As the United Nations Climate Change Conference of the Parties (“COP”) in Glasgow has drawn to a close, with seemingly mixed messages and a somewhat ambiguous conclusion, it is worth reflecting on the overall trajectory of the climate issue, societal expectations, and the accomplishments that — with time — Glasgow is likely to represent.  COP26 highlighted the fragility of the planet, as well as the fragility of the global consensus-based United Nations approach to protecting it.  It highlighted the sweep of global climate-induced challenges and the scale of transformation needed to address them.  With rising temperatures has come a rising global focus on climate and a far greater set of emerging societal expectations for meaningful responses by government and the private sector.  Despite the risk that the global agreement forged in Glasgow is seen by climate activists as all talk and no action — what they referred to as “blah, blah, blah” — I believe that a number of features will endure as important accomplishments.

Representatives from 197 nations, businesses, hundreds of civil society organizations, scientists, educators, media, and climate activists — you name it — all converged on Glasgow to shine a global spotlight on the climate crisis.  The Conference had some 40,000 registered participants.  With just a few thousand of those involved in the negotiations themselves, the rest converged around elevating climate understanding, climate solutions, and climate action. And still tens of thousands of others converged to protest and lend their voices to the climate debate. Expectations were heightened by the delay of the COP for a year due to Covid-19, as well as the return of the United States to the Paris climate process. Yet all of those expectations focused on a UN negotiating process that depends on achieving unanimity for each of its outcomes.

Despite the challenges posed by gathering under the cloud of Covid and the large numbers of attendees, the COP was in some ways better organized than ever before.  It has become less exclusively an international negotiation and much more of a communications mechanism to rally world opinion around the need for ambitious climate action. The UN proceedings kicked off with a Global Leaders Summit with 120 heads of state. It featured inspiring statements from governmental and societal leaders, such as Sir David Attenborough.  The Summit then flowed into the overall COP, which had a thematic organization for each day of the conference, by which it highlighted actions or the sweep and scale of climate impacts in a more coherent fashion than ever before — spanning from energy, finance, transport, cities and the built environment, science and innovation, nature, gender, youth, and adaptation to and loss and damage from climate change.  And the overall gathering encapsulated a heightened global focus on climate as a defining generational issue in a way that has never happened before.  

The World Rallied Around the Urgency Shown By the Evolving Climate Science 

The defining element of the Glasgow considerations was the acceptance of a far sharper sense of climate science findings around the scale and urgency of emissions reductions needed to stabilize the earth’s climate and prevent catastrophic consequences.  Every aspect of the discussions was judged by the context the new climate science shows. Continue Reading Report from Glasgow COP26: Assessing the United Nations Climate Conference

The African Growth and Opportunity Act (AGOA) has served as the cornerstone of the U.S.-Africa commercial relationship for more than two decades but it is set to expire on September 30, 2025. While the legislation’s unilateral trade preferences have provided economic benefits for countries across sub-Saharan Africa, AGOA as a whole remains underutilized. To ensure continuity in U.S-African trade ties, the United States must grapple with the legislation’s potential reauthorization now, with a particular focus on how the utilization of AGOA might be improved.

Just a renewal of AGOA won’t be enough to achieve this ambitious vision, though. Instead, the Biden administration should double-down on its partnership with AGOA beneficiaries and ensure that each country makes greater use of the program, including through National AGOA Strategies, in a manner that promotes regional and continental value chains.

This analysis includes Ethiopia, Guinea, and Mali, which are set to lose their AGOA benefits on January 1, 2022 because, as the Biden administration determined in a statement to Congress, they are no longer in compliance with the legislation’s eligibility requirements.

AGOA has been successful, but remains underutilized

In assessing the program’s future, it is important to acknowledge where AGOA has achieved success. When excluding exports of crude oil under AGOA, the data shows that the program has substantially improved the export competitiveness of certain African products, especially apparel. For instance, from 2010 to 2020, textile/apparel exports under AGOA grew by approximately 64 percent. Moreover, apparel exports from Lesotho, Ethiopia, Mauritius, Madagascar, and Kenya have not only led to the creation of tens of thousands of jobs but these countries have become reliable producers for the U.S. market and American consumers.  Lesotho and Kenya in particular have enjoyed the highest AGOA utilization rates: between 2010 and 2020, apparel products from Kenya accounted for 88 percent of the country’s total exports to the United States under AGOA ($3.6 billion in value); apparel products from Lesotho accounted for 99 percent of the same ($3.2 billion). The utilization rate is the percentage of U.S. imports under AGOA from a beneficiary country as a share of total U.S. imports from that country.

Heavy manufacturing has also seen some success under AGOA. South Africa’s auto exports to the U.S. under AGOA have created several hundred thousand jobs, directly and indirectly, in South Africa and in the auto supply chain within neighboring countries. Overall, light and heavy manufactured imports under AGOA accounted for 87 percent of all imports under AGOA from 2010 to 2020 (see Figure 1).

Figure 1: U.S. Imports under AGOA (2010-2020)

Note: This data set excludes exports of crude oil.

Source: USITC Data Web.

At the same time, not enough African countries have benefited from AGOA on a level that is sufficient to truly tip the scales when it comes to economic development, growth of commercial opportunities, and job creation. As Ambassador Tai noted during the recent AGOA Ministerial, this trend is due in part because utilization of the program remains low for many beneficiaries. In an effort to address this deficit, Congress called for—but did not require—participating countries to develop and publish national “utilization strategies” during the 2015 reauthorization of the legislation.

