Kelley Kronenberg - In the Know - Business - Q1 2026

EDITOR’S LETTER

WELCOME

Dear Clients and Friends,

Welcome to our latest issue of In the Know: Business Edition. This issue focuses on regulatory compliance at a moment when the rules are changing faster than most businesses realize. The rules governing how you hire, classify, bill, collect data, and structure transactions have been shifting at both the federal and state levels, often in opposite directions.

Federal deregulation has eased some pressures, but state enforcement is filling the gap aggressively. For businesses operating across state lines, that combination creates compliance obligations that are easy to miss and expensive to ignore.

In this issue, our attorneys break down what these changes mean in practice. Our employment team examines the growing divide between federal and state requirements and what employers need to know now. Our health law team covers the latest Medicare telehealth extensions and what healthcare providers must do to stay compliant. Our technology attorneys explain why your company website may be creating litigation exposure you have not considered. On the transactions side, our attorneys address the compliance questions that are making or breaking M&A deals, and what maritime businesses need to understand about new emissions and cybersecurity requirements.

Our product liability attorneys also examine how sweeping new e-bike regulations in New Jersey, New York City, and California are reshaping litigation risk across the chain of distribution, from manufacturers and importers to retailers and insurers, and what those developments signal for the rest of the country.

We also invite you to get to know our attorneys a little better through our Behind the Briefcase feature. This issue spotlights Jason Vanslette, Chair of the firm’s Real Estate Division.

Beyond the articles, the broader message of this issue is straightforward: the companies that navigate this environment successfully are not waiting for an enforcement action to prompt a review. We hope this issue gives you a useful starting point.

Sincerely,

Kelley Kronenberg Business Legal Team

Navigating the New DOL Reality: What Changed in 2025 and What it Means for Your Workforce in 2026

What Actually Changed at the Federal Level

Secretary Chavez-DeRemer announced over 60 proposed regulatory rollbacks in 2025. The DOL proposed eliminating employer reporting requirements for musculoskeletal disorders, limiting OSHA enforcement, and reconsidering wage and hour regulations.

In January 2026, the DOL submitted a new independent contractor rule to the Office of Management and Budget, signaling a return to a simpler two-factor test for classification.

By David Harvey

Florida employers dodged the federal overtime salary increase when a Texas court struck it down in November 2024. The federal threshold stayed at $684 per week, and most Florida companies breathed a sigh of relief.

That relief is premature if you have employees in Illinois, New York, New Jersey, or other states where we’re seeing clients expand operations.

After 30+ years representing Florida employers through regulatory transitions, I can tell you 2025 created a split that’s going to cost unprepared companies significant money in 2026: federal employment regulation is contracting while states where Florida businesses operate are expanding requirements aggressively.

But none of these proposals are final. Most won’t be finalized until late 2026, and litigation will challenge the high-impact changes. Florida employers operating under the assumption that proposed deregulation is already in effect are exposed if courts block implementation or final rules differ from proposals.

The federal white collar overtime exemption pay threshold remains $684 salary per week. That’s good news for Florida-only operations. But five states increased their thresholds effective January 1, 2026, including New York where many Florida companies have sales offices or remote employees.

DOL’s 2026 Enforcement Priorities

The January 15 enforcement announcement reveals where investigators will focus. Health and welfare plan enforcement received significant resources—mental health parity, surprise billing compliance, and cybersecurity protections for benefit plan data. Retirement

plan enforcement continues targeting terminated vested participants and required minimum distributions.

What’s missing? The aggressive wage and hour enforcement that characterized the Biden administration. The DOL is allocating resources toward employee benefits, though wage violations still get investigated when complaints surface (and they will if you’re misclassifying employees in states with higher thresholds).

The Multi-State Problem Florida Companies Face

Florida companies expanding to Illinois, New York, or New Jersey face dramatically different compliance requirements than home-state operations. Your Tampa headquarters operates under Florida law. Your Chicago sales office operates under overlapping Chicago, Cook County, and Illinois requirements. Your New York office faces different overtime thresholds and paid sick leave mandates.

Illinois implemented AI employment law requiring employers to notify employees when AI makes employment decisions and banning use of ZIP codes as proxies for protected characteristics. If you’re using AI recruiting tools (and many Florida companies adopted these during the pandemic hiring surge), your Illinois operations face compliance obligations that don’t exist in Florida. For expanded analysis on this topic, please see my prior article on the risks of AI.

New York’s overtime threshold varies by location and employer size. Misclassify an employee as exempt in your Manhattan office based on Florida assumptions about the federal threshold, and you’re facing back wages, liquidated damages, and penalties under New York law. That $50,000 sales manager you classified as overtime-exempt needs to earn at least $58,500 in New York City to maintain exempt status (and that’s for small employers—larger employers face higher thresholds).

New Jersey has its own paid sick leave requirements. Georgia tracks federal law more closely but has state-specific final pay requirements. Texas and Louisiana provide more employer flexibility, but multi-state operations still require separate compliance tracking.

The Remote Work Complication

Florida employers who hired remote workers during the pandemic face exposure in states where those employees work. Your employee working remotely from Illinois accrues rights under Illinois law even though your company is headquartered in Tampa. Your New Jersey remote worker gets New Jersey paid sick leave. Your New York remote employee requires higher salary to maintain exempt status.

I’m handling cases now where Florida companies classified remote employees as exempt based on Florida assumptions, not realizing the employee’s work state imposed higher salary thresholds. The employee files a wage claim in their home state, and

suddenly the Florida employer is defending a case under that state’s wage laws with penalties that exceed anything Florida law provides.

Remote work didn’t eliminate state law compliance—it multiplied your compliance obligations across every state where employees work. Your HR system built for Florida operations can’t handle this without significant modification.

Independent Contractor Classification Still Uncertain

The DOL ordered staff not to enforce the 2024 independent contractor rule and submitted replacement regulations to OMB in January 2026. Until new rules are finalized, the 2024 six-factor test technically remains on the books despite non-enforcement guidance.

Florida construction companies, hospitality operators, and professional services firms using independent contractors face uncertainty. Federal guidance says one thing, DOL isn’t enforcing it, but courts may still apply the 2024 rule in litigation. State laws (particularly in Illinois and New York) often provide greater worker protections than federal standards.

Conservative classification remains safest. If worker status is questionable, classify as an employee. The cost of misclassification— back wages, benefits, unemployment insurance, workers’ compensation premiums, tax penalties—exceeds any savings from independent contractor treatment.

What January 2026 Opinion Letters Tell Us

The DOL issued opinion letters in January that signal enforcement approach even without finalized regulations.

Opinion Letter FLSA2026-1 confirmed employers may classify employees as nonexempt even when they meet exemption criteria. Florida companies worried about misclassification exposure can treat potentially exempt employees as non-exempt without FLSA violations. This provides a conservative approach that eliminates exemption disputes.

What Florida Employers Need to Do Now

Audit your multi-state exempt classifications. That employee in your New York office who meets federal exemption requirements may be misclassified under New York law. Your Illinois employees may face different thresholds than your Indiana employees. The federal $684 per week provides no protection when state thresholds are higher.

Review remote employee work

locations. Don’t assume remote employees working “for a Florida company” only face Florida law requirements. They accrue rights under the laws of states where they actually work. Document where remote employees work and ensure compliance with those state requirements.

Implement separate tracking for multi-state leave obligations if you have operations in

Illinois or New Jersey. These states have paid leave requirements that don’t exist in Florida, Georgia, Texas, or Louisiana. HR systems that only track federal FMLA can’t handle overlapping state obligations.

Evaluate benefit plan compliance against DOL’s 2026 enforcement priorities. Mental health parity, surprise billing procedures, and cybersecurity protections face heightened scrutiny this year. Florida employers with self-insured plans or who sponsor retirement plans should review practices now before investigators show up.

Document worker classification decisions thoroughly. With federal regulatory uncertainty and aggressive state enforcement, detailed contemporaneous documentation of why you classified workers as employees or independent contractors, exempt or non-exempt, becomes your primary defense when disputes arise.

Don’t implement changes based on proposed DOL rules. The independent contractor rule hasn’t been published for comment. The 60+ deregulatory proposals are in various stages and face certain litigation. Wait for final rules before changing practices, or you’re exposed when courts block implementation or final versions differ significantly.

The Florida Business Reality in 2026

Federal deregulation helps Florida-only operations, but most growing Florida companies have expanded beyond state borders or hired remote workers in other

states. That expansion creates compliance obligations that Florida law doesn’t prepare you for.

Illinois, New York, and New Jersey impose requirements that exceed federal minimums and differ significantly from Florida law. Companies operating in multiple states face fragmented compliance frameworks that can’t be managed with a single national policy built on Florida assumptions.

The DOL shifted enforcement priorities toward employee benefits and away from wage and hour, but state agencies in Illinois, New York, and New Jersey are ramping up enforcement. Your Florida headquarters may face less federal scrutiny, but your Chicago office faces more state scrutiny than ever.

Florida employers navigating 2026 successfully treat multi-state compliance as an ongoing challenge requiring regular review of each state’s requirements, not a federal checklist applied uniformly. The cost of getting this wrong in states with aggressive enforcement and enhanced penalties exceeds the cost of proactive compliance review.

Medicare Telehealth Through 2027: What Healthcare Providers Need to Know About the Latest Extension and Permanent Changes

By Elizabeth Perez and Brandon Thompson

If you’ve been following Medicare telehealth policy over the past few years, you know it’s been a moving target. What started as emergency COVID flexibilities became a series of year-to-year extensions, each one leaving providers wondering if this would be the year telehealth coverage disappeared.

After a brief government shutdown in late January 2026 that temporarily suspended some telehealth flexibilities, Congress passed the Consolidated Appropriations Act of 2026 on February 3, 2026. The good news is that most telehealth flexibilities are now extended through December 31, 2027. Even better news is that some key provisions are now permanent.

Telehealth Extension Through 2027

Medicare patients can now receive telehealth services for non-behavioral and non-mental health care in their home through December 31, 2027. This means your patients don’t need to travel to your office or a designated originating site for routine telehealth visits.

Audio-only telehealth is also extended through December 31, 2027 for nonbehavioral services. This is important for patients who lack video capability or aren’t comfortable with video technology. The statute includes a permanent provision allowing audio-only services if the provider is technically capable of video but the patient either can’t use video or doesn’t consent to it.

