Costello Advisory advises organisations on the full spectrum of digital regulation — privacy law, data governance, cybersecurity compliance, AI regulation, the Digital Services Act, the Online Safety Act, DORA, and their equivalents across EU, UK and US jurisdictions.
“Digital regulation is no longer a single framework. It is an overlapping landscape of privacy law, AI governance, cybersecurity obligations, and platform rules — moving simultaneously across the EU, UK and US. The organisations that navigate it best are those with the clearest picture of all of it.”
Digital regulation has become one of the most complex compliance challenges facing organisations today. Privacy law. Cybersecurity obligations. AI governance. Platform regulation. Data governance. These are not separate problems — they are the same problem from different angles, and they are moving simultaneously across three major jurisdictions that do not always agree.
Costello Advisory advises organisations of every size and sector on all of it — from global financial institutions navigating DORA and GDPR simultaneously, to technology scale-ups facing EU AI Act obligations and CCPA enforcement, to platforms managing DSA and Online Safety Act duties across EU and UK markets.
Costello Advisory is an independent consultancy led by Ash Costello. Senior, strategic, commercial. It is not a law firm. Where an engagement requires regulated legal advice, that work is carried out through a regulated law firm, which is identified to you before the engagement begins. Everything else is delivered directly — with the depth and judgement that only comes from twenty years at the coalface of digital regulation across three jurisdictions.
A focused, fixed-scope review of your AI deployments against EU AI Act obligations. Risk classification, compliance gap analysis, and a clear written action plan. Delivered within two weeks. No retainer required.
Enquire nowUS privacy enforcement is accelerating. CCPA fines, FTC action, and state AI laws are creating real exposure for any organisation touching US consumers. A focused review of your specific risk — what the law requires, where your gaps are, and what to fix first.
Enquire nowEvery engagement involves direct access to senior expertise — no junior team, no templated deliverables, no unnecessary complexity. A straight answer on what the regulation requires, what your exposure is, and what to do about it.
GDPR, UK GDPR, CCPA, CPRA, and the growing landscape of US state privacy law. Data governance frameworks, privacy by design, data subject rights, international transfers, and regulatory compliance — across EU, UK and US from a single adviser.
DORA, NIS2, the UK Cyber Resilience Act, and NIST frameworks. Regulatory compliance for cybersecurity obligations in financial services and technology — what the frameworks require operationally, not just on paper.
Risk classification, gap analysis, compliance frameworks, and board-level advisory on AI governance. EU AI Act obligations, UK AI policy, and US state AI laws — what your specific exposure is and what to do about it.
Platform obligations under the DSA, the Online Safety Act, and the expanding framework of digital platform regulation across EU and UK. Content moderation, algorithmic accountability, risk assessments, and regulatory reporting.
The ICO finalised its Storage and Access Technologies guidance on 29 April 2026 — PECR fines are now aligned with GDPR. Consent architecture, tracking technology compliance, and adtech regulatory strategy for UK and EU markets.
Regulatory strategy for fintech business models, payments, digital assets, and blockchain infrastructure — including DAOs, smart contract platforms, and tokenisation. Advisory across EU MiCA, UK FCA regime, and US frameworks since the sector's earliest days.
The EU defines an AI system in statute. The UK deliberately does not. The US has a federal definition and a different one in almost every state law. Why the line matters.
Read the briefingThe EU AI Act allocates duties by role, ISO 42001 puts them on top management, and NIST starts with ‘Govern’. In practice, someone has to be named. How to set it up.
Read the briefingMost AI risk arrives through a supplier. Whether the vendor trains on your data, who pays if outputs infringe, and what happens when something goes wrong are all contract questions.
Read the briefingGovern, Map, Measure, Manage. The US framework is voluntary, but buyers, insurers and regulators use it as a benchmark. What it asks for and what is changing.
Read the briefingCustomers are starting to ask suppliers for ISO 42001 certificates. A certificate shows an organisation manages AI systematically. It does not show that any particular system complies with the law.
Read the briefingISO 22989 gives everyone the same words for AI. ISO 42005 gives a structure for assessing a system’s impact on people. Together they make governance documents readable across borders.
Read the briefingThe OECD’s AI Principles are not law. Yet their definition of an AI system is in the EU AI Act, and their values run through most AI frameworks. Why they still matter.
Read the briefingThe EU requires chatbots to say they are AI. California and New York go further for companion chatbots, with crisis protocols and protections for minors. More US states start in 2027.
Read the briefingOn 30 September 2026 the ICO became the Information Commission. It must now write a statutory code on AI and automated decisions, and final guidance on automated decisions is due this winter.
Read the briefingEuropean regulators accept that legitimate interests can justify AI training, but only after a three-step test. A model trained unlawfully may itself be tainted. The US has no general consent rule, but regulators have ordered models deleted.