Countries with national AGOA strategies have increased AGOA utilization

These strategies are prepared by governments in sub-Saharan Africa as part of their planning to enhance the use of AGOA. In developing these strategies, beneficiary countries determine how their comparative advantage can enhance a country’s own competitiveness, which will also benefit regional trade. The idea behind such plans was that they would position beneficiary countries to take fuller advantage of their preferential access to the U.S. market. A review of trade data suggests that creating AGOA strategies is positively associated with increasing AGOA utilization rates.

To date, only 18 out of the 39 beneficiary countries have developed a national utilization strategy for AGOA. These countries include: Botswana, Eswatini, Ethiopia, Ghana, Kenya, Lesotho, Madagascar, Malawi, Mali, Mauritius, Mozambique, Namibia, Rwanda, Senegal, Sierra Leone, Tanzania, Togo, and Zambia.

Out of the 16 countries reporting data since the publication of a national AGOA utilization strategy, 14 have seen an increase in non-crude exports under AGOA. These increases in exports range from 2 percent to more than 3,000 percent. In particular, Mali, Mozambique, Togo, and Zambia, who had very low utilization rates, experienced an increase in exports of over 90 percent following establishment of a utilization strategy. Below are relevant examples:

  • Kenya published a utilization strategy in 2012. Kenya’s exports to the United States under AGOA subsequently doubled between 2012 to 2020. The largest source of exports during this period were apparel products.
  • Ghana published a utilization strategy in 2016. Ghana’s non-oil exports, which include yuca plant root, apparel products, and travel goods rose by 91 percent from 2017 to 2020.
  • Madagascar published a utilization strategy in 2015. Madagascar’s exports to the United States under AGOA subsequently saw a 390 percent increase from 2015 to 2020. Major exports during this period include apparel products, chocolate, and basket-weaving materials.
  • Mali published a utilization strategy in June of 2016. Mali’s exports to the United States under AGOA increased by 397 percent from 2016 to 2018. Agricultural and manufactured goods, including buckwheat, travel goods, and musical instruments, made up the largest portion of total exports during this period.
  • Mozambique published a utilization strategy in May of 2018. Exports from Mozambique under AGOA saw an 813 percent increase from 2018 to 2020. Agricultural products, such as sugar, nuts, and tobacco, made up the majority of exports over the period.
  • Togo published a utilization strategy in August of 2017. Exports from Togo under AGOA saw a 91 percent increase between 2017 and 2020. Agricultural products, including wheat, legumes, and fruit juices, were the largest source of exports during the period.
  • Zambia published a utilization strategy in March of 2016. Exports from Zambia under AGOA saw over a 3,000 percent increase by 2019. Semi-precious stones, pearls, and copper accounted for the largest portion of exports over the period.

Unfortunately, less than half of AGOA beneficiaries have developed national AGOA strategies. With four years left under the existing legislation, there is still time for beneficiary countries to achieve greater results under AGOA. Moreover, a renewal of AGOA for another 10 years would provide even more time to make national strategies as beneficial as possible while further deepening U.S.-Africa commercial ties.

This article first appeared on Brookings and can also be found on CovAfrica, the firm’s blog on legal, regulatory, political and economic developments in Africa.


I.  Introduction: the Scottish Government’s Draft Hydrogen Action Plan

On the 10th of November 2021, the Scottish Government published its Draft Hydrogen Action Plan (the “Plan”), as a companion document to its December 2020 Hydrogen Policy Statement.

The Plan sets out the Scottish Government’s detailed proposals for the Hydrogen industry in Scotland across the next five years. The aim is for Scotland to have capacity to produce 5GW of Hydrogen by 2030 and 25GW of Hydrogen by 2045. This blog sets out the key takeaways from the Plan.

A. Context

Scotland’s goal is to achieve net zero greenhouse gas emissions by 2045, with a 75% reduction against the 1990 baseline by 2030. Acknowledging the urgent need for change, the Scottish Government states that to reach these climate change targets, it will need to move at an unprecedented pace.

The Scottish Government is keen to ensure that those employed in existing (hydrocarbon) sectors will be reskilled and offered opportunities in the renewable sector and that renewable energy is affordably priced. The Scottish Hydrogen sector will play an important role in supporting this transition and the Plan commits the Scottish Government to assessing how to create a long term ‘skills guarantee’ for workers in carbon-intensive sectors. The Plan also highlights Scotland’s potential to become a low-cost producer of Hydrogen in Europe. The Scottish Government will set out in more detail its approach in its 2022 Energy Strategy and Just Transition Plan.

B. Funding

The Plan commits £100m to the Scottish Hydrogen industry over the next five years as part of the Scottish Government’s £180m Emerging Energy Technologies Fund (“EETF”). This money will fund FEED studies for large-scale renewable Hydrogen production projects with a view to making full investment decisions later in the decade.

The Scottish Government wants to use the £100m fund as a means to accelerate as many projects as possible from pilot stage to large scale commercial and has hypothecated £10m to prioritise innovation and research through the creation of the Scottish Hydrogen Innovation Fund, which will be launched early in 2022.

The remaining £80m of the EETF will fund the development of carbon capture, utilization and storage technologies – suggesting that the Scottish Government views blue Hydrogen as an important element of its Hydrogen revolution.

C. Timeline

The Plan sets out detailed action points until the end of 2026. By 2026, the Scottish Government expects large scale Hydrogen production infrastructure to be in place, with links to large-scale CS and onshore and offshore wind developments.

The Plan also sets out the proposed ‘Hydrogen Economy Route Map’ to 2045. Scotland aims to operate on 100% renewable electricity by 2035, with Hydrogen exports to the rest of the UK and Europe being increased at around the same time. In the 2040s, the Scottish Government aims to have capacity to produce 25 GW of Hydrogen and to be established as an enduring and reliable exporter of Hydrogen to Europe.