For behavioral and mental health services, the rules are even more favorable. Medicare patients can permanently receive these services via telehealth from their home, including through audio-only platforms. There’s no expiration date for mental health telehealth.

One requirement that’s been waived through December 31, 2027 is the in-person visit requirement for behavioral health services. Under pre-pandemic rules, patients needed an in-person visit within six months before their initial telehealth behavioral health visit, and annually thereafter. That requirement remains suspended until the end of 2027.

Permanent Changes to Virtual Supervision

The 2026 Medicare Physician Fee Schedule Final Rule made several significant changes permanent. CMS permanently removed frequency limitations for subsequent inpatient visits, subsequent nursing facility visits, and critical care consultations delivered via telehealth. Before this change, there were limits on how often you could bill these codes when provided through telehealth. Those restrictions are gone.

More significantly, CMS permanently adopted a new definition of direct supervision that includes virtual presence. For services that require direct supervision by a physician or other supervising practitioner, you can now meet that requirement through real-time audio and video technology on a permanent basis. Note that audio-only supervision is not sufficient. You need both audio and video.

This applies to incident-to services under 42 CFR § 410.26, diagnostic tests under 42 CFR § 410.32, pulmonary rehabilitation services under 42 CFR § 410.47, and cardiac rehabilitation and intensive cardiac rehabilitation services under 42 CFR § 410.49.

The one major exception involves surgical procedures. Services with a global surgery indicator of 010 or 090 cannot be provided under virtual direct supervision. These are minor procedures requiring 10 days of postoperative care (010) or major procedures requiring 90 days of post-operative care (090).

What This Means for Your Practice

BEHIND THE

These changes create real operational flexibility. You can supervise diagnostic tests from another location as long as you’re immediately available via two-way audiovideo connection. A physician supervising a nurse practitioner providing incident-to services can do so virtually.

But flexibility doesn’t mean you can be careless about documentation. CMS expects you to document virtual supervision the same way you would document physical presence. Your policies and procedures should specify how virtual supervision works in your practice. You need systems that ensure real-time, two-way audio-video capability whenever you’re providing virtual supervision. And you need to be genuinely immediately available.

Florida-Specific Requirements

If you’re practicing in Florida or providing telehealth services to Florida patients, you need to be aware of state-specific requirements that go beyond Medicare rules.

Out-of-state providers who want to deliver telehealth services to Florida patients must register with the appropriate Florida board or the Department of Health. This registration is in addition to your home state license. You must have an active, unencumbered license in your home state, demonstrate that you haven’t faced disciplinary action in the past five years, designate a registered agent for service of process in Florida, and maintain professional liability coverage that includes telehealth services to out-of-state patients.

Florida also has specific restrictions on prescribing controlled substances via telehealth. You cannot use telehealth to prescribe Schedule II controlled substances unless you’re prescribing for treatment of a psychiatric disorder, inpatient treatment at a licensed hospital, hospice services, or nursing home residents. Schedules III through V can be prescribed via telehealth, but you must still comply with Florida’s controlled substance prescribing requirements.

These Florida requirements apply regardless of what Medicare allows. Medicare might permit something that Florida law prohibits, and in those cases, Florida law controls for Florida patients.

Common Compliance Pitfalls

Based on our experience helping healthcare providers navigate telehealth compliance, here are the mistakes we see most often.

First, providers assume that because Medicare allows something, they’re automatically compliant. But you also need to comply with state law, your professional board’s regulations, and any specific payer requirements.

Second, providers don’t update their policies and procedures to reflect current rules. If your telehealth policy was written in 2021 and hasn’t been updated since, it’s almost certainly out of date.

Third, providers inadequately document virtual supervision. If you’re virtually

supervising someone, document how you maintained real-time audio-video connection, document that you were immediately available, and document any interventions or guidance you provided. If CMS audits you, they need to see evidence that supervision actually occurred.

Fourth, providers don’t properly verify that their technology meets CMS requirements. Real-time two-way audio and video means exactly that. You can’t use asynchronous communication. You can’t use audioonly for services that require audio-video supervision.

Fifth, providers overlook billing location requirements. CMS ended the flexibility that allowed you to bill telehealth services from your home using your practice address. Starting in 2026, if you’re providing telehealth from a location other than your enrolled practice location, you may need to enroll that location separately.

How Kelley Kronenberg Can Help

Our Health Law Division works with physicians, nurses, clinic owners, and other healthcare providers to develop compliant telehealth programs and respond to regulatory challenges. We help you audit your current telehealth practices against both Medicare and Florida requirements. We identify compliance gaps and help you fix them before they become problems. We draft and update telehealth policies and procedures that reflect current law. And when you receive a CMS audit notice or a complaint to your professional board, we provide aggressive defense to protect your license and your practice.

These regulatory changes create opportunities for your practice, but only if you implement them correctly. Getting telehealth compliance wrong can result in Medicare overpayments that you’ll have to refund, potential False Claims Act liability, and disciplinary action from your licensing board.

BEHIND THE

The State Privacy Law Patchwork and Your Litigation Exposure

By Timothy Shields

Most business owners think privacy laws are about customer rights and compliance checklists. They’re not wrong, but they’re missing the bigger picture. State privacy laws have become a litigation minefield, and companies are getting sued for things they didn’t even know were illegal.

Approximately twenty states now have comprehensive privacy laws on the books. Indiana, Kentucky, and Rhode Island joined the club on January 1, 2026. Nine other states amended their existing laws last year. Each state has slightly different requirements for consent, data retention, consumer rights, and enforcement mechanisms. The patchwork is real, it’s growing, and it’s creating litigation exposure that most companies haven’t considered.

But here’s what really keeps me up at night as a technology attorney. The bigger threat isn’t the comprehensive privacy statutes everyone talks about. It’s the older state wiretapping laws that were written decades ago to stop telephone eavesdropping. Courts are now applying those laws to website tracking pixels, chatbots, and session replay

software. Companies are facing class action lawsuits with statutory damages of $1,000.00 per violation, multiplied by thousands of website visitors, plus attorney fees.

If you operate a consumer-facing website, you probably have litigation exposure right now. You just don’t know it yet.

Florida’s Security of Communications Act

Let me explain why Florida matters. The Florida Security of Communications Act has been on the books since 1969. It was designed to protect telephone conversations from unauthorized recording. For years, courts said it didn’t apply to modern website technologies.

That changed in March 2025. A federal court in the Middle District of Florida ruled that the FSCA applies to tracking pixels embedded in healthcare websites. The case involved a hospital system that used Meta and Google pixels on its patient portal. When patients searched for information about symptoms or treatments, the pixels allegedly captured and transmitted that data to third parties without patient consent.

The court said those transmissions could violate the FSCA. The case survived a motion to dismiss and is moving forward. Since then, we’ve seen a surge of similar lawsuits filed in Florida courts.

Magenheim v. Nike was filed in December 2025 in the Southern District of Florida.

The plaintiffs claim Nike triggered tracking technologies on visitors’ browsers immediately upon visiting the website, before users could review privacy disclosures or provide consent. The lawsuit seeks class certification for all Florida visitors to Nike’s website over the past two years.

Cobbs v. PetMed Express involves an online veterinary pharmacy. Plaintiffs allege that tracking tools intercepted URLs, search queries, email addresses, and phone numbers related to prescription browsing and purchases. This case highlights the litigation risk when sensitive data like health or prescription information is involved.

These cases follow a pattern we saw first in California under the California Invasion of Privacy Act. California has been ground zero for pixel-based wiretapping litigation for the past few years. Plaintiffs’ attorneys have filed hundreds of cases alleging that website tracking technologies violate CIPA by intercepting communications without allparty consent.

Now they’re bringing the same playbook to Florida. And to Pennsylvania. And Washington. And Massachusetts. Any state with an old wiretapping statute that requires all-party consent for intercepting communications is fair game.

Why This Matters for Your Business

The statutory damages under the FSCA are significant. Any person whose communication is intercepted in violation of

the statute can recover damages of $100.00 per day for each day of violation, with a minimum recovery of $1,000.00. Plaintiffs can also seek punitive damages, attorney fees, and injunctions.

Do the math. If 10,000 people visit your website in a month and your tracking pixels allegedly violate the FSCA, you’re looking at potential statutory damages of $10 million before you even get to punitive damages or attorney fees. That’s why these cases get filed as class actions. The potential damages are enormous even if no one suffered actual harm.

The plaintiffs’ bar learned this model works from other statutes with similar damages provisions. The Telephone Consumer Protection Act generated thousands of class actions over robocalls and text messages. The Illinois Biometric Information Privacy Act created massive litigation over fingerprint scanners and facial recognition. Now state wiretapping statutes are the new frontier.

Companies settle these cases not because they believe they violated the law, but because the cost of defending a class action through trial exceeds the settlement value. That’s the business reality.

What Courts Are Looking At

The legal issue boils down to a few questions. First, does the tracking technology “intercept” a communication? Courts are split on whether capturing data transmitted between a user’s browser and a website

BEHIND THE

server qualifies as an interception. Some courts say yes if a third-party tool captures the data. Others say no if the website owner authorized the tool to collect data on its behalf.

Second, does the captured data constitute the “contents” of a communication? This matters because wiretapping statutes typically distinguish between contents (protected) and routing information like phone numbers or email addresses (less protected). Plaintiffs argue that URLs containing search queries, form inputs, and page navigation constitute contents. Defendants argue they’re more like address information.

Third, did the website visitor consent to the interception? This is where privacy policies, cookie banners, and terms of service come into play. The problem is that most privacy policies use browsewrap disclosures. The terms are available somewhere on the website, usually in the footer, but users don’t have to click “I agree” before the tracking starts.

Courts increasingly prefer clickwrap agreements where users must affirmatively click to accept terms before the tracking begins. Plaintiffs argue that browsewrap disclosures don’t demonstrate actual consent, especially when tracking starts before users have any opportunity to review the privacy policy.

The fourth question is whether the thirdparty tracking company is acting as an agent

of the website or as an independent party. If Meta or Google is acting as the website’s agent when collecting data through pixels, there’s no “interception” by a third party. But if they’re collecting data for their own purposes beyond just providing analytics to the website, they might be independent parties whose access constitutes an interception.

