Insights

London – June 11, 2026: Crowell & Moring Partner Emma Wright has been appointed to the UK Government's newly formed Digital ID Advisory Group, an independent body of experts convened by Right Honorable Darren Jones MP, to support the delivery of a national digital ID system that is inclusive, useful, and trusted. 

Washington – June 4, 2026: Crowell & Moring earned 92 individual rankings for 81 attorneys, as well as 48 national and statewide practice area rankings, in the Chambers USA 2026 guide. The Chambers guide ranks the country’s top law firms and lawyers through in-depth research, client interviews, and feedback from attorneys at peer firms. 

Washington, D.C. – January 13, 2015: Crowell & Moring LLP is pleased to announce the publication of its third annual "Litigation Forecast: What Corporate Counsel Need to Know in the Coming Year," and the introduction of its first-ever "Regulatory Forecast 2015: What Corporate Counsel Need to Know in the Coming Year."

The EU Cyber Resilience Act (CRA) is an EU product cybersecurity law for connected products (formally, “products with digital elements” under the CRA) commercialized in the EU; it entered into force on 10 December 2024, with direct application across the EU. Full application begins 11 December 2027, but one of its most operationally demanding provisions takes effect in just under 100 days, on 11 September 2026: the mandatory vulnerability and incident reporting under Article 14 CRA.

On February 28, 2023, the European Data Protection Board (“EDPB”) adopted its Opinion 5/2023 (the “Opinion”) on the draft adequacy decision of the European Commission regarding the EU-U.S. Data Privacy Framework (“DPF”). The DPF aims to ensure that personal data transferred from the European Union to the U.S. receives an adequate level of protection. The framework is based on the principles of transparency, accountability, and oversight, and it includes safeguards to protect the data privacy rights of individuals.

In 2025, owners and operators of critical infrastructure will have new security and information sharing obligations to consider under the National Security Memorandum 22 (“NSM-22” or the “Memorandum”). NSM- 22 replaces the Obama-era Presidential Policy Directive 21: Critical Infrastructure Security and Resilience (PPD-21).

Protecting critical infrastructure is paramount to today’s digital age. Critical infrastructure includes physical and virtual systems essential for the functioning of our society, economy, and national security. Such a definition may include power grids, communication networks, and financial institutions, among other networks that heavily rely on interconnected computer systems. These systems are also considered critical infrastructure, as they are used to protect critical cybersecurity infrastructure. 

It is our pleasure to invite you to Crowell & Moring’s Seminar on Cybersecurity and Data Protection.

Since the emergence of cybersecurity and privacy as high risk issues in the public sector, the Government Accountability Office (GAO) has been at the forefront—identifying risks, reviewing progress of federal agencies, and keeping Congress informed on the latest developments. In this role, GAO has reported on the most pressing issues in these areas, as illustrated by a sampling of its 2014-15 reports.