Resources

Product Counsel Insights

Articles and legal commentary on Product Counsel from Sarhan Data Law.

Latest thinking

Articles and Insights

Browse legal analysis on privacy, AI governance, technology transactions, and product counsel.

Product Counsel • August 13, 2026

Does SOC 2 Cover Your AI Model?

Your SOC 2 report says nothing about your model. What the Trust Services Criteria actually cover, the AI-specific gaps buyers now probe, and where ISO 42001 fits.

Business Transactions • August 5, 2026

The AI M&A Data Room: What Acquirers Will Ask For

The standard data room gets you through legal and financial review. AI-era acquirers ask for a second layer: training-data provenance, model dependencies, and governance artifacts most startups don't have.

Product Counsel • July 29, 2026

How to Evaluate Fractional Privacy & AI Governance Counsel: 9 Criteria

Nine specific, checkable criteria for evaluating fractional privacy and AI governance counsel — plus how one Canadian boutique practice scores against them, disclosed transparently.

Product Counsel • July 28, 2026

Do Enterprise Buyers Actually Care About Your AI Governance Policy?

Enterprise buyers don't read your AI governance policy document. They care about five specific artifacts it produces. Here's the difference, and why it matters for how you build it.

Product Counsel • July 27, 2026

Is Fractional Product Counsel Worth It Before Series B?

Fractional product counsel is worth it once you have a real contract queue — usually your first enterprise pilot, not a funding stage. Here's the cost math and the honest exceptions.

Data Protection & Cybersecurity • July 6, 2026

Canada's CDBA Draft Regulations Are Here: What Fintechs Need to Prepare For

The draft Consumer-Driven Banking Regulations published June 27, 2026 fill in the operational details — four accreditation pathways, security requirements, consent architecture, record keeping, and liability rules. Here's what fintechs need to know before the August 26 consultation deadline.

Healthcare • June 30, 2026

Navigating the PIPEDA-PHIPA Intersection: What Healthtech Companies Need to Know

PIPEDA vs PHIPA: which regime applies to your healthtech company, when both apply simultaneously, and how to navigate the grey zones that stall hospital deals.

Product Counsel • May 8, 2026

Canada's Consumer-Driven Banking Act Is Now Law: What Every Fintech Needs to Know.

The era of screen scraping is officially over and the API-driven data ecosystem is law. Here are the five legal and operational gaps fintechs needs to solve right now if you actually want to launch on day one.

Product Counsel • January 19, 2026

Party Roles in Data Processing Agreements: When Controller-to-Controller Makes Sense

Many important data flows operate on a controller-to-controller basis. Mischaracterizing these relationships creates legal risk and operational confusion.