Courts are all over the map on these questions. That’s the problem with a patchwork of state laws written before the internet existed. Different judges in different jurisdictions reach different conclusions about the same technology.

Other States with Similar Exposure

Florida isn’t unique. California’s CIPA requires all-party consent for intercepting communications. Pennsylvania’s Wiretapping and Electronic Surveillance Control Act has similar provisions. Washington’s Privacy Act includes wiretapping protections. Massachusetts has a wiretap statute. New Hampshire does too.

Each state’s law has slightly different language, which means slightly different legal arguments, which means slightly different outcomes. A tracking pixel configuration that survives a motion to dismiss in one jurisdiction might get thrown out in another.

Companies operating nationwide can’t tailor their website differently for each state. You can’t show different tracking to California visitors than Florida visitors than Pennsylvania visitors. It’s technically possible but

operationally absurd. So, companies either track everyone the same way and accept the litigation risk, or they disable tracking for everyone and lose valuable business intelligence.

Most companies choose the first option because they don’t realize the litigation risk exists until they get sued.

The Comprehensive Privacy Law Connection

Here’s where it gets more complicated. While companies are fighting wiretapping lawsuits over tracking pixels, they also have to comply with comprehensive privacy laws that require transparency about data collection.

Approximately twenty states now have comprehensive privacy laws. These laws generally require:

• Clear privacy notices explaining what data is collected and how it’s used.

• Consumer rights to access, delete, and correct their personal data.

• Opt-out mechanisms for targeted advertising and data sales.

• Data protection assessments for high-risk processing activities.

• Contracts with third-party processors specifying how data can be used.

The comprehensive laws don’t create private rights of action. Only state attorneys general can enforce them. But noncompliance with these laws strengthens plaintiffs’ arguments in wiretapping cases. If your privacy policy doesn’t accurately describe your tracking practices, plaintiffs will point to that as evidence you’re hiding what you’re doing.

More importantly, the state privacy laws create expectations about consent and transparency that courts consider when interpreting older wiretapping statutes. When a court asks whether a website visitor consented to tracking, the existence of detailed consent requirements in new privacy laws influences how judges think about what counts as consent under old wiretapping laws.

The two bodies of law are converging to create a compliance environment where anything less than explicit, affirmative, informed consent before tracking begins is legally risky.

What You Should Do Now

If you have a consumer-facing website with any third-party tracking technologies, you need to audit your setup. This isn’t just about compliance with comprehensive privacy laws. This is about avoiding class action litigation.

Start by inventorying every third-party tool on your website. Google Analytics, Meta Pixel, TikTok Pixel, Hotjar, session replay software, chatbots, customer service platforms. Any tool that collects data about

user behavior or transmits data off your website needs to be documented.

BEHIND THE

Review what data each tool collects. Is it just aggregate traffic statistics? Or is it capturing search queries, form inputs, page content, personally identifiable information? The more sensitive the data, the higher the litigation risk.

Check your consent mechanism. Do you have a browsewrap policy in the footer? A cookie banner that loads after tracking already started? Or do you have a clickwrap agreement that blocks tracking until users affirmatively consent?

Update your privacy policy to accurately describe all tracking that occurs on your website. Generic language about cookies and analytics isn’t enough anymore. You need to specifically disclose what third-party tools you use, what data they collect, and what those third parties do with the data.

Review your contracts with third-party vendors. Do your agreements specify that vendors are acting as your agents? Do they restrict how vendors can use data collected from your website? If not, plaintiffs will argue the vendors are independent parties whose data collection constitutes interception.

Consider implementing a more robust consent mechanism. This might mean a cookie banner that actually blocks tracking until users click accept. Or a clickwrap agreement before users can access certain parts of your website. Or removing tracking

from pages that handle sensitive information like health data or financial information.

These changes won’t eliminate litigation risk entirely. But they significantly improve your position if you do get sued. Courts are more likely to dismiss claims when websites have clear disclosures, meaningful consent mechanisms, and contractual controls over third-party data use.

Industry-Specific Considerations

Healthcare providers face the highest risk. Any website or patient portal that tracks queries about symptoms, treatments, diagnoses, or prescriptions is a target. The combination of health data and tracking pixels is exactly what courts find most problematic.

Financial services companies are close behind. Tracking related to loan applications, credit checks, account access, or financial planning raises similar concerns.

Retailers selling age-restricted products like alcohol or adult products need to be careful. Tracking purchase history or browsing behavior for sensitive products creates litigation exposure.

Education technology companies should pay attention. Student data triggers additional protections under laws like FERPA, and tracking students’ online activities can create wiretapping claims.

But honestly, any company with a consumerfacing website has exposure. I’ve seen cases

involving athletic apparel, pet supplies, home improvement retailers, and general e-commerce platforms. The plaintiffs’ bar isn’t limiting itself to obviously sensitive industries.

The Role of State Attorneys General

While private plaintiffs are driving wiretapping litigation, state attorneys general are enforcing comprehensive privacy laws. Several states have announced enforcement priorities for 2026.

California’s Privacy Protection Agency is focused on data broker compliance and has issued warning letters to brokers who haven’t properly registered. The agency is also scrutinizing companies’ responses to consumer data deletion requests.

Connecticut expanded its privacy law definition of sensitive data to include neural data. The state is signaling it will investigate companies using brain-computer interfaces or neurotechnology.

Virginia and Texas added protections for minors’ data and prohibited certain data processing for users under 16. Expect enforcement actions against companies that target advertising to teens or collect data from children without proper consent.

State AG enforcement doesn’t directly create litigation exposure the way private class actions do. But enforcement actions damage companies’ reputations and provide ammunition for private plaintiffs. If a state AG

finds your privacy practices lacking, expect a wave of class action complaints shortly after.

Looking Forward

The state privacy law patchwork isn’t going away. Congress has shown no appetite for federal privacy legislation that would preempt state laws. The Trump administration’s executive order on AI included language about preventing state-level regulation, but that’s focused on AI specifically, not general privacy law.

More states will pass comprehensive privacy laws. Massachusetts, Georgia, Pennsylvania, and other states have bills pending for 2026 legislative sessions. Each new law will have slightly different requirements, making the compliance burden heavier.

More importantly, plaintiffs’ attorneys will continue finding creative ways to apply old statutes to new technologies. The FSCA litigation surge in Florida is just getting started. Pennsylvania will be next. Then Washington. Then Massachusetts. Any state with an allparty consent wiretap statute is a potential venue.

Companies can’t wait for enforcement actions to drive compliance. By the time you get sued, your litigation costs will dwarf what you would have spent on proactive compliance. This is one area where an ounce of prevention really is worth a pound of cure.

Our Approach to Privacy Compliance

BEHIND THE

At Kelley Kronenberg, we work with companies to navigate this patchwork of state privacy laws and minimize litigation exposure. My background in technology and software development helps me understand exactly how tracking works and what data is actually being collected. That technical knowledge is critical when assessing legal risk.

For healthcare providers and financial services companies facing heightened scrutiny, we coordinate with our Health Law Division and Financial Services Team to address industry-specific regulations alongside privacy compliance. This collaborative approach ensures we’re considering HIPAA requirements, GLBA obligations, and sector-specific disclosure rules when evaluating your litigation exposure and developing compliance strategies.

We conduct privacy audits that go beyond just reading your privacy policy. We actually test your website to see what data is being collected, when tracking starts, how thirdparty tools are configured, and whether your privacy disclosures match reality.

We help companies implement consent mechanisms that satisfy both comprehensive privacy law requirements and reduce wiretapping litigation risk. This isn’t one-size-fits-all. The right approach depends on your business model, your industry, your customers, and your risk tolerance.

If you’re already facing a demand letter or a filed complaint, we defend those cases. I’ve worked on several FSCA cases and similar claims under other state wiretap statutes. Understanding the technology is critical to mounting an effective defense.

The bottom line is this. If you have a consumer-facing website with third-party tracking, you have litigation exposure. The question isn’t whether the risk exists. The question is how much risk you’re willing to accept and what steps you’ll take to minimize it.

This is the new reality of doing business online in 2026. State privacy laws aren’t just about compliance. They’re about litigation risk management. Companies that understand this and act accordingly will be in far better shape than companies that wait for a lawsuit to force their hand.

If you want to discuss your specific situation, reach out. This is exactly the kind of problem we help businesses solve every day.

BEHIND THE

Navigating OSHA’s Mixed Signals: What Construction Contractors Must Do Now in 2026

By Gary Brown

OSHA is sending construction contractors contradictory messages in 2026. The agency is conducting aggressive heatrelated inspections and raising penalties while simultaneously proposing to eliminate dozens of regulations and narrow its enforcement authority. For contractors trying to stay compliant, this creates confusion about where to focus limited resources and safety budgets.

Here’s how to cut through the noise and focus on what actually matters.

The Enforcement Paradox

Maximum OSHA penalties jumped to $16,550.00 per serious violation and $165,514.00 for willful and repeat violations on January 15, 2025. At the same time, OSHA published 25 proposed deregulatory rules on July 1, 2025, aimed at eliminating or revising outdated requirements.

This reflects competing priorities within the agency. OSHA extended its National Emphasis Program on heat hazards through April 8, 2026, targeting construction sites for proactive inspections. But simultaneously, the agency proposed limiting the General Duty Clause to exclude hazards “inherent and inseparable” from certain work.

The reality? Heat enforcement is aggressive right now, regardless of deregulation proposals. Construction remains a highpriority sector for inspections, particularly in high-temperature environments, a significant concern for Florida contractors facing extended periods of extreme heat and humidity.

What’s Actually Changed vs . What’s Just Proposed

Not all OSHA announcements carry the same weight. Some changes are already in effect; others are proposals you can still influence.

Already in Effect:

PPE Proper Fit (January 13, 2025):

Construction employers must ensure PPE (Personal Protective Equipment) properly fits each employee. Ill-fitting equipment can be cited as noncompliant. Review your inventory for size inclusivity, test gear with workers, and document fit assessments.

Still Pending:

Heat Illness Prevention Standard: Public hearings concluded July 2, 2025. The initial

public comment period closed January 14, 2025, and the post-hearing comment period for those who submitted Notices of Intention to Appear closed October 30, 2025. As of February 2026, no final rule has been issued. The proposed rule requires written heat prevention plans, monitoring when temperatures exceed 80°F, and additional protections above 90°F.

