The litigation environment in 2026 is far stormier than many corporate legal leaders predicted.
Corporate law departments across four key industries said they significantly underestimated the level of legal exposure they would face, particularly over cybersecurity and data privacy issues, a just-released survey by Norton Rose Fulbright on the litigation landscape reveals.
As part of its annual Litigation Trends Survey released in January, Norton Rose reported that 29% of corporate legal departments expected increases in cybersecurity and data privacy suits. A follow-up survey, released in June, produced a far less rosy result. Among law departments in the energy, financial services, healthcare, and technology industries, 56% now report increased cybersecurity litigation risk at the federal level and 53% are seeing heightened risk at the state level.
“The responses confirm what we see in practice: Enforcement risk has not receded, it has relocated,” Andrey Spektor, a co-head of the firm’s litigation and disputes practice in New York, said in the report. Companies can now expect to defend “parallel investigations on two tracks—and state AGs are increasingly the more aggressive plaintiff in the room,” Spektor said.
- Cybersecurity litigation is surging faster than companies expected in 2026, with 56% of corporate legal teams reporting higher federal exposure and 53% seeing increased state-level risk.
- AI is accelerating litigation pressure, especially in healthcare and tech, where privacy, bias and employment claims tied to AI tools are becoming common class action triggers.
- Data breaches are now the top driver of class actions, with 51% of companies citing cyber incidents as their biggest threat, including vendor-related leaks that can quickly escalate costs.
- Corporate counsel face growing multistate compliance challenges as state regulators intensify enforcement, making flexible litigation planning and risk management critical heading into 2027.
The No. 1 Concern
Overall, Norton Rose said that emerging technologies, including artificial intelligence, are boosting the number and sophistication of cyberattacks. Geopolitical instability is contributing as well, the firm said, with the federal government warning of potential cyber incursions “targeting critical U.S. infrastructure.” In addition, Norton Rose said, “perpetually evolving cybersecurity and data privacy requirements continue to expose companies to multijurisdictional enforcement, as does accelerating AI use across organizations.”
Cybersecurity and data privacy is now the No. 1 area of increased dispute exposure for technology and energy companies, both at the state and federal levels, the survey showed. Nearly three-quarters of tech players and 60% of energy companies listed it as their top area of increased risk. Financial institutions said cybersecurity litigation risk was their biggest worry in federal venues and ranked it among their top three issues at the state level. Healthcare companies ranked federal exposure in their top three, as well.
For technology companies, the increasing risk may reflect their “dual vulnerabilities,” the survey said. Tech players face cyberthreats themselves and also provide the digital products that may be held liable if customers are attacked. The survey also showed that data breaches are the top issue prompting class actions for tech companies.
In the law firm’s previous survey, released in January, 4 in 10 energy companies reported that greater exposure around cybersecurity and data privacy was their highest area of litigation risk. Those feelings have only intensified as 2026 has progressed. In the latest survey, 6 in 10 companies now see it as their leading risk in federal and state disputes.
How Cyber Exposure Can Snowball
Among the four industries covered in the mid-year report, financial institutions were the least likely to report increased dispute exposure, Norton Rose said. Nonetheless, federal cybersecurity litigation was causing the most unease for those companies. More than half said it was their biggest area of increased litigation risk. And data breaches and cybersecurity incidents were cited most often as a cause for class actions.
“Together, these results reflect the industry’s digital maturity—and larger attack surface—with banks and FinTech companies housing troves of sensitive personal and financial data,” the report said. While the industry may be catching a break from federal regulatory suits during the Trump administration, a spike in private litigation tied to federal rules may be causing worry for corporate counsel.
“Consumer protection and cybersecurity exposure remain the day-to-day reality for financial institutions,” Steve Dollar, co-head of the firm’s U.S. Financial Institutions Disputes team, said in the report. “What’s newer is how even a relatively modest data leak can snowball into a wave of class actions, including when the breach starts with a vendor rather than the bank itself.”
A Class Action Trigger
At the end of last year, 39% of companies told Norton Rose that they expected data breaches and cybersecurity issues would be the most active areas for class actions. As of midyear that number has soared to 51%.
Ed Camere, co-head of litigation and disputes in the firm’s Chicago office, said in the report that the stakes are getting higher for companies because “even small incidents can trigger massive potential exposure to class actions once statutory damages and multistate law come into play.”
Among other class action risks, workforce changes such as layoffs ranked second behind cybersecurity and data breaches. Just under half of companies (47%) cited those issues as their biggest class action trigger. That represents a significant jump since the firm’s annual survey. In January, 38% of companies cited employment-related class actions as a future litigation hot spot.
The firm’s annual survey also noted another trend—a wave of individual arbitration claims brought by plaintiffs firms that are seeking to circumvent class action waivers contained in terms of use. The claims, Norton Rose said, “can generate substantial cumulative filings fees that, in some cases, could exceed the cost of defending a class action.” That, in turn, can prompt corporate defendants to settle. Some 74% of companies said they had seen the strategy employed in 2025.