Read the briefingUK organisations can now make solely automated decisions more freely, provided they offer safeguards. The EU still starts from a prohibition. California’s automated decision rules bind businesses from 1 January 2027.
Read the briefingUsing an algorithm does not change who is liable for discrimination. In Mobley v Workday a US court has allowed claims against the AI vendor itself to proceed. What employers and lenders should check.
Read the briefingThe EU’s new Product Liability Directive treats software, including AI, as a product, with no need to prove fault. It applies to products placed on the market from 9 December 2026. The UK and US are behind.
Read the briefingCalifornia’s frontier model and chatbot laws apply now. Colorado’s rewritten law starts in 2027. A federal executive order targets state AI laws, but Congress has not legislated. Where things stand.
Read the briefingA US appeals court has held that training on Westlaw headnotes was not fair use. A UK court largely sided with Stability AI against Getty. A German court found OpenAI liable for song lyrics. What it means for businesses.
Read the briefingWhere did the data come from, were you allowed to use it, and is it good enough for the job? The EU AI Act puts these questions in law for high-risk systems. Everyone else should ask them anyway.
Read the briefingProviders of the most capable models already have legal testing duties in the EU and California. For everyone else, testing evidence is what regulators, customers and courts will ask for first.
Read the briefingCalifornia already requires the largest AI developers to report critical safety incidents within 15 days. The EU AI Act adds serious-incident reporting for high-risk systems. And the old data breach rules still apply.
Read the briefingA DPIA under data protection law, a fundamental rights impact assessment under the EU AI Act, and California’s new risk assessments overlap heavily. One well-built assessment can satisfy all three.
Read the briefingAI systems drift as data and use change. The EU AI Act requires providers to monitor after release and deployers to keep logs. And every system eventually needs retiring, with its data.
Read the briefingEnglish courts have referred lawyers to regulators over fictitious AI-generated citations, and the SRA issued a warning notice in August 2026. The rules are old ones: competence, confidentiality and candour to the court.
Read the briefingFund managers are using AI for research, operations, investor reporting and compliance. No regulator has written an AI rulebook for them, but conduct, outsourcing and operational resilience rules already apply.
Read the briefingAI agents are starting to trade, pay and trigger smart contracts on their own. Contract law, crypto regulation and data protection all apply, and the question of who is liable when it goes wrong is unsettled.
Read the briefingThe EU’s new Machinery Regulation applies from 20 January 2027 and covers self-evolving behaviour. AI built into regulated products becomes high-risk under the AI Act in August 2028. What manufacturers need to plan.
Read the briefingAI agents that act for consumers raise the same questions as human intermediaries: who authorised them, what may they do with the data, and must the other side deal with them? A US appeals court gave a first answer in August 2026.
Read the briefingAn AI agent has no legal personality, so it cannot be an agent in the legal sense. But contracts it makes can still bind the business or person who set it running. How courts approach automated contracting.
Read the briefingMost consumer tiers of the big AI assistants can use your conversations to improve their models unless you opt out. Business tiers generally do not. Why the tier your staff use matters more than the brand.
Read the briefingDeepSeek stores data in China and has faced European regulators since 2025. Mistral began training on consumer chats by default in 2026. Meta uses AI chats for ads outside Europe. Self-hosted models keep data in-house.
Read the briefingClients and employers are starting to ask who on a team is qualified in AI governance. The IAPP’s AIGP has become the reference credential. ISO 42001 auditor courses serve a different purpose. What each signals.
Read the briefingTen cases, five themes: who may train on what, who owns the output, who is liable for biased screening, what happens when a chatbot harms a user, and whether websites can block AI agents. Status as at November 2026.
Read the briefingOne product, three legal characters: a regulated intermediation service in the EU, an agent under general law in the UK, and a patchwork of agent and broker rules in the US. A side-by-side summary.
Read the briefingSince 1 August 2026 registered data brokers must act on deletion requests sent through the state’s own platform. Browsers must offer an opt-out signal by 2027. What the regime requires and what 2026 enforcement shows.
Read the briefingEvery EU member state must offer a digital identity wallet by 24 December 2026. The UK has dropped its mandatory plan but tightened the rules on identity checks. The US has no national scheme at all.
Read the briefingThe CNIL fined Google €325 million and Shein €150 million. The UK’s maximum penalty for cookie breaches is now £17.5 million or 4% of turnover. California reaches the same conduct through opt-out rules.
Read the briefingA US court refused to break up Google’s ad business. The EU has fined it €2.95 billion and has not ruled out divestiture. Meta now offers less personalised ads in the EU. What it means for advertisers and publishers.
Read the briefingMatthew McConaughey registered his catchphrase as a sound mark. Taylor Swift applied for her voice. Italy’s prime minister filed at the EU trade mark office in October 2026. What trade marks can and cannot do against AI imitation.