Deregulatory Changes: The July 2025 proposals include removing medical evaluation requirements for certain respirators, eliminating construction illumination standards, and providing greater flexibility in respirator selection for 16 substance-specific standards (asbestos, benzene, lead, formaldehyde, and others). The public comment period for most of these proposals closed in early September 2025, but no final rules have been issued as of February 2026.

General Duty Clause Limitation: The proposal to narrow OSHA’s General Duty Clause authority could reduce citations for certain inherent workplace risks, though its construction applications remain unclear. This remains a proposal awaiting finalization.

Construction-Specific Action Plan

1 . Heat Illness Prevention (Act Now)

Don’t wait for the final rule. OSHA is citing heat violations under the General Duty Clause right now. Florida’s climate makes this particularly urgent; summer temperatures regularly exceed both proposed thresholds.

Develop a written heat prevention plan that includes:

• Heat index monitoring protocols for days exceeding 80°F

• Rest break procedures and shade access when temperatures exceed 90°F

• Hydration requirements (water readily available, not just during breaks)

• Acclimatization programs for new and returning workers—most heat deaths occur in the first three days

• Supervisor training on recognizing heat stress symptoms

Document everything. If OSHA shows up during a heat wave, you need proof of your prevention efforts. These protocols also intersect with workers’ compensation exposure—heat-related injuries can result in significant claims if prevention measures aren’t documented and enforced.

2 . PPE Compliance Audits

This requirement is already in effect. Conduct a systematic review:

• Inventory current PPE sizes and styles

• Identify employees whose equipment doesn’t fit properly

• Order additional sizes or alternative styles as needed

• Document fit testing, especially for women and workers with non-standard body types

• Train supervisors to spot ill-fitting equipment during site inspections

The compliance cost is minimal, but the citation risk is real, and the penalty will exceed the cost of prevention efforts.

3 . Penalty Relief

Businesses can mitigate penalties by taking immediate steps. Most importantly, proactive measures and prompt and accurate record keeping can be your best tools:

• Maintain documentation showing no serious, willful, or failure-to-abate violations in the past five years

• Maintain written safety and employee enforcement policies

• Keep organized safety meeting records, training certificates, inspection reports, and records of past employee enforcement

4 . Monitor Pending Rules

While the comment periods for most deregulatory proposals have closed, keep tracking these rulemakings as they move toward finalization. The heat illness prevention standard, in particular, could be issued at any time in 2026. Subscribe to OSHA updates and Federal Register notifications to stay informed about final rule publications.

Multi-State Operations and State Divergence

Many Florida-based contractors operate across state lines. Federal deregulation doesn’t mean state-plan states will follow suit. California must adopt its workplace violence prevention regulation by December 31, 2026. New York passed similar legislation for healthcare facilities, effective September 2026.

If you work in California, Oregon, Washington, or other state-plan jurisdictions, track statespecific requirements. State agencies may maintain or add regulations even as federal OSHA scales back. Contractors working across state lines need coordination between OSHA compliance, risk management, and legal teams to avoid gaps in coverage.

Practical Compliance Shortcuts

The deregulatory proposals, if finalized, could offer genuine relief in some areas:

Respirator Flexibility: If finalized, the proposed changes would allow different respirator types for lead, asbestos, benzene, cadmium, formaldehyde, and 11 other substances. You could choose equipment that’s more comfortable, less expensive, or better suited to your specific work conditions while maintaining protection levels.

Reduced Medical Evaluations: Eliminating medical evaluations for Filtering Facepiece Respirators (FFRs) and loose-fitting Powered Air-Purifying Respirators (PAPRs) would cut

administrative burden without compromising safety. Fit testing, training, and other respiratory protection requirements would remain in place.

Streamlined Substance Standards: Many proposed changes would remove duplicative requirements that already exist in the general Respiratory Protection Standard.

Where OSHA Will Focus Despite Deregulation

Expect continued enforcement pressure in these areas:

• Heat-related hazards (extended emphasis program through April 8, 2026)

• Fall protection

• Scaffolding violations

• Ladder safety

• Electrical hazards

• Trenching and excavation

Construction accounted for over 20% of workplace fatalities in 2023 (up 2% from 2022). Falls, slips, and trips accounted for 39.2% of all construction fatalities. OSHA won’t reduce scrutiny on the biggest killers.

The Integrated Approach

OSHA compliance doesn’t exist in a vacuum. Heat illness prevention intersects with workers’ compensation claims management; documented prevention programs can reduce both injury frequency and claim severity. PPE compliance affects both regulatory exposure and potential

liability in personal injury claims. Penalty structures impact financial planning and risk assessment.

Effective compliance requires coordination across disciplines: construction law and OSHA for regulatory interpretation, workers’ compensation for claims management, risk management for insurance coverage analysis, and employment law for workforce policies.

This approach ensures you’re protecting your business from exposure on multiple fronts: regulatory, contractual, and financial.

The Bottom Line

OSHA’s mixed signals require a practical response: implement heat safety now, audit PPE fit immediately, and monitor pending rulemakings that could affect your operations. Don’t assume deregulation means reduced enforcement. Heat inspections are happening, penalties have increased, and construction remains a priority sector.

Focus your resources on what’s actually enforceable (heat prevention and PPE fit) while monitoring proposed changes that could reduce compliance burden once finalized. If you operate across multiple states, pay attention to state-federal divergence.

The fundamentals haven’t changed: protect your workers, document your efforts, and stay informed about which rules actually

apply. When compliance questions arise that touch on workers’ compensation exposure, contractual risk allocation, or insurance coverage, coordinating across legal disciplines helps ensure nothing falls through the cracks.

Our OSHA team routinely counsels employers on OSHA compliance matters and welcomes inquiries.

Considerations for Today’s Regulatory Due Diligence

By Angelo Gasparri

The regulatory environment for mergers and acquisitions has evolved considerably. After years of intensifying federal oversight and ongoing compliance requirements, we’re seeing a recalibration of enforcement priorities. Federal pressure is easing in some areas, but state-level activity is accelerating. Small and mid-sized business owners contemplating M&A transactions should consider the changing landscape and be ready to confront these shifting priorities. Regulatory due diligence is no longer a checkbox exercise. It’s become a value driver that can make or break your deal. Over my three decades advising on acquisitions, restructuring, and complex transactions, I’ve seen firsthand how regulatory blind spots

can eliminate the opportunity and destroy the benefits of a promising transaction. The difference between a smooth closing and a derailed transaction often comes down to seven questions that most business owners aren’t asking early enough.

The Shifting Federal Landscape

The continued focus on a deregulatory agenda has reshaped federal antitrust enforcement. The FTC and DOJ have moved away from an aggressive litigationfirst approach that characterized the prior administration. Early terminations of HartScott-Rodino waiting periods have returned, and agencies are more willing to accept remedies and settlements rather than block deals outright.

This sounds like good news for dealmakers; transactions that would have faced prolonged challenges are moving forward. The “10 for 1” executive order requiring agencies to identify ten existing regulations for repeal when proposing a new one signals a fundamental shift in regulatory philosophy, which reflects the general Laissez Faire approach.

But this shift hasn’t made regulatory due diligence less important. It’s made it more nuanced and harder to navigate. While federal merger review may be more predictable, state attorneys general have stepped into the void with unprecedented vigor. States like Washington, Colorado, and New York have enacted their own merger notification requirements. Multi-state enforcement actions are becoming the norm, not the exception.

The result? You may clear federal review smoothly only to find yourself entangled in state-level challenges that delay closing for months. The regulatory risk hasn’t disappeared. It’s just fragmented across multiple jurisdictions.

The State-Level Enforcement Surge

If federal deregulation is the headline, statelevel enforcement is the story that matters for most middle-market transactions. States aren’t waiting for Washington to act. They’re building their own enforcement capabilities and showing little hesitation in using them.

Data privacy provides the clearest example. As of January 2026, twenty states have comprehensive consumer privacy laws in effect. Indiana, Kentucky, and Rhode Island just joined this group at the start of the year. More significantly, nine states amended their existing privacy laws in 2025 to broaden protections, tighten enforcement, and eliminate cure periods. California continues to lead with expanded data broker registration requirements that took effect in August 2025, including mandatory disclosure of whether personal data is sold to foreign actors, government entities, or AI developers.

For M&A transactions, this creates a minefield. A company operating in multiple states must comply with a patchwork of differing requirements for consumer consent, data retention, breach notification, and opt-out mechanisms. Many middlemarket companies haven’t mapped their data

flows, don’t know which state laws apply to them, and have no documented compliance program. When this surfaces during diligence, it triggers price adjustments, escrow requirements, or representations and warranties insurance premium increases if insurers will even provide coverage.

Employment compliance presents similar challenges. At least 19 states increased minimum wages on January 1, 2026, with rates hitting or exceeding $15 per hour for the first time in six states. More importantly, states are enacting vastly different requirements for worker classification, pay transparency, paid leave, and workplace safety. California alone enacted more than a dozen new employment laws effective January 2026, covering everything from expanded crime victim leave and use of AI hiring to “stay-or-pay” training agreements.

The compliance burden for companies operating across state lines has become staggering. And during M&A due diligence, these exposures surface quickly. Buyers are asking pointed questions about worker classification, wage and hour compliance, and paid leave policies because they know that inheriting employment violations is one of the easiest ways to destroy deal value.

The Seven Questions Every Business Owner Must Answer

As you prepare your due diligence plan, here are seven essential questions to consider. If you can’t answer these confidently, you may not be ready for the scrutiny that comes with a serious buyer or a competitive process.

1. What laws and regulations apply to your business today, and how will they change in the next 24 months?

This seems basic, but most business owners can’t provide a complete answer. They know their industry regulations but often miss cross-cutting requirements in areas like data privacy, employment, environmental compliance, and consumer protection. The regulatory landscape is evolving rapidly, and what was compliant last year may be problematic today.

One hidden challenge in this area is that we are seeing a large number of different delivery configurations within legacy industries. For example, Med Spas or online retailers of pharmaceuticals frequently believe they are insulated from compliance with certain regulation by using outsourced or contracted services, but this is simply not true and can lead to some surprises if not properly addressed.

