Velqory Blog | AI, cybersecurity and regulation

Showing

Regulation

1–12 of 54

Current knowledge, organised by topic, date and practical consequence.

Conceptual scene of an opened network device, disconnected cable and power adapter in a box, with a clock in the background. — Product triage and evidence preservation under time pressure. Generated scene; not a real incident.AI-generated image under Velqory editorial direction.

Lead analysis

Regulation05 Oct 20264 min read

CRA in October: turn 24- and 72-hour reporting into an operation

Manufacturer reporting already applies. The task now is to connect triage, owners and submission evidence without waiting for a perfect investigation.

Read analysis

Two people work on an exposed circuit board with separate parts and a closed box on a nearby bench. Generated conceptual scene; not documentation of an actual event, product or test.AI-generated image under Velqory editorial direction.

Regulation05 Oct 20265 min read

03/10 edition: an open-source steward is not a manufacturer

The entity maintaining a project's infrastructure and the entity supplying a market product may differ. How can that distinction be preserved without leaving a vulnerability without a recipient?

Read analysis

Technician shows another person a device's rear connection beside a sheet with an illustrated sequence. Generated conceptual scene; not documentation of an actual event, product or test.AI-generated image under Velqory editorial direction.

Regulation05 Oct 20265 min read

28/09 edition: a security advisory must let its recipient act

After receiving an advisory, can a user determine whether they are affected, choose the measure and verify the result without interpreting a sales statement?

Read analysis

Technician examines a circuit board under a microscope while another person separates cables in a clear box. Generated conceptual scene; not documentation of an actual event, product or test.AI-generated image under Velqory editorial direction.

Regulation05 Oct 20265 min read

23/09 edition: a CVE cannot decide CRA reporting on its own

What evidence qualifies a vulnerability as actively exploited in the product? The form comes after distinguishing identification, demonstration and malicious exploitation.

Read analysis

Technician works inside a handheld terminal with spare parts and a second unit on the workbench. Generated conceptual scene; not documentation of an actual event, product or test.AI-generated image under Velqory editorial direction.

Regulation05 Oct 20265 min read

18/09 edition: a support promise needs a maintenance chain

How can you show that a sold release will keep receiving a security response? CRA preparation connects expected use, components and update delivery.

Read analysis

Technician examines a network device with a magnifier beside another device in an open box. Generated conceptual scene; not documentation of an actual event, product or test.AI-generated image under Velqory editorial direction.

Regulation05 Oct 20264 min read

13/09 edition: using software does not, by itself, make you a manufacturer

Which product do we supply to the market, and under whose name? CRA classification starts here, not with a count of installed applications.

Read analysis

Conceptual editorial illustration about digital regulation. — Conceptual image generated for this analysis; it does not document a real event.AI-generated conceptual image by Velqory.

Regulation12 Sept 20264 min read

CRA reporting and digital products in the EU

Cyber Resilience Act reporting duties began to apply before the main obligations stated for 2027.

Read analysis

Regulation11 Sept 20264 min read

Regulation: prepare innovation without pre-empting law

The European innovation proposal creates a preparation opportunity, but it does not justify treating proposed outcomes as rules already in force.

Read analysis

Regulation10 Sept 20264 min read

A roadmap for the digital omnibus

The European simplification package is a planning signal, but proposals require legislative tracking.

Read analysis

Regulation09 Sept 20264 min read

Rebaseline compliance for the AI Omnibus

The AI Omnibus entering into force changes Commission-indicated timelines, but does not remove the need for compliance governance.

Read analysis

Conceptual editorial illustration for “AI Act: Turning Requirements into a Verifiable Obligations Inventory”. — Conceptual image generated for this analysis; it does not document a real event.AI-generated conceptual image by Velqory.

Regulation08 Sept 20264 min read

AI regulation: a verifiable inventory

An obligations inventory is useful only when it separates legal requirements, technical standards, and internal decisions.

Read analysis

Conceptual editorial illustration for “AI Omnibus: Rebaseline Controls Without Pausing Preparation”. — Conceptual image generated for this analysis; it does not document a real event.AI-generated conceptual image by Velqory.

Regulation07 Sept 20264 min read

AI Omnibus: Rebaseline Controls Without Stopping

The communicated timelines for high-risk systems change planning, but do not remove the need for documented preparation.

Read analysis

How we publish

Each analysis links to the official source and says what changes in practice.

01Sources in view
Every analysis links the official documentation it relies on.
02Operational context
We translate change into decisions, owners and evidence.
03Continuous review
We update the analysis when facts or guidance change.
04Identified imagery
We disclose generated photography and credit documentary photography.

From context to execution

Is there an obligation or a system that needs to become operational?

We map the problem, write the scope and build the solution with acceptance criteria.

Talk to Velqory Explore services