AI Litigation: A Real Threat
Class actions over artificial intelligence issues are also raising concerns for corporate legal teams. The midyear survey showed that 41% of companies said that product launches or AI-enabled product deployments were among their most common class action triggers.
In fact, AI in general is moving from a theoretical issue into a prime litigation category as more companies adopt the technology. Some 46% of companies told Norton Rose that they are experiencing additional federal dispute exposure over AI-related issues—the second highest-ranking category after cybersecurity. A similar number—42%—said they are seeing increased state-level exposure.
The type of AI-related litigation risk varies widely by industry and revenue. For smaller companies, AI-centric privacy, bias, and intellectual property claims are driving risk, according to the survey. For companies with $1 billion or more in revenue, regulatory scrutiny and AI-driven employment or workforce decisions are most cited as litigation drivers.
The healthcare industry reported the highest levels of AI litigation risk. Fifty-three percent of companies surveyed said their federal-level litigation exposure over AI issues had increased this year and the same number said AI was a class action trigger.
“Healthcare’s growing deployment of AI across operational and clinical functions is increasing litigation risk on multiple fronts,” Norton Rose said. For instance, a healthcare company may face Health Insurance Portability and Accountability Act (HIPAA) issues if an AI system is not “truly closed” and patient information “can escape the perimeter,” Jay Dewald, Norton Rose’s head of healthcare investigations, said in the report.
Employment Remains a Worry
Among other findings in the survey, Norton Rose said 39% of companies were experiencing increased federal dispute exposure over employment issues, and 44% were seeing risk rise at the state level.
Six months ago, in the firm’s annual litigation report, 31% of firms expected more exposure over labor and employment claims this year. And more than half said employment dispute risk would hold steady. At the time, corporate counsel said they were seeing shifts at the federal level because of new enforcement priorities and policy changes by the Trump administration. Year over year, in fact, the number of companies reporting labor and employment litigation had declined from 42% to 34%.
But at midyear, companies appear less sanguine. Norton Rose attributed the increases in risk to “decentralized enforcement and increased compliance complexity,” particularly in states like California and New York, where new employment laws are being implemented. “For multistate employers, that dynamic increases compliance complexity and forum risk in a very real way,” Kimberly Cheesman, co-head of the firm’s litigation practice in Houston, said in the report.
Indeed, financial institutions and healthcare companies said labor and employment claims were the No. 1 area of increased dispute exposure at the state level. Energy companies ranked labor and employment at number two at both the state and federal levels.
Remaining Flexible
How are companies responding to increasing litigation risks? According to Norton Rose, corporate counsel at midyear are reporting “meaningful progress on internal constraints and challenges.”
More than half of the companies said management of internal legal budgets has improved since January, and a similar number are seeing better cross-functional coordination. Outside counsel costs have “remained the same or become easier” to manage “even as regulatory and compliance complexity continues to be a challenge for the majority,” the survey said.
Corporate counsel will need to remain flexible, particularly as they plan for 2027. As the survey noted, the litigation environment is changing quickly, becoming more multijurisdictional and with levels of risk that may not have been expected just months ago.
“We’re seeing activity and new approaches at a level not seen in years,” Steven Jansma, who heads Norton Rose’s U.S. litigation and disputes team, said in the report. “Even where federal oversight has eased, states are often making up the difference, and that is pushing litigation forward across a broad range of areas.”
Frequently Asked Questions
How much did companies underestimate cybersecurity litigation risk in 2026? Corporate legal departments initially expected 29% would face increased cybersecurity and data privacy litigation in 2026. By midyear, the actual figures came in at 56% for federal exposure and 53% for state exposure—nearly double the original forecast, according to Norton Rose Fulbright's 2026 Litigation Trends Survey.
Is AI-related litigation actually increasing for companies? Yes. Norton Rose Fulbright's midyear survey found 46% of companies report increased federal AI-related litigation exposure and 42% report increased state-level exposure—the second-highest risk category after cybersecurity. Healthcare companies report the sharpest exposure, at 53%.
Which industries face the most litigation risk in 2026? Technology and energy companies rank cybersecurity and data privacy as their top litigation risk at both federal and state levels. Financial institutions cite it as their top federal-level concern. Healthcare companies report the highest AI-specific litigation exposure of any industry surveyed.
Why are class action risks tied to data breaches rising so quickly? Norton Rose Fulbright attributes the jump—from 39% to 51% of companies citing data breaches as a top class action trigger—to the fact that even small security incidents can trigger large-scale exposure once statutory damages and multistate law apply, and that breaches originating with a vendor rather than the company itself are increasingly common triggers.
---
David L. Brown is a legal affairs writer and consultant, who has served as head of editorial at ALM Media, editor-in-chief of The National Law Journal and Legal Times, and executive editor of The American Lawyer. He consults on thought leadership strategy and creates in-depth content for legal industry clients and works closely with Best Law Firms as senior content consultant.