Start by conducting a regulatory inventory across all jurisdictions where you operate. Include federal, state, and local requirements. Then project forward: what’s changing? New state privacy laws? Employment law amendments? Industry-specific regulations? Buyers will ask this question, and if you can’t answer it, they’ll assume worst-case scenarios in their valuation models.

Data breaches and privacy failures have become the top deal-killers in M&A transactions. Last year, I represented a company in bankruptcy after a cybersecurity breach created a cascade of operational and financial chaos. They had been victimized by a notorious hacker, and they ended up paying the price. The breach had taken place more than a year prior to the actual discovery. You end up with overwhelming liability for an outsider’s bad actions, yet the company bears the full burden of response costs, regulatory penalties, and reputational damage.

Every company with an online presence should treat cyber insurance as mandatory, not optional. But insurance alone isn’t enough. You need documented cybersecurity protocols, incident response plans, vendor due diligence, and regular vulnerability assessments. You need to know what consumer data you’re collecting, where it’s stored, how long you retain it, and whether you’re complying with state-specific requirements for consent and deletion requests.

If you’ve had a breach of any magnitude be proactive in disclosing it.

3. Are employment practices compliant with current state requirements?

2. Is there a data privacy or cybersecurity issue lurking under the surface?

Worker classification issues, wage and hour violations, and inadequate leave policies are among the most common liabilities inherited post-closing. They’re also the easiest for sellers to fix before going to market.

Conduct an employment audit that covers: worker classification (especially 1099 contractors), overtime exemptions, pay equity, paid leave policies, meal and rest breaks, and workplace safety training. Pay special attention to multi-state operations where different state laws may apply to different employee populations.

Document everything. Buyers will request employment agreements, contractor classifications, wage and hour policies, leave administration records, and safety training logs. If you can’t produce these quickly, it signals poor compliance infrastructure and triggers deeper scrutiny.

4. Are there outstanding government filings, notices, warnings, or enforcement risks?

Any history of regulatory contact creates disclosure obligations and due diligence inquiries. This includes OSHA inspections, environmental notices, consumer complaints, data breach notifications, tax disputes, or industry-specific regulatory communications.

Compile a complete regulatory history. For each contact, document: the issue raised, your response, current status, and any ongoing obligations. If matters are unresolved, develop a remediation plan before going to market. Buyers will discover these issues regardless, so controlling the narrative by disclosing proactively is always the better approach.

5. Are marketing, advertising, or consumerfacing statements legally compliant?

The FTC and state attorneys general have signaled continued focus on consumer protection, including advertising claims, subscription practices, and privacy policies. Companies making health claims, environmental claims, or using words like “natural” or “sustainable” face heightened scrutiny.

Review all consumer-facing materials: website copy, social media, advertising, packaging, terms of service, and privacy policies. Ensure claims are substantiated and that privacy policies accurately reflect your actual data practices. Inconsistencies between privacy policies and actual practice create significant liability during diligence.

6. Is documentation strong enough to survive buyer or regulator scrutiny?

Buyers have become increasingly skeptical of verbal assurances. They want documented proof of compliance: written policies, training records, audit trails, board minutes, vendor contracts, and regulatory filings.

The expanded Hart-Scott-Rodino filing requirements that took effect in 2024 remain in place, requiring substantially more disclosure at the outset of merger review. While the Trump administration FTC is triaging deals more efficiently and granting early terminations where appropriate, they’re still using this expanded information to identify problem transactions quickly.

This means documentation standards have risen permanently. You need written

policies, not just practices. You need audit trails, not just good intentions. You need vendor contracts that include appropriate indemnification and data protection terms. If you can’t produce this documentation quickly during diligence, buyers will assume compliance failures and adjust pricing accordingly.

7. If the deal fails regulatory review, what is your contingency plan?

Most middle-market transactions won’t trigger extended regulatory review, but you still need a Plan B. This includes: reverse break-up fee provisions, outside date protections, regulatory cooperation obligations, and fall-back buyer strategies.

More importantly, consider integration risk. Are you inheriting compliance weaknesses that will require immediate attention postclosing? Budget for this. Build it into deal structure. Address it in representations and warranties or through escrow holdbacks.

What This Means for Your Business

Whether you’re a seller preparing for exit or a buyer pursuing acquisition opportunities, the new regulatory landscape demands a more sophisticated approach to due diligence. The federal government’s shift toward deregulation hasn’t reduced compliance risk. It’s simply relocated it to state and local levels where enforcement is more fragmented and harder to predict.

The businesses that will succeed in this

environment are those that treat regulatory compliance as a strategic asset, not a necessary evil. They invest in documentation, conduct regular compliance audits, and address issues proactively rather than reactively.

A modest investment in pre-deal compliance review (typically a fraction of what you’d spend on financial due diligence) can prevent significant post-closing costs and protect deal value. More importantly, it positions you to move quickly when the right opportunity emerges.

The regulatory landscape will continue evolving throughout 2026. Early planning protects value and speeds up closing. The question isn’t whether regulatory due diligence matters. It’s whether you’re prepared to answer the questions that buyers are now asking. Having worked through this transition with numerous clients over the past year, I can tell you that the companies getting deals done efficiently are the ones asking these seven questions long before they sit down with potential buyers. inspections and raising penalties while simultaneously proposing to

Emerging E-Bike Regulations Trigger Downstream Litigation Consequences

for Product Manufacturers and Retailers

By James S. Coons and David A. Gonzalez

The e-bike industry has steadily grown in recent years and is expected to continue, driven by practicality, social and market incentives toward sustainable urban mobility, lithium-ion battery applications, and government policy. As the market for these products has grown, so too have the number of e-bike accidents and subsequent litigation. Inevitably, local and state authorities have responded to these trends with new laws aimed at safety and accident prevention, forcing product manufacturers and stakeholders throughout the chain of distribution to navigate a new landscape of rules and regulations affecting their business and litigation risks. Two such developments are noteworthy and carry the prospect of adoption and expansion by other cities and states.

New Jersey’s New E-Bike Classification Statute, P . L . 2025, c . 285

In January 2026, New Jersey signed into law what may be the most comprehensive e-bike legislation in the country, significantly expanding licensing, registration, insurance and compliance requirements. Prompted, in part, by a fatal New Jersey e-bike accident involving a 13-year old boy in the Fall of 2025, state lawmakers prioritized e-bike legislation to address data that shows a rapidly growing number of annual e-bike injuries with a significant portion of these injuries involving young people, many of whom had not previously been licensed to operate motor vehicles or exposed to any motor vehicle safety instruction or training. National data indicates a steep upward trend in e-bike injuries and fatalities, especially since 2019, and an increase in the severity of the reported injuries due to the high-speed factors at play with e-bikes.

Regulation of E-Bike Motors and Batteries

in New York City (N .Y .C . Local Law No . 39 of 2023) and California (SB 1271)

In 2023, New York City enacted its own targeted micromobility safety regulations, specifically requiring such products to exclusively contain UL-certified electrical systems and batteries. In only a few years, these regulations have been prominently featured in pleadings and expert opinions, specifically in e-bike fire lawsuits. Similarly, as of January 1, 2026, California now requires

all new e-bicycle batteries and charging systems sold or leased in California to be certified by an accredited laboratory to meet UL and EN safety standards – and those batteries are required to display certification logos demonstrating compliance.

Challenges facing Manufacturers

The material changes in how e-bikes and their component parts are being regulated in states like NJ, NY and CA are likely to shift various aspects of the product-liability landscape and preview similar if not more stringent legislation to be adopted by other states in the nation.

For manufacturers of these products, the regulatory compliance and litigation implications are certain to affect their approach to research, development and testing with respect to elevated minimum standards and foreseeable use. With higher safety standards and expectations, courts are likely to apply motor vehicle analysis to e-bike-related litigation, scrutinizing the risk/ utility of e-bike braking systems, lighting and visibility, battery safety and compliance, and stability at higher speeds, along with the marketing representations and warnings promoting and advising consumers of these features.

We can anticipate that plaintiffs will seek to capitalize on these stringent standards with more product liability claims centered around manufacturers’ obligations to design, test and market their e-products in consideration of traditional motor-vehicle safety principles. In the New York City battery context,

failure to include a UL-certified electrical system or battery can trigger negligence per se exposure based on violation of a safety standard. While the New York City regulation technically applies to retail sales, plaintiffs are likely, if not certain, to attack the entire chain of distribution, including manufacturers, assemblers, distributors, importers, retailers and online sellers.

On the other hand, manufacturers and retailers will have a variety of new defenses in such cases; specifically, comparative fault of the end-users focused on illegal operation without meeting the minimum age requirement and absent the required licensing, registration and liability insurance. Moreover, illegal modification issues will expand product misuse defenses as several existing regulations already explicitly prohibit speed-enhancing modification kits or software modifications to manipulate original throttle and governor limitations, highly relevant to any manufacturer’s or seller’s defense of a product liability claim.

In New York City, manufacturers implementing UL-certification into their products can rely on regulatory safe harbor defenses by showing compliance with the new state regulations, recognized industry safety standards, design-conformity with known lithium-ion fire mitigation standards, and appropriate labeling and warning communications to end-users.

motor-vehicle-style laws we can anticipate will expand and be implemented in city and state-level oversight across the United States. The wide-sweeping implications signal an evolution in this product market and the standards on which these products will be evaluated and scrutinized in both the marketplace and the courthouse.

Inconsistent and evolving state rules and regulations create a patchwork of often conflicting requirements that pose significant challenges to manufacturers operating on a national level. Evaluating state-by-state requirements and the varying degrees of legal exposure associated with each, manufacturers are often faced with difficult decisions on how to balance production efficiency and profitability against risk and exposure, all while not hindering innovation and the next generation of products.

Increasing regulation in the e-bicycle space, and in the micromobility market at large, demonstrates a rapid shift from light-touch pilot programs to rigorous

On one hand, manufacturers can choose to produce multiple product lines that are customized to comply with specific regional regulations, often creating a variety of operational inefficiencies and additional costs associated with supply chain logistics and distribution. Alternatively, manufacturers can opt to “over-design” and make the most restrictive version of their product ensuring compliance across a national market, often generating higher production costs and unnecessary complexity with many overdesigned products being sold into markets with no existing mandates for such product features.

