Skip to main content
Client access Talk to us

Latest edition

Blog · 267 analyses

Regulation, AI and cybersecurity, with sources in view.

Context for better decisions.

Analysis on AI, cybersecurity, regulation, governance and digital systems. With sources, practical consequences and one clear next action.

Showing

Regulation

13–24 of 54

Current knowledge, organised by topic, date and practical consequence.

Conceptual editorial composition about ai act information request: respond with a claim, source, and owner map
Activate a response room spanning legal, product, security, data, and leadership. Decompose each question into atomic claims, authority, systems, and period; assign each claim an owner, primary source, reproducible extraction, independent review, uncertainty, and approval.AI-generated image under Velqory editorial direction.
Regulation15 min read

AI Act information request: respond with a claim, source, and owner map

The Commission's published enforcement framework explains that the AI Office may issue simple requests for information or requests by formal decision. An incorrect or misleading reply may be sanctioned; for a request by decision, failure to reply or an incomplete reply may also lead to a fine.

Read analysis
Conceptual editorial composition about nis2 in portugal: turn registration and permanent contact into operating evidence
Create one dossier per legal entity linking services, sector, size, exceptions, tax identifier, domains, networks, cybersecurity officer, deputy, and permanent contact. The board approves the rationale; operations tests availability and legal validates material changes.AI-generated image under Velqory editorial direction.
Regulation14 min read

NIS2 in Portugal: turn registration and permanent contact into operating evidence

Decree-Law 125/2025 brought Portugal's new Cybersecurity Legal Regime into force on 3 April 2026. For a potentially covered entity, the immediate risk is not only interpreting its sector: it is being able to prove classification, registration data, the responsible person, and a permanently available contact.

Read analysis
Conceptual editorial composition about dora in september: reconcile the ict register with contracts, functions, and subcontractors
Reconcile the register against independent sources: contracts, procurement and payments, CMDB, architecture, service catalogue, critical functions, suppliers, and subcontractor notices. Orphan relationships, inconsistent identifiers, and impossible dates should block the reporting version.AI-generated image under Velqory editorial direction.
Regulation15 min read

DORA in September: reconcile the ICT register with contracts, functions, and subcontractors

DORA requires covered financial entities to maintain and update a register of all contractual arrangements for ICT services at the applicable levels. September is a useful gate to reconcile the standardised model with summer changes in contracts, services, entities, and subcontracting chains.

Read analysis
Conceptual editorial composition about ai act after 2 august: enter september with a map of rules that actually apply
At month-end, reconcile each system and role against the consolidated text, application date, duty, evidence, owner, and status. Do not use one date for the entire regulation, and do not turn Commission guidance or news into a substitute for the applicable article.AI-generated image under Velqory editorial direction.
Regulation15 min read

AI Act after 2 August: enter September with a map of rules that actually apply

August 2026 marked a new phase of AI Act application and enforcement, reflected by the Commission and official timeline, with Digital Omnibus changes in the consolidated text. Organisations should not continue operating from calendars created before those changes.

Read analysis
Conceptual editorial composition about e-evidence: preserve quickly without turning an order into an unlimited copy
Preservation should freeze only identified, existing data within the order's scope, with legal hold, integrity, restricted access, and controlled expiry. Production, challenge, and communication should follow their own legal validation; preservation does not authorise a general search.AI-generated image under Velqory editorial direction.
Regulation15 min read

E-evidence: preserve quickly without turning an order into an unlimited copy

Regulation (EU) 2023/1543 on European Production and Preservation Orders has applied since 18 August 2026. In-scope service providers need to receive, authenticate, preserve, and respond through a workflow that respects timing and data protection.

Read analysis
Conceptual editorial composition about data act: a cloud exit plan needs data, timing, and a test — not merely a clause
For each covered cloud service, maintain a plan defining exportable data and assets, format, interfaces, transition period, assistance, continuity, deletion, permitted charges, dependencies, and destination. Legal interpretation of the contract should be validated for the specific service and date.AI-generated image under Velqory editorial direction.
Regulation15 min read

Data Act: a cloud exit plan needs data, timing, and a test — not merely a clause

The Data Act has generally applied since September 2025 and contains rules on switching between data-processing services. As acquisitions and commercial changes affect technology providers, customers should be able to locate contractual duties and convert them into a technical exit path.

Read analysis
Conceptual editorial composition about cra: two weeks to reporting — run a rehearsal that starts from a real signal
The rehearsal should start with an incomplete signal received through support, a researcher, a supplier, or telemetry and force the team to decide product, version, exploitation, impact, territory, clock, and content. An exercise that starts with a completed form does not test the real duty.AI-generated image under Velqory editorial direction.
Regulation15 min read

CRA: two weeks to reporting — run a rehearsal that starts from a real signal

Cyber Resilience Act Article 14 reporting duties apply from 11 September 2026. An early warning may be due within 24 hours and the main notification within 72 hours after a manufacturer becomes aware of a covered actively exploited vulnerability or severe incident.

Read analysis
Conceptual editorial composition about ai act: a provider's confidential evaluation does not replace the deployer's dossier
Accept external evaluation as one dossier item and require a table linking every result to the relevant requirement, risk, and deployment configuration. If the report does not establish version, scope, or limitations, it should not independently support a compliance or production decision.AI-generated image under Velqory editorial direction.
Regulation14 min read

AI Act: a provider's confidential evaluation does not replace the deployer's dossier

The double-blind evaluation pilot announced by DeepMind offers a promising way to protect prompts and weights, but the AI Act allocates duties by role and use case. An organisation deploying a system still needs inventory, classification, instructions, oversight, logs, and controls in its own context.

Read analysis
Conceptual editorial composition about ai act after the omnibus: delaying high-risk rules did not suspend the rest of the regulation
Replace any single line called ‘AI Act — 2027/2028’ with a calendar by article, role, system type, placing-on-market date, and obligation. Continue executing what already applies and use the additional high-risk time as an engineering and evidence window.AI-generated image under Velqory editorial direction.
Regulation14 min read

AI Act after the Omnibus: delaying high-risk rules did not suspend the rest of the Regulation

Regulation (EU) 2026/1744, in force since 27 July, changed the AI Act timetable. Sections 1 to 3 of Chapter III now apply on 2 December 2027 to high-risk systems under Article 6(2) and Annex III, and on 2 August 2028 to systems under Article 6(1) and Annex I. The general application date of 2 August 2026, however, did not disappear.

Read analysis

How we publish

Each analysis links to the official source and says what changes in practice.

  1. 01Sources in view

    Every analysis links the official documentation it relies on.

  2. 02Operational context

    We translate change into decisions, owners and evidence.

  3. 03Continuous review

    We update the analysis when facts or guidance change.

  4. 04Identified imagery

    We disclose generated photography and credit documentary photography.

From context to execution

Is there an obligation or a system that needs to become operational?

We map the problem, write the scope and build the solution with acceptance criteria.