Tech & Sourcing @ Morgan Lewis

Companies are transforming legacy systems, implementing automation and artificial intelligence tools, embedding digital capabilities into their products, shifting to cloud solutions and leveraging technology to better connect to their customers, personnel, and third parties, all at an unprecedented pace. The focus on businesses to get to market faster, reach a broader audience and provide real-time interaction has in turn put pressure on legal and sourcing documents to keep up. The complexity and volume of the numbers of projects (and contracts) can be daunting — especially for companies that have not yet elevated the importance of the technology law function within their organizations.

The Board of the International Organization of Securities Commissions (IOSCO) has published a set of revised outsourcing principles for regulated entities. IOSCO is an international policy forum for securities regulators and a global standard-setter for securities regulation whose membership regulates more than 95% of the world's securities markets.

During the last year, we have seen a significant shift to “as a service” models and cloud solutions, as well as heightened attention on outsourcing as a strategic business tool to enable scalability, improved service, and accelerated access to in-demand technology and resources. This increased reliance on vendor performance to enable business operations has underscored the importance of implementing a solid service level methodology in order to: establish performance metrics that align with the customer’s expectations and business requirements; measure, monitor, and report performance against the metrics; set out the remedies for service level defaults, including service level credits and termination rights; and agree to events that may excuse performance resulting in missed service levels.

The Chancery Lane Project, a UK-based nonprofit network of legal professionals, has published a “Net Zero Toolkit” to help organizations achieve net zero goals. The toolkit includes 100 “climate clauses” aligned with the 2015 Paris Agreement goals.

Changes to complex commercial contracts are inevitable. These contracts, such as large outsourcing agreements, typically include a master services agreement (MSA) and a high number of exhibits and attachments describing the scope, performance standards, financials, and other contractual requirements in detail. Some deals can end up containing over 50–75 documents (or more!) in total. Given their strategic importance, these agreements often require numerous amendments as the relationship evolves over time and changes need to be formally documented.

The United Kingdom’s Department for Digital, Culture, Media & Sport (DCMS) is requesting views on supply chain cybersecurity, which it will look to incorporate into its new National Cyber Security Strategy.

For UK companies choosing between hiring employees or using independent contractors, there are important legal risks that must be taken into consideration. In addition, agile and remote workforces are a hot topic as companies around the world are considering new ways of working following the COVID-19 pandemic. However, in the post-Brexit United Kingdom, the idea that people can work in any place at any time presents tax, data protection, and employment law challenges.

The European Cloud User Coalition (ECUC) published a paper (the Position Paper) on May 17 recommending, among other matters, the adoption of “model clauses” for the long-term compliant use of cloud technologies.

Annual spending worldwide on cloud services is expected to increase by 23% in 2021, according to a recent article in The Wall Street Journal, which cites a forecast by IT research and consulting firm Gartner Inc. Since the beginning of the COVID-19 pandemic, businesses have shifted to cloud-based services to support remote work, but businesses are also using the shift in attitudes toward cloud services to move more complex IT needs to the cloud. The article reasons that the push to use cloud services may also be due to the hybrid workplace model that many businesses are adopting, where workers can work both in the office and from home. This model requires that remote workers have access to critical software and infrastructure.

We recently noted that the UK Financial Conduct Authority (FCA) published the outcome of a review into the factors that determine failure or success when implementing technology change in the financial services sector and discussed the importance of this review for firms seeking to improve the operational resiliency of their technology change management process.