Whether a manufacturer, seller, or insurer of such entities, all stakeholders in the e-bike space will require their counsel to have a strong grasp of these new products’ innovative technology, ongoing efforts in research and development, the effect of new laws and regulations on those investments, and deep and long experience in product liability litigation, counseling on consumer warnings and instructions, and regulatory compliance.

Kelley Kronenberg’s Product Liability and Regulatory Compliance Attorneys have extensive experience navigating evolving product standards and regulations, and advising stakeholders at every phase in the chain of development and distribution. For guidance on these regulatory developments, or any other product concerns, contact our team.

Maritime Compliance in 2026

By Robert Kritzman

The maritime industry is navigating through one of the most significant regulatory transformations in decades. Two parallel tracks of requirements are reshaping operations for vessel owners, cruise lines, and maritime businesses with exposure to

U.S. and European waters. The first involves ambitious greenhouse gas emissions reduction targets. The second centers on cybersecurity mandates that treat digital threats as seriously as physical security risks.

For business owners with maritime operations or those considering vessel acquisitions, understanding these regulatory shifts is not optional. They directly impact operational costs, vessel values, insurance requirements, and transaction structures.

Emissions Regulations Come into Force

The International Maritime Organization’s revised GHG Strategy, adopted in 2023, set aggressive targets for reducing greenhouse gas emissions from international shipping. The strategy calls for net-zero emissions by 2050, with interim checkpoints requiring at least a 20 percent reduction by 2030 and at least 70 percent by 2040, compared to 2008 levels.

These targets moved from aspiration to binding obligation in April 2025, when the IMO’s Marine Environment Protection Committee approved the Net-Zero Framework. The framework combines two enforcement mechanisms: a global fuel standard requiring ships to reduce their annual greenhouse gas fuel intensity over time, and a pricing mechanism that requires vessels emitting above certain thresholds to acquire remedial units.

The IMO framework was scheduled for formal adoption in October 2025, but the adoption session was adjourned until 2026 to

allow for additional review. This delay pushes the earliest possible entry into force of these regulations to around March 1, 2028. The delays in implementation do put the interim checkpoints in jeopardy but the net-zero requirement for 2050 remains. The rules apply to ocean-going vessels over 5,000 gross tons.

European Requirements Move Faster

While global regulations work through the adoption process, European requirements are already in effect. The EU’s FuelEU Maritime regulation took force on January 1, 2025. It sets maximum limits for the yearly average greenhouse gas intensity of energy used by ships above 5,000 gross tons calling at European ports, regardless of flag.

Companies began monitoring and reporting data on January 1, 2025. The first FuelEU reports were due to verifiers on January 31, 2026, covering the 2025 calendar year. Compliance balances must be approved by April 30, 2026, with Documents of Compliance required onboard by June 30, 2026.

The intensity targets started with a 2 percent reduction in 2025, increasing to 6 percent in 2030, and accelerating from 2035 to reach an 80 percent reduction by 2050. These reductions are measured on a well-to-wake basis, accounting for emissions from fuel extraction, production, transportation, and onboard use.

Shipping companies must surrender allowances through the EU Emissions Trading System for a percentage of their reported CO2 emissions, with the percentage now at 100 percent from 2026 forward. Starting in 2026, the scope expanded beyond CO2 to include methane and nitrous oxide. Shipping companies are now adding surcharges to freight rates to cover the cost of allowances. Surcharges currently average between 6% and 7% and as much as 12% in some scenarios. Those costs will fluctuate based on the cost fluctuations of allowances and the ability of the shipping companies to reduce emissions.

For cruise lines and other vessels calling at UK or EU ports, compliance with these European requirements is mandatory regardless of flag state. The U.S. has not adopted the IMO requirements in the same form and has not imposed EU style requirements. However, any vessel that operates internationally must account for European compliance in its operational planning.

Cybersecurity Becomes Mandatory

While emissions regulations have received more public attention, cybersecurity requirements and implications may have more immediate operational impact. The maritime industry’s increasing reliance on interconnected digital systems has created vulnerabilities that regulators now view as critical security threats. AI supercharges the threats and capabilities of bad actors.

The IMO has required that cybersecurity risks be addressed and incorporated into ship safety management systems for all annual Document of Compliance audits occurring after January 1, 2021. The steps for compliance include:

1. Assess Risks : Conduct vulnerability assessments on all onboard systems.

2 . Update SMS: Incorporate cyber procedures into existing safety documents.

3 . Train Crew: Implement training for awareness of phishing and malware.

4 . Continuous Monitoring: Establish procedures for ongoing threat detection.

Since 2020, the U.S. Coast Guard has expected companies with U.S.-flagged vessels to incorporate cyber risk management into their Safety Management Systems under the ISM Code. Foreignflagged vessels calling on U.S. ports must demonstrate that their Safety Management Systems adequately address cyber risks.

In January 2025, the Coast Guard formalized these expectations through a comprehensive cybersecurity rule that establishes binding minimum requirements. The rule applies to U.S.-flagged vessels, Outer Continental Shelf facilities, and any facility covered under the Maritime Transportation Security Act.

The Coast Guard also requires that by July 16, 2027, companies must implement comprehensive cybersecurity governance

frameworks. This includes appointing designated cybersecurity officers, conducting formal cybersecurity assessments, and submitting cybersecurity plans to the Coast Guard for review and approval. The plans can be standalone documents or integrated into existing Facility or Vessel Security Plans.

The Coast Guard’s approach is performancebased rather than prescriptive. Companies have flexibility in how they structure their cybersecurity programs, but they must demonstrate that their measures adequately address identified risks. The Coast Guard references frameworks from NIST and CISA as guidance but does not mandate specific technologies or vendors.

Enforcement mechanisms mirror those used for physical security compliance. The Coast Guard can identify cybersecurity deficiencies during inspections, issue notices of violation, impose civil and criminal penalties, suspend or revoke plan approvals, and in serious cases, stop operations. Recent policy guidance makes clear that cybersecurity incidents must be reported using the same protocols as other transportation security incidents.

Why Cybersecurity Enforcement

Matters

The regulatory push by IMO and the USCG responds to documented threats. In 2021, hackers exploited a vulnerability at the Port of Houston, stealing credentials that could have provided remote access to port systems. In 2019, malware disabled shipboard systems on a U.S.-bound vessel. GPS jamming incidents

have become increasingly common in hightraffic areas.

During the first half of 2024, one technology provider monitoring 1,800 vessels reported 23,400 malware detections and 178 ransomware attacks. These are not theoretical risks. They represent operational realities that can halt vessel operations, compromise cargo, threaten safety, and trigger cascading supply chain disruptions.

The financial impact can be severe. Ransomware attackers routinely demand millions of dollars to unlock critical systems. Even when ransom is not paid, the costs of incident response, system restoration, and operational delays add up quickly. Insurance coverage for cyber events is available but has become more expensive and carries higher deductibles as insurers have recognized the risk profile.

For companies involved in maritime transactions, cybersecurity compliance status is becoming a due diligence issue. Buyers want to verify that target companies have implemented required training, designated responsible officers, and developed incident response plans. Undisclosed cybersecurity incidents or compliance gaps discovered during due diligence create valuation adjustments and warranty concerns. The threats are real and risks much greater than those imposed by regulators.

Insurance Review is Critical

Insurance coverage and review of current policies is critical to managing cyber security risks. Cyber insurance is becoming a standard requirement for maritime operations, but coverage terms vary significantly. Companies need to verify that policies adequately cover incident response costs, business interruption losses, and third-party claims arising from cyber events. Most International Group P&I policies cover third party liabilities from cyber incidents. However, these policies do not cover first party losses such as ship systems or hardware damage, damage to the vessel, restoring lost data or business interruption. Cyber incidents classified as war or terror are also typically excluded. Supplemental coverage for first party losses may be available through FD&D or separate policies. However, specialized products for cyber risks may be advisable and are available through existing marine insurers and specialty policies offered by insurers not traditionally in the marine space.

Implications for Corporate Transactions

These regulatory changes have significant implications for maritime transactions. Whether you are acquiring vessels, purchasing a shipping company, or structuring joint ventures in the sector, regulatory compliance is now a material consideration.

Due diligence must include verification of emissions reporting systems, review of cybersecurity training records and plans,

assessment of vessels’ ability to meet future emissions targets, evaluation of compliance history and any outstanding deficiencies, and analysis of budgeted costs for future compliance investments.

Representations and warranties in purchase agreements should address regulatory compliance explicitly. Buyers typically want sellers to represent that vessels and facilities are in material compliance with applicable environmental and cybersecurity requirements, that all required reports have been timely filed, that no material violations or penalties are outstanding, and that systems are in place to meet upcoming regulatory deadlines.

Indemnification provisions need to allocate risk for pre-closing compliance failures, with particular attention to undisclosed cybersecurity incidents or emissions reporting deficiencies. Escrow arrangements may be appropriate where compliance status is uncertain or where significant investments will be required to meet upcoming requirements.

Financing arrangements increasingly require borrowers to maintain compliance with environmental and cybersecurity regulations. Lenders view non-compliance as a risk to vessel operations and collateral value. Loan agreements may include covenants requiring the borrower to maintain necessary certifications, provide periodic compliance reports, and notify the lender of any material violations.

Maritime regulatory compliance is not a onetime project. It requires ongoing attention from operations personnel, legal counsel, and external advisors. Companies benefit from establishing clear lines of responsibility for compliance functions and building these obligations into regular business processes. Boards of Directors need independent review and analysis of their company’s compliance practices and risks.

Our Business Legal Team works closely with maritime clients to integrate these regulatory requirements into transaction structures and ongoing operations. For cybersecurity matters, we coordinate with our Cybersecurity and Data Privacy Division to provide comprehensive guidance on both maritime-specific requirements and broader data protection obligations.

The regulatory landscape will continue evolving throughout 2026 and beyond. The IMO’s adoption of the Net-Zero Framework will clarify global emissions requirements. Additional guidance from the Coast Guard will refine cybersecurity compliance expectations. European authorities will implement and enforce their requirements with increasing rigor.

Companies that treat these regulations as core business considerations, rather than afterthoughts, position themselves for success. Early investment in compliance systems, training, and governance structures avoids the costs and disruptions of reactive

compliance efforts. It also creates competitive advantages in transactions, financing arrangements, and insurance markets.

