components of the DARQ collective, such as quantum computing, are still in their infancy.

As such, regulators will move forward with defining the compliance regime DARQ must be used within as each component becomes more mainstream and begins to impact consumers.

For businesses, while most recognise the massive impact SMAC has had, they may not be aware of DARQ or know that its impact could be even more disruptive. Once they wake up to this reality, their development roadmap should come into focus as soon as possible and they can start taking their first steps in using these technologies.

Regulators will, as always, be watching and RegTech could deliver a helpful dose of automated compliance. But that doesn’t mean it’s time to say goodbye to your human compliance officers – they will have a vital role to play as we start to more confidently explore the DARQ.