D. Underlying Themes

Strategic Scotland – the Plan stresses Scotland’s ideal position – due to its location, infrastructure, skilled workforce and natural resources – to grow its Hydrogen industry and become a world-leader in the Hydrogen sector.

Private Sector Diversification – the Plan notes the opportunity that Hydrogen offers for existing energy companies not only to diversify their offer, but also to reduce their carbon emissions.

Regional Approach – the Plan reinforces the importance of Scotland’s key regional hubs, in particular Orkney and Shetland, for potential growth in the Hydrogen industry. Aberdeen City is already deemed to be a Hydrogen hub in this regard, and the aim is for the initial public investment in these hubs to facilitate more significant private investment.

Collaboration – the Plan sets out a collaborative approach to developing Scottish Hydrogen for export, particularly with Germany and other Northern European nations.

E. Relationship between Hydrogen and other renewable energy sources

Although the Plan is not explicit on this point, it acknowledges that initial low-carbon Hydrogen infrastructure will pave the way for establishing the transportation and storage infrastructure to support a green Hydrogen economy in Scotland.

The Plan acknowledges that a strong renewables sector is essential to the development of Hydrogen projects. The Plan notes the importance of the onshore wind sector in supporting small and large renewable Hydrogen projects, but acknowledges the sector requires further investment.

The offshore wind sector is more advanced. Successful bidders in the July 2021 leasing round will be announced in early 2022 and August 2021’s leasing round had the specific objective of constructing offshore wind farms to decarbonise oil and gas infrastructure operations, support oil and gas-field decommissioning, and to use excess generation to create Hydrogen.

F.  Key Goals
The Plan set out six key goals:
  1. Drive Scotland’s Hydrogen production capability to meet an ambition of 5GW of renewable and low-carbon Hydrogen by 2030 and 25GW by 2045.
  2. Address current barriers to the uptake of green and low-carbon Hydrogen, including high production costs.
  3. Support the growth of Regional Hydrogen Energy Hubs.
  4. Encourage demand for Hydrogen by supporting Hydrogen use and developing supply chain capability and export potential.
  5. Secure broad economic benefit from public sector and private sector support for development of regional Hydrogen production and use.
  6. Encourage the development of a strong Hydrogen sector in Scotland which supports a just transition to net zero.
II. Action Plan

The Plan sets out six key challenges to be overcome during the next five years.

A.  Scaling up Hydrogen production in Scotland

To unlock Scotland’s potential to meet its ambitious targets for Hydrogen production, barriers such as regulation, planning laws or infrastructure constraints will need to be addressed. The Plan therefore commits the Scottish Government to a review of existing legislation, regulation and standards, to identify and remove potential barriers to the growth of the Hydrogen industry.

In order to improve understanding of the likely role to be played by Hydrogen in the domestic and global markets, the Scottish Government aims to establish the expected cost-trajectory for renewable Hydrogen up to 2045.

The Scottish Government will work with its counterpart in Whitehall to establish a UK Hydrogen Standard, and until this is established, the Scottish Government will only grant funding to Hydrogen projects with capture rates of at least 90%. Funding will not be awarded to new Hydrogen sites where CO2 emissions are unabated.

B. Facilitating the development of a domestic market

To facilitate the growth of the domestic Scottish Hydrogen market, economies of scale and technological progress are key. Transport and industry are seen as the sectors with the likely highest Hydrogen demand.

The Scottish Government will invite energy-intensive manufacturers to apply for grants under the Scottish Industrial Energy Transformation Fund to support deeper decarbonisation projects. New industrial developments with unabated carbon emissions will not be eligible for Scottish Government funding schemes. In the transport sector, the Scottish Government will establish a consortium for implementation of the Plan.

In the heating sector, the Scottish Government will support SGN (formerly known as Scotia Gas Networks), in converting elements of its network to Hydrogen, but only where doing so is consistent with keeping options open and limiting consumer costs.

Finally, the Scottish Government notes the urgency of amendments to existing UK-wide regulations to support the role of Hydrogen in the gas grid, to support Hydrogen blending and to maximize the volumes of renewable Hydrogen available in the energy system as quickly as possible.

C.  Maximising the benefits of integrating Hydrogen into the Scottish energy system

The Plan notes that converting renewable energy into Hydrogen provides new routes to market and may well change the investment proposition for new and existing renewables investors.

The Scottish Government believes that a key way to maximize the benefits of Hydrogen integration is to work with the UK government, Ofgem and the energy network sector to ensure that regulation rewards Hydrogen projects appropriately. A key action point is the establishment of a Hydrogen transportation and distribution infrastructure to support Scotland’s Hydrogen export ambitions.

D. Enabling the growth and transition of Scotland’s supply chain and workforce

The Plan places significant value on the existence of a skilled workforce within Scotland with expertise in the energy sector and its corresponding supporting infrastructure. Emphasis is placed in the Plan on investment in skills, including upskilling and reskilling workers into the Hydrogen sector. The Hydrogen Business Development service will aim to facilitate collaboration between industry and academic research.

E. Establishing and strengthening international partnerships and markets

The Plan notes Scotland’s potential to produce quantities of Hydrogen far in excess of its own domestic needs, and thus the potential of export and the importance of securing global supply chains. The Enterprise Agencies will, in particular, support the Scot2Ger project, aiming to deliver renewable Hydrogen produced in Scotland to German consumers by 2024. The Plan notes the importance of ensuring there are no legislative or regulatory hurdles to the international export of Hydrogen from Scotland, nor barriers to international inward investment in the Scottish Hydrogen industry.

