Law for CEOs

Five legal risks every CEO should be monitoring

Not the exotic ones. The risks that reach the board are usually ordinary obligations that nobody owned until they crystallised.

EducationalExecutive briefingLast reviewed 2026-08-14No named reviewer yet

Which legal exposures are most likely to become a board-level problem?6 min read

Key points

Personal data. The exposure is rarely a sophisticated attack; it is not knowing what you hold, where it is, or who can reach it.
Employment process. Most claims turn on whether a process was followed and documented, not on whether the decision was reasonable.
Contract concentration. A single supplier or customer relationship with weak terms is an operational risk disguised as a commercial one.
Authorisation. In regulated activities, company registration is not permission to operate - and the two are frequently confused internally.
Records. Almost every other risk on this list is defended, or lost, on whether the records exist.

Exposure rarely sits where the accountability does. This is where it tends to surface first.

Take these into the meeting. The value is usually in how long the answers take.

1Who owns each of these areas by name, and what do they report on?
2If a regulator asked today what personal data we hold, how long would it take to answer?
3Which single contract, if it failed, would most disrupt operations - and what does it actually say?
4Are we authorised for everything we currently do, in every place we do it?
5What would we be unable to evidence if we had to?