As technology evolves faster than regulation, businesses need legal guidance that accounts for not only what the law requires, but how those requirements work in practice.
Chris Dodson brings a software engineer’s perspective to his technology, privacy, and data security practice, helping clients translate legal requirements into contracts, policies, and business practices that they can actually implement. He takes legal theories and makes them operational.
We spoke with Chris about navigating the growing patchwork of state privacy laws, the rise of autonomous AI and robotics, and how his technical background shapes his approach to emerging technology risks.
Q: How does your background as a software engineer influence the way you advise clients?
A: My software engineering background sets me apart from other technology-focused lawyers. It allows me to consider legal requirements not just in terms of what the law says, but how those requirements will actually be implemented by my clients. That's especially valuable in privacy, cybersecurity, and AI, where legal guidance often needs to be translated into contract language, processes, or policies and then made operational. I have a practical understanding of what's behind contractual language; the provisions related to data, security, APIs, service levels, and functionality aren't abstract concepts. I understand how they connect to the underlying technology and where contractual commitments may create implementation challenges or unexpected risks. My experience also helps me communicate effectively with engineers, security teams, and product leaders because I understand both the technical language and their general approach and mindset to these types of issues, as I’ve sat in their chairs and evaluated these issues from their perspectives.
Q: We've seen an increasing patchwork of state privacy laws across the U.S. How are companies adapting to this changing regulatory landscape?
A: The challenge for many organizations is deciding which privacy requirements should be standardized nationally and which state-specific differences need to be operationalized. While many state laws share common themes, differences involving sensitive data, exemptions, applicability thresholds, and opt-out rights can be significant. I help clients understand how those requirements intersect with their technology, including what data their systems collect and how data flows. From there, we can develop adaptable compliance processes that account for state-specific requirements without rebuilding the program each time a new law takes effect.
Q: Looking ahead three to five years, what developments in technology, privacy, or cybersecurity do you expect will have the greatest impact on businesses?
A: If you think the last few years have been dominated by AI, just wait for the next few years. New autonomous agents will be able to monitor systems, execute tasks, interact with third parties, and make decisions with limited human involvement. Organizations will need to determine not only what their own AI agents can do but also how they interact with agents representing customers, vendors, and employees. AI-driven robots are likely to move beyond factories and specialized environments into broader business settings, introducing new privacy, cybersecurity, safety, and liability concerns. In cybersecurity, AI will also make both defenders and attackers more capable. It can help organizations identify vulnerabilities, detect threats, and respond faster to incidents. At the same time, attackers can use AI to exploit weaknesses, enhance social engineering efforts, and create convincing impersonations.
Q: What excites you most about the intersection of technology and law right now?
A: I can't think of a more fast-changing practice area. Privacy laws continue to evolve, AI capabilities are advancing rapidly, and debates around regulation are just getting started. If the next few years bring broader robotics adoption, we'll have another wave of legal questions to tackle. I can't wait.