The Scottish Development International outreach programme will actively engage with 280 international companies identified as potential targets for Foreign Direct Investment in the Scottish Hydrogen industry. Key collaborations on renewable Hydrogen development will be sought with Germany, Belgium, the Netherlands, Denmark, Canada, Australia, Japan and France.

F. Strengthening innovation and research

The Plan notes the funding set aside to create the Scottish Hydrogen Innovation Fund. A new Scottish Hydrogen Innovation Network will facilitate increased collaboration between Scotland’s Hydrogen innovation assets and avoid duplication of research. The Scottish Government will support Scottish participation in applications for EU funding through the Clean Hydrogen for Europe Partnership and will launch a £150k research call to support collaboration between academics and applied research institutes in Scotland and Germany.

Covington has a well-established and growing Hydrogen practice and our mixed policy, regulatory and legal teams are well-placed to help and advise clients moving into this increasingly important sector.  We would welcome the chance to discuss these opportunities with you.


On November 1, 2021, the Supreme Court denied a petition for a writ of certiorari in American Civil Liberties Union v. United States. In its petition, the American Civil Liberties Union (ACLU) sought the Supreme Court’s review of the Foreign Intelligence Surveillance Court (FISC) and the Foreign Intelligence Surveillance Court of Review’s (FISCR) decisions declining to release court records to the ACLU.

Beginning in 2013, the ACLU filed a series of motions with the FISC arguing that the First Amendment provides a qualified right of public access to its opinions. Both the FISC and the FISCR later rejected the ACLU’s request for records, asserting in turn that each court lacked the authority to consider the merits of the ACLU’s argument. In the case underlying this cert petition, FISC Judge Boasberg concluded that exercising jurisdiction over the ACLU’s motion would be inconsistent with an April 24, 2020 FISCR ruling on a prior ACLU motion seeking access to records, which held that the ACLU’s petition for review did not “fall[] within the class of cases carefully delineated by the [Foreign Intelligence Surveillance Act] as within [the FISCR’s appellate jurisdiction].” Per Judge Boasberg, the FISCR ruling established that Congress has not given either court the authority to review “freestanding” constitutional claims, nor has it granted entities like the ACLU statutory authorization to seek FISCR review.

On appeal to the Supreme Court, the government argued in response to the ACLU’s petition for review that the FISC and FISCR’s decisions were correct, and the Supreme Court did not have jurisdiction to review the lower courts’ rulings.

Justice Gorsuch, in an opinion joined by Justice Sotomayor, dissented from the Supreme Court’s decision to deny cert. “On the government’s view, literally no court in this country has the power to decide whether citizens possess a First Amendment right of access to the work of our national security courts,” Justice Gorsuch wrote, “this case involves a governmental challenge to the power of this court to review the work of Article III judges in a subordinate court. If these matters are not worthy of our time, what is?”

As reflected in Justice Gorsuch’s dissent, the Supreme Court’s decision to deny the ACLU’s petition resurfaces long-standing questions about judicial oversight over the U.S. government’s surveillance programs.

According to a leaked draft, on November 4, 2021, the Council of the European Union (“Council”) and the European Parliament (“Parliament”) agreed a number of amendments to the following three chapters of the draft ePrivacy Regulation, which will replace the ePrivacy Directive 2002/58/EC and has been pending since January 2017):

  • Chapter III (End-Users’ Rights to Control Electronic Communications) – this chapter is expected to regulate: (i) the presentation of calling and connected line identification (g., whether the device’s screen identifies the number of the incoming call); (ii) the blocking of unwanted malicious or nuisance calls; (iii) the inclusion of information, including personal data, in publicly available directories; and (iv) unsolicited direct marketing communications (e.g., spam email and SMS texts).
  • Chapter V (Remedies, Liability and Penalties) – this chapter is expected to regulate: (i) remedies; (ii) right to compensation and liability; (iii) general conditions for imposing administrative fines; and (iv) penalties.
  • Chapter VI (Final Provisions) – this chapter is expected to regulate the entry into force of the draft Regulation and the subsequent monitoring of its implementation by the European Commission.

However, the Council and Parliament still disagree on a number of significant issues.  For example, the Council and Parliament have not yet agreed on a definition of “unwanted calls”.  They also disagree on the scope of the prohibition for sending direct marketing communications without the recipient’s consent:  the Council intends to apply this prohibition only to communications sent to “natural persons”, while Parliamentarians want the prohibition to apply to sending communications to legal persons (e.g., companies) as well.  The Parliament also seeks to extend the traditional definition of direct marketing (which includes automated calling machines, telefaxes, and e-mails, including SMS messages) to various other types of advertisements, such as “pop-up windows or email-like advertisements” (e.g., push notifications), something not currently endorsed by the Council.

The Council and Parliament plan to hold a second trilogue on November 18, 2021 with the aim of closing the above three chapters, to the extent possible, and moving on to the other chapters of the draft ePrivacy Regulation.  We will continue to monitor and report on the developments in future blog posts on Inside Privacy.

The European Commission seeks stakeholders’ feedback until 18 November on its proposal to define cross-border projects in the field of renewable energy generation that would be eligible to receive EU funding under Connecting European Facility instrument.

In July 2021, the European Union adopted its Connecting Europe Facility (CEF) program for the period 2021-2027 worth EUR 33.71 billion to fund the development of high-performing infrastructures in the transport, energy and digital sectors.

