Romaine helps organizations navigate legal obligations relating to data innovation, privacy, and security, and Artificial Intelligence. 

Romaine’s risk management approach is informed by his experience as a business litigation and trial lawyer, and as legal counsel in response to hundreds of cybersecurity and data privacy incidents which, in some cases, involved litigation and regulatory investigations. He has been lead-counsel in multiple jury and bench trials in Utah state and federal courts, and against government agencies nationwide. 

As organizations embrace digital transformation, Romaine helps them manage legal risks by tailoring incident response plans and risk assessments, and co-developing written information security and AI risk management programs. He also advises on the application of cybersecurity and AI governance frameworks, and related data privacy considerations, and has recently represented clients in relation to:

• AI governance including assisting organizations with implementing AI literacy and AI risk management policies and programs, and conducting assessments required by states (e.g., UAIPA, CAIA, and TRAIGA) and overseas (e.g., EU AI Act).  
• Cybersecurity and data privacy litigation involving botnets and man-in-the-middle attacks against end users and business executives, a cryptocurrency exchange, nonfungible token (NFT) platforms and digital art creators, and web tracking.
• Regulatory investigations by the US Federal Trade Commission, US Securities and Exchange Commission and US Department of Health and Human Services into cybersecurity and data privacy practices, and blockchain and digital assets. 
• International cybersecurity regulations including the European Union’s NIS2 Directive, Digital Operational Resilience Act, and Cyber Resilience Act, and China and Canada’s Personal Information Protection (PIPL and PIPEDA) laws.
• Critical infrastructure and regulatory changes to cybersecurity alignment, readiness, and maturity requirements for the energy, financial, food and agriculture, information technology, emergency services and transportation sectors.
• Ransomware attacks involving the Ryuk, CryLock, Conti, MAZE, THT v2, RagnarLocker, LockBit, CLOP, NoEscape, and ALPHV/Blackcat variants, and led teams that analyzed and applied notification obligations.

Romaine is also a frequent author and presenter on digital transformation and related legal obligations, is co-chair of the National Asian Pacific American Bar Association’s Emerging Technologies Committee, vice chair of the Utah Bar’s Cyberlaw Section, a member of the Utah Bar’s Innovation in Law Practice Committee, and a host for the Utah Chapter of the CISO Executive Network.