The maritime industry has always operated in a heavily regulated environment, but the convergence of environmental and cybersecurity requirements represents a new level of complexity. Companies

with proactive compliance programs and experienced legal advisors will navigate this transition more smoothly than those waiting for enforcement actions to drive change. If you have questions about how these regulatory developments affect your operations or planned transactions, reach out to discuss your specific needs and concerns.

BRIEFCASE BEHIND THE

ATTORNEY SPOTLIGHT

Jason Vanslette

Who has been a mentor or major influence in your career?

Chair, Real Estate Division Fort Lauderdale, FL jvanslette@kklaw.com

Click here for Bio

Michael Fichtel, Heath Eskalyo and Howard Wander (the firm owners) have been invaluable mentors throughout my career here at Kelley Kronenberg. Their ongoing support has allowed our department to flourish over the last decade to now being a nationally-recognized industry player.

What’s one book, podcast, or resource you recommend to others?

Journey of Souls—by Michael Newton, Ph. D (life changing)

What is the most interesting or unexpected thing about your area of law?

Residential mortgage foreclosures in and of itself is a controversial field of law simply from the unfortunate events that have to occur. However, despite the many foreclosures that naturally end with a sale of the property, through our clients, we have assisted hundreds of distressed homeowners with obtaining loan modifications or repayment plans to help save their homes.

What’s your guilty pleasure or something you unapologetically love?

Legos—I have over 30 different sets of Legos ranging from the largest sets (the Titanic, Eiffel Tower) to the smallest— I’ve always loved building Legos and doing them with my children now is even more meaningful.

If you could go back and give your younger self one piece of advice, what would it be?

Do not sweat the small stuff; only you have control of your anxieties and worries, do not let anyone take control of your emotions and mental health.

If you weren’t a lawyer, what would you be doing instead? Cruise Director

If your colleagues had to describe you in three words, what would they say? Forward, humorous, sassy

What drew you to this particular area of law initially?

I really enjoy real estate. Homeownership is an American staple and often taken for granted, as many countries do not have banking systems that allow for 10- or 20-plus year mortgages.

What’s the best career advice you’ve ever received?

“No case or client is worth your Bar card.”

What’s something on your bucket list?

Seeing a U.F.O. with my own eyes.

What’s a hobby or interest that might surprise people?

Playing my acoustic guitar

Click the links below to read recent blogs from Kelley Kronenberg’s Business Legal Team.

CONSTRUCTION LAW

COPYRIGHT & TRADEMARK

DATA PRIVACY, TECHNOLOGY, AND SOCIAL MEDIA

INTELLECTUAL PROPERTY

LABOR & EMPLOYMENT REAL ESTATE WEALTH FAMILY PROTECTION WORKERS’

FEATURED VIDEO

In this three-part video series, our attorneys explore the most common employment law claims arising from workers compensation cases, including workers’ compensation retaliation claims, ADA disability accommodation requirements overlapping with work injury restrictions, wage and hour issues, settlement strategies and release agreements that protect employers, attorney fee provisions that drive up claim values, and best practices for managing dual exposure from work injuries.

MEET THE

CONTRIBUTORS

David S . Harvey Partner/Business Unit Leader

Tampa, FL

Email David S. Harvey

David Harvey is a Partner and Business Unit Leader at Kelley Kronenberg, focusing his practice on labor and employment law. Since 2001, he has been Board Certified in Labor and Employment Law by The Florida Bar.

David’s practice is dedicated to representing employers in various employment and labor-related matters, including litigation, counseling, HR risk management, day-to-day advice, training, and policy development. He represents employers in state and federal courts across the United States and has advocated for them before key employmentrelated agencies such as the EEOC, DOL, NLRB, and FCHR.

With over 30 years of employment and litigation experience, David is a seasoned attorney adept at managing and resolving complex litigation and compliance issues. He has extensive experience crafting fair and legally compliant employment strategies, union avoidance tactics, and improving working conditions for both large Fortune-rated companies and small businesses across the United States. David has successfully negotiated settlements in numerous HR disputes, ranging from a few hundred dollars to $30 million.

David holds a Bachelor’s degree in Accounting from The University of Akron and a Juris Doctor from the University of Florida Law School.

Timothy D . Shields Partner/Business Unit Leader

Fort Lauderdale, FL

Email Timothy D. Shields

Timothy Shields is a Partner and Business Unit Leader at Kelley Kronenberg who helps private equity diligence teams identify cyber, data, and IP risks before they affect valuation or close. Drawing on a practice that spans technology law, artificial intelligence, data privacy, intellectual property, and sports and entertainment, Timothy brings a rare combination of legal depth and technical fluency to complex transactions, finding the exposures that traditional deal counsel often miss.

Timothy has conducted buyer-side due diligence on intellectual property, technology assets, and data privacy compliance to mitigate risks and maximize deal value. He assists start-ups on seller-side private equity financings and mergers and acquisitions deals transactions by negotiating key provisions related to intellectual property ownership, cybersecurity representations, and post-closing data breach and privacy obligations. He represents a wide range of clients, including start-up companies, athletes, social media influencers, and content creators, guiding them through their distinctive business and personal legal challenges. His practice also encompasses advising clients on critical cybersecurity and data privacy issues, ensuring compliance with regulations such as FTC guidelines, FERPA, and HIPAA. Timothy’s legal career is complemented by his position as an NFL agent, adding another dimension to his ability to understand and address the specific needs of athletes and sports-related businesses.

Prior to joining Kelley Kronenberg, Timothy spent a significant portion of his professional career at Nova Southeastern University and worked in software development. This background in technology and higher education provides him with valuable insights that inform his approach to intellectual property and data privacy law.

Timothy earned his Bachelor of Science and Master’s degrees in Higher Education Administration from the University of Central Florida. He obtained his Master’s degree in Computer Information Systems and Doctorate in Organizational Leadership from Nova Southeastern University. He earned his law degree from Nova Southeastern University Shepard Broad College of Law, where he graduated summa cum laude as Valedictorian, served as Managing Editor of the Nova Law Review, received Highest Grade awards in multiple courses, and made the Dean’s List every semester. He earned his Master of Laws in Intellectual Property from the University of New Hampshire.

Timothy holds certifications including Certified Information Privacy Professional (CIPP/US), advanced certifications in Lexis-Nexis and Westlaw, and Black Belt in Lean Six Sigma. His multifaceted background, combining legal knowledge, technological expertise, and business experience, positions him to address complex legal challenges in private equity transactions, intellectual property, and the digital economy.

MEET THE

CONTRIBUTORS

Gary L . Brown Chair, Construction Law Division

Fort Lauderdale, FL | Orlando, FL | Miami, FL | Naples | West Palm Beach, FL

Email Gary L. Brown

Gary Brown is a Partner and Chair of Kelley Kronenberg’s Construction Law Division. His practice focuses on complex commercial and general business litigation, as well as OSHA compliance. He is Board Certified by The Florida Bar in Construction Law. Gary is also a Florida Supreme Court Certified Circuit Civil Mediator.

In his practice, Gary assists businesses with complex and routine construction-related matters, working closely with business owners, developers, general contractors, construction managers, and major subcontractors to identify and resolve project issues early on. He also represents municipalities and other local governments, as well as contractors, on public works projects, including the development of procurement documents, construction agreements, and design agreements. Gary’s public works experience also includes prosecuting and defending bid protests.

Gary is an excellent source of guidance for his clients on transactional matters, furnishing them with both legal and business strategies that are tailormade to strategically advance their objectives. His expertise extends to the preparation, negotiation, and enforcement of contracts, covering a broad spectrum of legal disputes, including:

• Change Order Disputes

• Construction Defect Claims

• Construction Lien Claims

• Delay, Inefficiency, and Acceleration Claims

• Design Defect Claims

• Insurance Claims

• Payment and Performance Bonds

Gary’s practice also includes counseling clients in regulatory compliance with the standards and regulations enforced by the Department of Labor and OSHA. As part of his OSHA practice, Gary assists clients in establishing compliant safety programs; guides employers during OSHA inspections; and defends employers in OSHA enforcement actions.

Placing emphasis on client satisfaction, Gary establishes highly engaged relationships with his clients. He provides both on- and off-site counsel and daily guidance to clients on both small and large-scale projects, aiming to resolve disputes before crises occur. Through proactive problemavoidance measures, Gary helps his clients to maintain workflows, facilitating timely compliance with contractual and other requirements while minimizing risks.

Angelo A . Gasparri Partner/Business Unit Leader

Fort Lauderdale, FL

Email Angelo A. Gasparri

Angelo Gasparri is a Partner and Business Unit Leader at Kelley Kronenberg, where he concentrates his practice on all aspects of business law and transactional matters. He has a personal focus on business transactions, mergers and acquisitions, business succession planning, and complex restructuring.

Angelo’s practice is particularly focused on serving private equity firms, investment bankers, and their portfolio companies throughout the transaction lifecycle. He regularly partners with deal advisors— including CPAs, wealth managers, and M&A intermediaries—to help middle-market business owners maximize enterprise value through proactive legal structuring and risk mitigation. Whether preparing companies for sale, conducting buyside due diligence, or navigating post-acquisition integration, Angelo provides the sophisticated transactional expertise and practical business acumen that private equity sponsors and their advisors expect. His unique background as both a former corporate executive and Big-4 consultant allows him to anticipate deal complexities and deliver solutions that protect investments while accelerating closings.

With a career spanning over three decades, Angelo is a seasoned professional with unparalleled expertise in solving enterprise problems as a business leader and lawyer. Over the years, he has successfully collaborated with many individuals and

businesses, addressing a myriad of legal challenges. Angelo comes to Kelley Kronenberg with the accomplishments of an experienced business advisor and attorney, having advised senior executives on complex enterprise transitions including acquisitions, restructuring, joint ventures, global expansion and a wide range of other solutions. He led negotiations, effectuated closings for multiple acquisitions, and oversaw enterprise integration efforts. He has consistently provided strategic legal advice and counsel in key areas, including commercial transactions, bankruptcy and restructuring, commercial litigation, and corporate governance. Most recently Angelo served as the interim COO and General Counsel for an emerging investment company.