Out of the CEF program devoted to energy (EUR 5.83 billion), 15% (EUR 875 million) is earmarked for a new category of eligible projects, namely ‘cross-border projects in the field of renewable energy’, including for instance the generation of renewable energy from on- and offshore wind, solar energy, sustainable biomass, ocean energy, geothermal energy, or combinations thereof, their connection to the grid and additional elements such as storage or conversion facilities.

The Commission is now consulting stakeholders on its draft delegated act aiming at laying down the specific selection criteria and selection procedure of cross-border projects in the field of renewable energy. The consultation closes on 18 November, at midnight.

The proposed procedure may be seen as a fastidious process without guarantee for promoters that their selected projects will be funded under the CEF. In this respect, the Commission stresses that a promoter may wish to apply for the status of cross-border project in the field of renewable energy but not for CEF funding. That status must indeed be seen as a ‘quality label’ of a project, allowing promoters to obtain appropriate financing on the market, or from Member States. In this context, the CINEA (European Climate, Infrastructure and Environment Executive Agency) has already launched a call for proposals open until 30 November 2021 and making available EUR 1 million to support preparatory studies for projects before they are included in the Union list of cross-border renewable energy projects.

Companies who plan to develop cross-border projects in the field of renewable energy within the EU may wish to give their views to the Commission on the selection criteria and the selection process. They may also envisage applying for grants for their studies to identify and develop such projects.

Covington has a dedicated team with significant experience to help you structure your EU energy projects, from an early stage. We can help you draft a response to the consultation – something we do frequently on a range of issues – and later, design your project and its funding under CEF, EU State aid law, energy regulation, public contracting, project finance. Our team includes Carole Maczkovics, who has cutting-edge expertise in State aid law, regulation and public contracts, particularly in the energy sector, and Cándido García Molyneux, who has deep knowledge of EU requirements on renewable energies and helps clients influence EU legislation and guidance. Visit our website to learn more about our Energy and Project Development and Finance teams.

On November 5, 2021, an Editorial Note was added to the Federal Register stating “An agency letter requesting withdrawal of this document was received after placement on public inspection. The document will remain on public inspection through close of business November 4, 2021. A copy of the agency’s withdrawal letter is available for inspection at the Office of the Federal Register.”   The reason for the Department of Defense withdrawal of the unpublished Advanced Notice of Proposed Rulemaking was not provided.

On Thursday, November 4, 2021, the Department of Defense (DoD) filed an Advanced Notice of Proposed Rulemaking (ANPRM) on Version 2.0 of the Cybersecurity Maturity Model Certification (CMMC).  The notice will published in the Federal Register on November 5, 2021.  DoD also provided a release regarding the enhanced CMMC 2.0.  We have discussed previous versions of the CMMC in earlier blog posts, and the changes discussed in this ANPRM represent a significant departure from those versions.

DoD’s announcement explains “the way forward” for the latest version of the CMMC.  The previous version, CMMC Version 1.0, was designed to protect the defense industry from malicious cyber actors threatening the security of federal contract information and controlled unclassified information (CUI).  CMMC Version 1.0 measured cybersecurity maturity at one of five levels, and required compliance with both “practices” (i.e., technical controls) and “processes” (i.e., measures of implementation).  CMMC Version 1.0 also included third-party certification requirements to ensure that defense contractors adopted these mandatory processes and practices, including those sufficient to protect CUI at Level 3 and above.  DoD had previously taken the position that compliance with the CMMC model represented effective safeguarding measures to protect information crucial to the Department’s mission and priorities.

Although CMMC 2.0 will remain generally consistent with DoD’s previously stated information safeguarding priorities, the ANPRM indicates that DoD will conduct two rulemakings—one in title 32 CFR (National Defense) and the other in title 48 CFR (the Federal Acquisition Regulation and agency supplements, including the Defense Federal Acquisition Regulation Supplement)—to implement a series of changes in the CMMC framework.  DoD has suspended the CMMC piloting efforts that began in December 2020 and will not approve inclusion of a CMMC requirement in DoD solicitations until rulemakings relating to CMMC 2.0 are effective.

The new CMMC Version 2.0 will include several modifications relative to the prior version.  According to Jesse Salazar, Deputy Assistant Secretary of Defense for Industrial Policy, these modifications “establish[] a more collaborative relationship with industry,” and “will support businesses in adopting the practices they need to thwart cyber threats while minimizing barriers to compliance with DoD requirements.” Modifications include:

  • Elimination of Levels 2 and 4 of the prior model. DoD has previously only referred to Level 2 as a step-stone to Level 3 and has grouped Levels 4 and 5 together as means to protect particularly sensitive information that may be the subject of advanced persistent threats.  Elimination of these Levels leaves contractors with only three levels of compliance, depending on the sensitivity of the information and the nature of the work that they perform:  Level 1 (the minimum necessary to protect Federal Contract Information), Level 3 (the minimum necessary to protect CUI), and Level 5 (the minimum necessary to protect CUI that may be the target of advanced persistent threats).
  • Bifurcation of Level 3 requirements to require independent assessment only for “prioritized acquisitions” and self-assessments for other procurements, and allowing for self-assessments for all contracts at Level 1. These are particularly notable changes, as DoD had previously required third party assessment at all certification levels.  Given the limited number of authorized third party assessors to date, this change will likely allow DoD to be significantly less constrained by the availability of assessors as CMMC is rolled out.
  • Development of a time-bound, enforceable Plan of Action and Milestone process (“POA&M”) and development of a time-bound waiver process. These changes are also notable, as DoD previously indicated that a significant driver of its shift to the CMMC model was to move contractors away from reliance on POA&Ms and to require contractors to achieve full implementation of required security controls in order to perform work on DoD contracts involving sensitive information.  As DoD did not elaborate on exactly how reliance on POA&Ms and a potential waiver process would function, further development of regulations in this area are likely to be of keen interest to contractors.  But it seems clear that DoD will want insight into contractors’ progress against their POA&Ms.
  • Elimination of “CMMC-unique practices and all maturity processes from the CMMC Model.” Although it is unclear what DoD considers to be “CMMC-unique” practices, this change could signal a shift, at least at the Level 3 and Level 5 certification levels, to remove those controls that were incorporated into the prior version of the CMMC model that were not included in the 110 security controls in NIST SP 800-171 (Level 3), NIST SP 800-53 (Level 5), or NIST SP 800-172 (Enhanced Security Requirements for Protecting CUI).  Additionally, removal of the maturity processes requirement could significantly simplify the requirements to achieve certification, shifting the focus away from documentation and towards technical implementation of required controls.

