Will the Law Actually Work?

Aspen Digital convened the Fall 2026 meeting of the Global Cybersecurity Group in New York City on September 22, on the sidelines of the UN General Assembly. This invite-only assembly of senior government officials, private sector executives, and civil society experts met for a closed-door policy dialogue on the rapidly evolving landscape of digital threats and trends in cybersecurity. Topics of discussion included the importance of coordination and coherence between national cyber policies and the initiatives pushed by multilateral institutions. Participants also explored the need for cyber impact assessments to test the efficacy of proposed or implemented digital policies and regulations.

These topics are closely linked, and they were the focus of a proposal I brought to the group: every major digital law should undergo a cybersecurity impact assessment. Such an assessment must not be treated as a new technical checklist added at the end of the legislative process. It should be part of determining whether the law will actually work. The proposal builds on an important observation the Group made at its Spring 2026 meeting in Tokyo. Mainly, cybersecurity is not simply a technical cost or a problem to be managed after an incident. It is part of economic competitiveness, national security, public service continuity, and digital sovereignty. The Tokyo conversation also emphasized that international cooperation ought to be fostered but should not incite regulatory colonialism by exporting regulatory models to regions with less cybersecurity capability and capacity. To develop a cybersecurity impact assessment, I propose we ask at least five core questions before adopting any cybersecurity-relevant digital law.

New Attack Surface

First, ask whether the law creates a new attack surface. A rule may require more data collection, identity verification, information retention, system interconnection, or centralized reporting. Each feature may address a legitimate policy objective, but each can also increase the consequences of a breach.

Conflicting Operational Duties

Second, test whether the law creates conflicting operational duties. An organization may be told to report rapidly under one regime, preserve confidentiality under another, protect personal data under a third, and avoid disclosure that could assist an attacker under a fourth. If these duties cannot be performed coherently during an actual incident, the problem is no longer compliance complexity. It becomes a security vulnerability created by law.

Institutional Capacity

Third, assess whether the institutions are capable of carrying out the law. A strategy without responsible institutions, executable tasks, resources, and measurable outcomes risks remaining only “a piece of paper.” That was one of the clearest messages from Tokyo. We must assess the capacity of regulators, incident response bodies, law enforcement agencies, courts, local authorities, and regulated entities, especially smaller organizations.

Trust

Fourth, ask whether the law strengthens or weakens trust. Incident reporting, for example, depends on timely cooperation. If organizations believe that good-faith disclosure will automatically expose them to disproportionate liability, public criticism, or duplicative investigations, they may become defensive. Reciprocal information sharing and safe harbor protection are therefore highly relevant.

International Interoperability

Fifth, check whether the law is interoperable internationally. Cyber incidents do not remain within one legal system. A cybersecurity impact assessment should identify conflicts with international standards, foreign reporting duties, cross-border evidence procedures, and trusted information sharing arrangements.

The Missing Integrated Test

Coordinate existing government assessments. Do governments conduct this kind of assessment today? Elements of it exist but usually in fragments. We have regulatory impact assessments, data protection impact assessments, security risk assessments, human rights reviews, and sectoral consultations. What is generally missing is an integrated test that examines how the proposed law changes cybersecurity risk across the entire legal and operational system. The European Union’s Cyber Resilience Act illustrates why that integration matters. The Act requires an early warning notification of actively exploited vulnerabilities and severe incidents within 24 hours of becoming aware, a full notification within 72 hours, and subsequent final reporting through a single platform. The important question for the rest of us is not whether we should copy those precise rules. It is whether our domestic reporting systems can speak to one another so that organizations report only once, authorities can act rapidly, and sensitive vulnerability information remains appropriately protected.

From Signature to Implementation

Treat international commitments as the start of the work, not the end of it. Cybersecurity goes beyond simple international commitments. Take the example of Thailand, which signed the United Nations Convention against Cybercrime on October 25, 2025. The Thai government identified combating cybercrime and online scams, as well as strengthening international cooperation, as national priorities. The Convention adds something that national legislation cannot produce by itself: a common legal basis for cross-border cooperation, electronic evidence, technical assistance, capacity building, and a 24/7 cooperation network. For Thailand, this is especially important. We may strengthen our Cybersecurity Act, Computer Crime Act, data protection framework, law enforcement capacity, and critical infrastructure protections, but a national solution ends where another jurisdiction begins. Evidence, infrastructure, proceeds, offenders, victims, and service providers may all be located in different countries.

But signature is not implementation. The difficult work begins when we map the Convention to the entire domestic legal chain: primary legislation, subordinate regulations, institutional mandates, investigative procedures, safeguards, budgets, technology, personnel, and actual enforcement practice. This dovetails with the idea of a cybersecurity impact assessment. We must examine the whole “river of information,” from upstream legislation to downstream implementation, and then map that domestic stream against Thailand’s international “waters,” or obligations.

Coherence in a Multilayered System

Measure coherence by whether rules work together in a crisis, not by whether they are identical. The first substantive plenary of the new UN Global Mechanism on Cybersecurity in July 2026 addressed the threat landscape, international law, norms, and capacity building. Thailand also joined a cross-regional statement emphasizing the application of international law and the value of structured, inclusive discussion. This demonstrates the architecture is already becoming multilayered: one process addresses responsible state behavior, another addresses criminal cooperation, regional systems impose operational requirements, and national governments continue to legislate. The test of coherence is therefore not whether every jurisdiction adopts identical laws but whether the rules can operate together during the first 24 hours of a real crisis.

A Trusted Place to Test the System

Define the function we need before settling on the form. Perhaps, the Aspen Digital Global Cybersecurity Group’s collective proposal for a cyber-AI equivalent of the International Atomic Energy Agency (IAEA) deserves further discussion. We may not yet know the precise institutional form, but we do know the function we are missing: a trusted place where governments, technical experts, industry, and civil society can compare risks, test interoperability, develop common assurance methods, and identify when a rule adopted for one legitimate objective inadvertently weakens collective security.
The goal should not be one global cyber law. The goal should be a coherent global system in which different laws reinforce, rather than undermine, our shared resilience.

The views represented herein are those of the author(s) and do not necessarily reflect the views of the Aspen Institute, its programs, staff, volunteers, participants, or its trustees.

Narun Popattanachai holds joint positions as Director of Impact Assessment and Evaluation of Law and Deputy Chief Information Officer, Office of the Council of State, Thailand’s central government legal advisory agency. In this role, he leads the national legislative and regulatory policy development works, including the reform of Thailandâ s Electronic Transaction Act as well as the introduction of the Digital Platform Economy Bill. He also leads the digital government initiatives, steering the transformation projects. Since April 2026, he acts as Senior Policy Advisor in Deputy Prime Minister Pakorn Nilprapunt’s Steering Team, responsible for: OECD Accession of Thailand and Whole of Government Digital Transformation. Since December 2023, he has been a member of the OECD Better Regulation in the Digital Age (BRIDGE) Expert Group, helping to modernize the regulatory governance approach that fits for the digital world. Narun holds a J.S.D. from Columbia Law School and is a member of NY Bar.