With the context gained through a career that includes experience as a corporate leader, Big-4 Consultant, Coach and Lawyer, Angelo works closely with clients to craft personalized strategies tailored to their specific goals. He takes pride in seeking solutions that achieve the strategic purposes of his clients, and providing pragmatic, actionable advice to support our clients in addressing your legal complexities.

Angelo holds a Bachelor of Industrial Engineering, cum laude, from the Georgia Institute of Technology, an MBA from Emory University, and his Juris Doctor from Emory University School of Law.

MEET THE

CONTRIBUTORS

Elizabeth P . Perez Partner/Business Unit Leader

Fort Lauderdale, FL

Email Elizabeth P. Perez

Elizabeth Perez is a Partner and Business Unit Leader at Kelley Kronenberg with a practice dedicated to health law and a member of the firm’s Business Legal Team. She brings over twenty-five years of comprehensive legal experience representing health care providers in regulatory compliance, commercial litigation, and criminal defense matters.

Prior to joining Kelley Kronenberg, Elizabeth founded and managed her own boutique law firm specializing in health law and commercial litigation. Her experience includes practicing at some of South Florida’s most prestigious law firms, where she represented health care providers in license investigations and disciplinary actions before various professional boards, handled Medicare and Medicaid provider terminations and appeals, and advised clients on the ever-changing federal and state healthcare laws. She has also served as a Partner at a regional law firm and as an Associate at a large international firm, where she handled complex commercial litigation, health care regulatory compliance, and white-collar criminal defense. Elizabeth began her career as an Assistant Public Defender in the Eleventh Judicial Circuit, where

she represented indigent clients in all aspects of criminal defense and brought more than fifty trials to verdict.

Elizabeth is recognized as an AV Preeminent® attorney, which is the highest peer rating standard. This is given to attorneys who are ranked at the highest level of professional excellence for their legal expertise, communication skills, and ethical standards by their peers. Also, she has consistently received the South Florida Legal Guide “Top Lawyer” in Health Law recognition since 2015 to the present.

She graduated from Florida State University with a Bachelor of Arts in Communication Studies and a minor in English Literature, where she served as President of Lambda Pi Eta Communications Honor Society. Elizabeth earned her Juris Doctor from The Florida State University College of Law, where she received the Florida MPLE Scholarship, the Torchbearer Leadership Award, and served as VicePresident of the Spanish American Law Student Association.

Elizabeth is fluent in Spanish.

Brandon M . Thompson Attorney

Fort Lauderdale, FL

Email Brandon M. Thompson

Brandon Thompson is an attorney at Kelley Kronenberg, focusing his practice on health law litigation. He brings comprehensive experience in healthcare regulatory compliance, insurance appeals, and health services administration.

Prior to joining Kelley Kronenberg, Brandon worked as an associate attorney appealing wrongfully denied and delayed insurance claims through insurance carriers’ internal appeals processes, utilizing federal regulations and state statutes to resolve claims and analyzing payer policies and managed care contracts to settle disputes. His experience includes serving as a legal extern for a major healthcare system’s compliance services, where he researched statutory and regulatory requirements for drafting policies on information blocking and provider-based rules, and as a legal extern for legal services conducting research on

clinical policy, contracts, licensure, compliance, and employment law. He has also worked as a legal intern drafting motions for summary judgment and conducting research on discovery matters. His healthcare background includes working as a service representative managing Medicare enrollment and benefits determination, as a patient access representative handling insurance verification and account management, and as a laboratory management intern implementing equipment to reduce adverse events.

Brandon earned his Bachelor of Science in Psychology with a minor in Asian Studies from the University of Florida. He received his Master of Science in Health Services Administration from the University of Central Florida and his Juris Doctor cum laude from the University of Florida Levin College of Law.

MEET THE

CONTRIBUTORS

David Gonzalez

Partner/Business Unit Leader

New York, NY | Short Hills, NJ

Email David Gonzalez

David Gonzalez is a Partner and Business Unit Leader at Kelley Kronenberg, focusing his practice on the defense of third-party insurance and general liability matters, with particular emphasis on products liability and complex commercial litigation. He has extensive experience defending commercial lawsuits and tort actions, including products liability claims, construction accidents, premises liability, automobile negligence, and multi-party commercial disputes in both state and federal courts.

Prior to joining Kelley Kronenberg, David served as Partner and Of Counsel at a law firm, where he practiced for over nine years handling complex litigation matters. He began his legal career as a Judicial Law Clerk for the Honorable Michael A. Toto in the New Jersey Superior Court Middlesex Visinage, where he gained valuable insight into

judicial decision-making and courtroom procedures. His experience also includes serving as Senior Legal Clerk to the Senior Vice President and General Counsel of a major national bank and as a Judicial Extern to the Honorable Jose L. Linares (ret.) in the United States District Court for the District of New Jersey. Prior to his legal career, David held various management positions in account management and business services, developing strong client relationship and business development skills.

David earned his Bachelor of Arts in Political Science, Economics, and Latin American Studies from the University of Pennsylvania. He received his Juris Doctor from Rutgers Law School.

David is proficient in Spanish.

James S . Coons Partner

New York, NY | Short Hills, NJ

Email James S. Coons

James Coons is a Partner at Kelley Kronenberg, focusing his practice on the defense of general liability and third-party insurance matters, with emphasis on products liability litigation and complex commercial litigation. He brings over twenty years of experience defending commercial lawsuits and tort actions, including personal injury, products liability, premises liability, construction defect, construction accident, wrongful death, mass toxic torts, and consumer fraud and warranty actions.

Prior to joining Kelley Kronenberg, James served as a partner at a New York law firm and previously as a partner at another firm for over seventeen years. He has represented numerous domestic and international companies, including product manufacturers, distributors, retailers, insurers, franchisors, healthcare companies, real estate

owners, and construction contractors in state and federal courts across New Jersey and New York. His experience includes representing corporate plaintiffs in high-stakes commercial matters, including multi-million-dollar contract disputes, construction disputes, commercial tenancy actions, and franchise disputes. James also maintains a regulatory compliance and advice practice, conducting investigations and counseling domestic and foreign companies regarding compliance with applicable state and federal law and regulations in areas such as import duties, consumer safety, and hazard communications.

James earned his Bachelor of Arts from Rutgers, The State University of New Jersey-New Brunswick. He received his Juris Doctor from Boston University School of Law.

MEET THE

CONTRIBUTORS

Robert Kritzman Partner/Business Unit Leader

Fort Lauderdale, FL

Email Robert Kritzman

Robert Kritzman is a Partner and Business Unit Leader at Kelley Kronenberg, focusing his practice on maritime law, the leisure and hospitality industry, and all aspects of corporate law, including mergers and acquisitions, complex commercial transactions, financing transactions, and regulatory compliance. He is a former general counsel for a major cruise line with decades of experience in the maritime and hospitality industries.

Prior to joining Kelley Kronenberg, Robert served as a partner at multiple law firms, where his practice included mergers and acquisitions, venture capital start-ups, corporate governance, cross-border transactions, bank financings, joint ventures, debt restructurings, and ship sale, construction, and finance transactions. His maritime practice covers shipbuilding contracts, vessel lease transactions, Jones Act and Passenger Vessel Services Act

compliant financing and environmental and safety compliance matters. He has also handled multiple superyacht purchases and sales, including vessel construction and financing. Robert served as Executive Vice President and General Counsel for one of the world’s leading cruise companies for eighteen years, where he was responsible for all legal affairs and held executive management responsibility for human resources and government affairs. He served on the Board of the International Council of Cruise Lines and as an Executive Committee and Board Member of the NorthWest Cruise Association.

Robert earned his Bachelor of Science in Economics from the University of Florida. He received his Juris Doctor from the University of Florida Fredric G. Levin College of Law.

ACCOLADES AWARDS AND FIRM AWARDS

Kelley Kronenberg has been the recipient of numerous awards and honors both firm-wide and for a number of our practices, including individual accolades. Below is a select list of recognition and awards:

LOCATIONS

FORT LAUDERDALE

10360 W. State Road 84

Fort Lauderdale, FL 33324

Phone: (954) 370-9970

ORLANDO

20 North Orange Avenue, Suite 704

Orlando, FL 32801

Phone: (407) 648-9450

TAMPA

1511 North Westshore Blvd., Suite 400

Tampa, FL 33607

Phone: (813) 223-1697

DAYTONA

128 Orange Avenue, Unit 306

Daytona Beach, FL 32114

Phone: (754) 888-5437

NEW YORK CITY

111 Broadway, Suite 1205

New York, NY 10006

Phone: (845) 306-7867

CHICAGO

20 N. Clark Street, Suite 1150

Chicago, IL 60602

Phone: (312) 216-8828

JACKSONVILLE

10245 Centurion Parkway N, Suite 100 Jacksonville, FL 32256

Phone: (904) 549-7700

MERRILLVILLE

233 E. 84th Drive, Suite 200

Merrillville, IN 46410

Phone: (317) 731-6243

BY APPOINTMENT ONLY

ALBANY

401 New Karner Road. Suite 301

Albany, NY 12205

Phone: (845) 306-7867

ATLANTA

1100 Peachtree Street NE, Suite 200

Atlanta, GA 30309

Phone: (404) 990-4972

MIAMI

220 Alhambra Circle, Suite 410

Coral Gables, FL 33134

Phone: (305) 503-0850

NEW ORLEANS

400 Poydras Street, Suite 2400

New Orleans, Louisiana 70130

Phone: (504) 208-9055

TALLAHASSEE

6267 Old Water Oak Road, Suite 250

Tallahassee, FL 32312

Phone: (850) 577-1301

DALLAS

5956 Sherry Lane, 20th Floor

Dallas, TX 75225

Phone: (983) 999-4640

WEST PALM BEACH

1501 Belvedere Road, Suite 500-504

West Palm Beach, FL 33406

Phone: (561) 684-5956

INDIANAPOLIS

10475 Crosspoint Blvd., Suite 218

Indianapolis, IN 46256

Phone: (317) 731-6243

NAPLES

3080 Tamiami Trail E., Suite 322

Naples, FL 34112

Phone: (239) 990-6490

SHORT HILLS

51 John F. Kennedy Parkway

First Floor West

Short Hills, NJ 07078

Phone: (862) 421-3155