Overall, the proposed changes are a notable simplification of the CMMC model relative to Version 1.0 and represent a model that is much closer to existing requirements that contractors must comply with.  Given the significance of the changes, and questions that remain unanswered about how CMMC Version 2.0 will operate in practice, DoD contractors should consider whether to participate in the rulemakings that will accompany CMMC 2.0.  DoD explained that it would solicit public comments in connection with its title 32 CFR rulemaking establishing the CMMC 2.0 program and the subsequent title 48 CFR rulemaking establishing contractual requirements consistent with the new model.

If there is a silver lining to most crises, the accelerated move toward digitized commerce globally and in Africa may be one positive outcome of the COVID-enforced lockdown. It is welcome news there that the South African Minister of Communications and Digital Technologies (“Minister”) published the Draft National Data and Cloud Policy (in Government Gazette no. 44389) (“Draft Policy”) for public comment. The Draft Policy seeks to create an enabling environment for the provision of data and cloud services in an effort to move “towards a data intensive and data driven South Africa” that ensures social and economic development and inclusivity. The Draft Policy affects a few key areas, which we briefly highlight below.

The objectives of the Draft Policy are to:

  • Encourage universal access to broadband connectivity, along with access to data and cloud services;
  • Eliminate regulatory barriers and enable competition in the data and cloud sector;
  • Implement effective measures to ensure the security of cloud infrastructure;
  • Create institutional mechanisms to govern data and cloud services;
  • Support the development of small, medium, and micro enterprises (“SMMEs”);
  • Promote research, innovation, and technological developments in relation to cloud;
  • Increase the government’s capacity to deliver relevant data and cloud-based services to the public;
  • Promote data sovereignty and security with respect to South African data; and
  • Encourage alignment with the Fourth Industrial Revolution (“4IR”), the OECD Framework and standards adopted by the European Union.

Draft Policy proposal relating to digital infrastructure

The Draft Policy recognizes that digital transformation in South Africa relies upon further developing electronic communication networks, mobile communication networks, and cloud and data infrastructure services in the country.

In relation to universal access and service delivery obligations, the Draft Policy recommends a government-backed digital platform and for all South African citizens to be provided with an online identity in order to receive services more easily.

The Draft Policy discusses the need for a Wireless Open Access Network (“WOAN”) “to extend the digital infrastructure footprint and services” across the country. The Draft Policy also refers to various measures to ensure the deployment of electronic communication infrastructure, which will help to bridge the digital divide by ensuring universal access to cloud and data infrastructure services for all South Africans.

The Draft Policy also proposes that existing networks of state-owned enterprises, such as Sentech and Broadband Infraco, be consolidated to form a State Digital Infrastructure Company (“SDIC”), which will provide network connectivity for the State.

Draft Policy proposal relating to cloud computing infrastructure

The Draft Policy also highlights the need to process data using cloud computing infrastructure and makes provision for pliable data storage architecture and the purchase of capacity from cloud service providers.

The Draft Policy highlights the importance of cloud services and their ability to enhance the potential of 4IR technologies (e.g. blockchain, the Internet of Things (“IoT”) and artificial intelligence (“AI”).

In order to leverage the full potential of the South African economy through digital technologies, the Draft Policy proposes that a Digital Transformation Centre (“DTC”) act “as a catalyst to lead Digital South Africa”.

In addition, the Draft Policy proposes the establishment of a High-Performance Computing and Data Processing Centre (“HPCDPC”) for the purpose of managing cloud computing capacity for the State and its functionaries, universities, research centers and South African registered business, and to provide user-on-demand cloud services for the State and its functionaries .

The Draft Policy specifically provides that investment in data centres will be centralised in large metropolitan areas in South Africa, like Gauteng, KwaZulu-Natal and the Western Cape. Further, the Draft Policy proposes supporting local and foreign investment in data and cloud infrastructure and services by establishing a digital or ICT ‘Special Economic Zone’ (“SEZ”).

Draft Policy proposal on data protection, data localization and cross border data transfers

The Draft Policy states that the processing of personal data or personal information, specifically metadata (for example, IP addresses), must be compliant with applicable laws like the Protection of Personal Information Act 4 of 2013 (“POPIA”), the Promotion of Access to Information Act 2 of 2000 (“PAIA”), and international best practice (such as the General Data Protection Regulation (“GDPR”) in the European Union).

There are currently no data localization requirements in South Africa (under POPIA or otherwise). However, the Draft Policy seeks to impose data localization requirements and defines data localization as the “…requirements for the physical storage of data within a country’s national boundaries, although it is sometimes used more broadly to mean any restrictions on cross border data flows”.