Read the briefingSince 11 September 2026 manufacturers of connected products must report exploited vulnerabilities in the EU within 24 hours. The UK Bill is in its final stages, and the US reporting rule is due. One incident, several clocks.
Read the briefingThe UK’s data reforms are in force, including a mandatory complaints process. The EU’s GDPR reform is stuck. Twenty US states now have comprehensive privacy laws, and several tightened them in July.
Read the briefingFrom 10 July 2027 EU exchanges and banks cannot handle anonymity-enhancing coins. In the US, Treasury has withdrawn its mixer rule while prosecutors press on with the Tornado Cash case. Where the line now sits.
Read the briefingThe Digital Omnibus on AI is law. High-risk obligations now start on 2 December 2027, or August 2028 for AI inside regulated products. Transparency duties began in August 2026. The dates to plan around.
Read the briefingUK law already lets a third party act for an individual, but it is silent on delegating the rights that matter most to data intermediaries. The government consulted on fixing that in summer 2026. What to do while the answer is pending.
Read the briefingNotification, neutrality, a separate legal entity and a duty to act in individuals’ best interests: the EU rules for data intermediaries are demanding. The Digital Omnibus would make them voluntary. How to design for both.
Read the briefingCalifornia lets a consumer appoint an agent to exercise privacy rights, and lets a business check that authority. The agent may use the consumer’s data for almost nothing else. Plus: the state’s own deletion platform.
Read the briefingA ‘data trust’ is rarely a trust in the legal sense. Agency is the more natural fit, and it brings fiduciary duties with it. The hard part is being paid from data you hold on other people’s behalf.
Read the briefingIndividuals have rights over their personal data, not ownership of it. A ‘licence’ to an AI developer is really a permission that can be withdrawn, and a trained model cannot easily forget. How to structure it.
Read the briefingA Delaware company run from the UK with users in Europe and America is inside three privacy regimes at once. Which laws apply, what the data transfers need, and which entity should hold the data.
Read the briefingNew DUAA exemptions, a 35-fold increase in maximum PECR penalties, and an expanded “instigation” concept that catches advertisers further up the adtech chain. What every UK organisation with a digital presence needs to do now.
Read the full analysisMandatory automated decision-making risk assessments. Mandatory cybersecurity audits. The largest CCPA settlement to date — $2.75 million against Disney. California's privacy regime has entered its most demanding phase.
Read the full analysisThe high-risk AI system requirements are being delayed to December 2027. The prohibitions and Article 4 literacy obligations are already in force. What compliance actually requires — and why the delay is not a reprieve.
Read the full analysisThe EU asks what an AI system might do. The US asks what it has done. The UK asks which regulator should be asking. What the divergence between Brussels, London and Washington means for global compliance strategy.
Read the full analysisWithout federal AI legislation, the real action is at state level — Colorado, California, Illinois, Texas — each with different definitions, scope triggers and enforcement mechanisms. What multi-state operators need to know.
Read the full analysisThe UK chose not to legislate on AI. Two years on, the scorecard is more complicated than either side acknowledges. What the sector-based approach has produced — and what it hasn’t.
Read the full analysisAsh Costello is the founder of Costello Advisory. She has spent over twenty years advising some of the world's most complex organisations on their most consequential digital regulation questions — across global financial institutions, technology platforms, and high-growth businesses at every stage.
Triply qualified across England & Wales, Ireland and New York, she advises on EU, UK and US regulatory frameworks simultaneously. For organisations navigating digital regulation across multiple jurisdictions, this means a single adviser who understands the complete picture — not three separate advisers each seeing one part of it.
She has held senior in-house legal roles in global financial services, has chaired and attended hundreds of board and fund governance meetings, and has advised on blockchain and digital assets since the sector's earliest days.
Through Costello Advisory, she works with boards, leadership teams, and organisations that need more than a compliance checklist — a strategist who understands the commercial reality behind the regulatory question, and who will tell you what matters, what doesn't, and what to do about it.
Over twenty years in private practice at leading UK and Irish law firms, followed by senior in-house roles at global financial institutions, and a decade advising technology platforms, fintechs and emerging technology businesses on digital regulation across three jurisdictions. Working with clients in the UK, EU and US.
If you are navigating digital regulation — whether that is DORA, the EU AI Act, CCPA enforcement, the Online Safety Act, or any combination of the above — the starting point is a direct conversation. No sales process. No pitch deck.
This form opens a pre-filled email in your own email program. Nothing you type here is sent to or stored by this website. Please do not include confidential information in a first enquiry. Costello Advisory is a consultancy, not a law firm; regulated legal advice is provided through a regulated law firm. Enquiries are treated in confidence. See the privacy notice.
Or write directly to ash@costello-advisory.com.