On the issue of data localization, the Draft Policy provides inter alia that:

  • Data generated in South Africa shall be the property of South Africa, regardless of where the technology company is domiciled.
  • Ownership and control of personal information and data shall be in line with the POPIA.
  • The Department of Trade, Industry and Competition through the Companies and Intellectual Property Commission (“CIPC”) and the National Intellectual Property Management Office (“NIPMO”) shall develop a policy framework on data generated from intellectual activities including sharing and use of such data.

Draft Policy proposal on cybersecurity measures

The Draft Policy proposes that the Electronic Communications and Transactions Act 25 of 2002 (“ECTA”) be reviewed to align with cybersecurity policy and legislation.

Interestingly, the Draft Policy does not mention the Cybercrimes Act 19 of 2020, which is now an official Act of Parliament. The Cybercrimes Act aims to established a comprehensive cybersecurity framework and provides for the criminalisation of a broad range of cyber-related crimes. The date on which the Cybercrimes Act comes into force is yet to be announced.

Nevertheless, the Draft Policy proposes the establishment of a National Cybersecurity Policy Framework (“NCPF”) which, together with other policies, legislation and international best practice, will provide guidance as to cybersecurity initiatives and measures, and will be reviewed from time to time to ensure that the NCPF is responsive to cybersecurity threats and risks.

In addition, the Draft Policy proposes that the government develop and implement cybersecurity awareness initiatives to educate the public.

Next steps

Upon finalization of the Draft Policy, it will apply to all levels of government (i.e. national, provincial and local authorities); state-owned entities, the private sector (i.e., multi-national entities seeking to invest in the digital infrastructure of South Africa); and the general public.

For further information, please reach out to Witney Schneidman at, Deon Govender at, Dan Cooper at, Mosa Mkhize at or Shivani Naidoo at

This post can also be found on CovAfrica, the firm’s blog on legal, regulatory, political and economic developments in Africa.

  •  On September 30, 2021, President Andrés Manuel López Obrador presented to Congress a constitutional reform of the electricity sector which modifies three articles of the Mexican Constitution (25, 27 and 28), reversing key parts of the 2014 energy reform that opened the sector to private investment. The congressional debate and vote on the reform are scheduled to take place as early as mid-November.
  • If it passes in its current form, the reform would have serious implications for companies with investments in Mexico’s electricity sector. Foreign investors in this sector should assess options they may have under Mexico’s trade and investment treaties to seek potential remedies for adverse impacts.
  • Recent preliminary analysis by the U.S. Department of Energy concludes that implementation of the reform in its current form would increase Mexico’s greenhouse gas emissions and result in higher generation costs, making Mexico a less competitive jurisdiction for investment.[1]
  • Politically, the President’s move could also have implications beyond the energy sector by dividing the opposition coalition in the run-up to the 2024 elections.

Since the beginning of his administration, President López Obrador has sought to strengthen the role of the sate-owned Comisión Federal de Electricidad (CFE) in providing electricity and regulating the market.  Earlier in 2021, the Mexican Congress approved reforms to the Electricity Industry Law, but implementation was blocked by the courts.  The constitutional reform is designed to skirt similar judicial intervention and would imply a major change in the medium and long term outlook for the sector.

The proposed constitutional reform is intended to: maintain CFE’s participation in the market at 54%  by limiting private generators to 46%; change the current dispatch regime in favor of CFE instead of the lowest-cost power generators (often private actors); cancel electric generation permits, power purchase agreements, self-supply contracts and Clean Energy Certificates for private and public electricity generators; eliminate the country’s independent energy regulatory agencies (the Comisión Nacional de Hidrocarburos or CNH and Comisión Reguladora de Energía or CRE); and have the National Center for Energy Control (CENACE) be absorbed by the CFE.

The Constitutional reform would also impact the production of lithium from Mexican deposits, requiring the minerals’ future production and exploitation be reserved for the State.


  • Passing the constitutional reform will be an uphill, but not impossible, battle for the President. His legislative coalition falls short of the two-thirds majority needed in the Mexican House and Senate to pass constitutional amendments.
  • In the House, Morena and its allies need 334[2] votes for the qualified majority necessary to pass the reform, assuming all legislators are present. The Green Party (PVEM), one of Morena’s key allies in the house, to date has not shown a clear position toward the electricity reform.
  • In the opposition bloc, the center-right PAN, the center-left PRD, and Movimiento Ciudadano have adamantly opposed the reform. The PRI however may be partly in play, even though the PRI introduced and passed the 2014 energy reform that opened the sector to private investment.  PRI leadership has not publicly rejected Morena’s effort and instead is proposing to convene experts to analyze the details of the proposed reform.  Those opposed to the reform fear that the PRI could separate themselves from the opposition bloc, increasing the chances that some form of the bill could pass.
  • In Mexico’s Senate, where the President’s party also lacks a qualified majority, the path looks more difficult. The PRI holds 13 votes out of 128 total in the Senate, of which 85[3] are needed to enact the reform, assuming all senators are present at the time of the vote.  A few PRI senators have publicly rejected the reform in its current form.  However, on September 27, five Senators (three from the President’s coalition) banded together to create a new group, and they could make the difference if they align on this reform.
  • The congressional debate and vote for the reform are scheduled to take place as early as mid-November, after the discussion and vote for the 2022 federal budget takes place.
  • The Constitutional reform would also need to be approved by a majority (50%+1) of state legislatures (e., 17 states). President López Obrador’s coalition controls 20 of the country’s 32 State legislatures and holds the governor’s office in 16 states.


Political Implications in Mexico

  • The outcome of the political debate on this constitutional reform will set an important precedent for other reforms planned by President López Obrador and his party. These other reforms may encompass fundamental changes to the electoral system, including opening debate on the autonomy of the country’s widely respected electoral institution and changes to Mexico’s security institutions, including further strengthening the role of the uniformed military over Mexico’s security structure.
  • The future of the opposition bloc going into the 2024 presidential election likely depends on their united position toward the electricity bill. Divisions over the bill could fracture the opposition alliance heading into those elections and key state races that will be decided concurrently.


  • Should the reform be implemented, Mexico could face challenges from foreign investors under its international trade and investment treaties that allow investors to initiate arbitration directly against the government. For example, recourse to arbitration is available to investors of ten countries that are party to the Comprehensive and Progressive Trans-Pacific Partnership (“CPTPP”).
  • Similarly, U.S. investors could potentially file arbitration claims under the S.-Mexico-Canada Agreement (“USMCA”), which provides enhanced protections for certain investors in the “power generation” sector. Potential claims could also be made by U.S. and Canadian investors under the North American Free Trade Agreement (“NAFTA”), which—although superseded by the USMCA—retains the option for investors to initiate arbitration proceedings for qualifying “legacy” investments until July 1, 2023. NAFTA contains exceptions specific to the energy sector that are not contained in the USMCA that may affect such claims.
  • Foreign investors in the Mexican electricity sector should assess whether they may pursue arbitral remedies under Mexico’s investment treaties and how potential domestic litigation in Mexico may affect access to those remedies.
  • In addition to investment arbitration, Mexico could also be subject to treaty challenges by other countries, which could claim that the reform violates other obligations, including—for example—provisions in the USMCA or CPTPP regarding state-owned enterprises.
  • By eliminating Clean Energy Certificates, the reform would eliminate Mexico’s most important mechanism for the reduction of greenhouse gas emission at the domestic level; this mechanism was included within the nationally determined contribution under the Paris Agreement. According to recent preliminary analysis by the U.S. Department of Energy, Mexico’s greenhouse emissions could increase by as much as 65 percent as well as raising costs for the generation of electricity. Both impacts would make Mexico a less competitive jurisdiction for foreign investment.


[2] Considering that there are 500 legislators in the House, 334 votes are required to reach a qualified majority – or a smaller number, depending on the total number of attendees at the session.

[3] Or a smaller number depending on the senators present in the plenary session.

On 27 October 2021, the U.S. Food and Drug Administration (“FDA”), Health Canada, and the United Kingdom’s Medicines and Healthcare products Regulatory Agency (“MHRA”) (together the “Regulators”) jointly published 10 guiding principles to inform the development of Good Machine Learning Practice (“GMLP”) for medical devices that use artificial intelligence and machine learning (“AI/ML”).


AI and ML have the “potential to transform health care” through their ability to analyse vast amounts of data and learn from real-world use.  However, these technologies also pose unique challenges, given their complexity and the constantly evolving, data-driven nature of their development.  The Regulators formed the guiding principles to “help promote safe, effective, and high-quality medical devices that use . . . AI/ML” and to “cultivate future growth” in this fast paced field.

The Regulators predict that the guiding principles could be used to: (i) adopt good practices from other sectors; (ii) tailor these practices to the medical technology/healthcare sector; and (iii) create new practices specific to the medical technology/healthcare sector.  The Regulators expect these joint principles to inform broader international engagements as well.

The 10 Guiding Principles

 The guidance published by the Regulators set out the 10 principles in full; however, in short, they recommend:

  1. Leveraging multi-disciplinary expertise throughout the total product life cycle
  2. Implementing good software engineering and security practices
  3. Ensuring clinical study participants and data sets are representative of the intended patient population
  4. Making training data sets independent of test sets
  5. Basing selected reference datasets upon best available methods
  6. Tailoring the model design to the available data and ensuring it reflects the intended use of the device
  7. Placing focus on the performance of the human-AI team
  8. Ensuring testing demonstrates device performance during clinically relevant conditions
  9. Providing users with clear, essential information
  10. Monitoring deployed models for performance and managing re-training risks

These principles cover the entire life cycle of devices with the aim of ensuring safety and efficacy.  The Regulators have focused on use of appropriate datasets and carrying out sufficient testing before marketing AI/ML-based devices.  These guiding principles set out an ongoing recommendation to manage risks, which will involve monitoring and potentially re-training AI/ML-based devices after deployment.

These principles are merely a starting point.  The Regulators stated, “[a]s the AI/ML medical device field evolves, so too must GMLP best practice and consensus standards.”

Possible Impact & International Considerations

AI and ML are clearly top priorities from a global health regulatory perspective.  The Regulators expect this collaboration to lead to further and broader international collaborative work.  As noted above, the Regulators expect these guidelines to evolve and emphasize the importance of “strong partnerships with [their] international public health partners.”

As one example, the guiding principles identify areas of possible collaboration for the International Medical Device Regulators Forum (“IMDRF”), international standards organizations, and other collaborative bodies.  These areas include “research, creating educational tools and resources, international harmonization, and consensus standards.”

This collaboration is important as it follows on from the individual work each agency has been doing in this space.  For example, MHRA has consulted on the future regulation of medical devices in the UK, including by developing a Work Programme for Software and AI-based Medical Devices (which we previously discussed in our blog post).  FDA has also been active in the AI/ML space, and several more FDA digital health developments are on the horizon for 2022.  Through this international regulatory collaboration it appears the Regulators are working towards a united front through close alignment on best practice and international regimes.  It also shows, for example, that the UK is considering international regimes broadly, rather than simply aligning with the European Union.

In sum, it appears there is an appetite for further international regulatory collaboration, so watch this space for the potential development of more detailed and sector specific international standards and practices for AI/ML-based technologies.