Latest edition
Blog · 267 analyses
Context for better decisions.
Analysis on AI, cybersecurity, regulation, governance and digital systems. With sources, practical consequences and one clear next action.
Showing
25–36 of 54
Current knowledge, organised by topic, date and practical consequence.
Regulation (EU) 2023/1543 has applied since 18 August 2026. It allows a judicial authority to issue European Production or Preservation Orders to a provider’s designated establishment or legal representative in another Member State, regardless of the data location, within the criminal proceedings defined by the Regulation.
Read analysis
On 12 January 2027 the transition still allowing certain switching and egress costs ends. On 24 August fewer than five months remain, enough to change contracts and billing only if the inventory of services and charges already exists.
Read analysis
NIS2 includes supply-chain security among risk-management measures and ENISA guidance makes the topic operational. A clause repeating maintain adequate security does not define alert, deadline, evidence, support, or exit.
Read analysis
DORA requires financial entities to maintain a register of information on contractual arrangements with ICT providers. The operating challenge is not filling fields once, but keeping contract, legal entity, service, supported function, subcontracting, and exit coherent.
Read analysis
The European Commission highlighted on 21 August the need for internal audit to keep pace with digital transformation, AI, and new ways of working. For regulated organisations, this reinforces planning assurance around change and risk, not only the annual calendar.
Read analysis
The final Recovery and Resilience Facility calendar requires milestones and targets to be completed by 31 August 2026. The approaching deadline makes the difference between work performed, admissible evidence, and acceptance by the competent chain critical.
Read analysis
The Private Safety Processing proposal renews the tension between minimisation and abuse detection. Even with content under customer control, processing to infer safety signals still requires mapping purpose, roles, legal basis, transparency, and rights.
Read analysis
OpenAI announced on 18 August that ChatGPT Ads would reach 31 European markets the following week. The company says ads are separate from answers, customer data is not sold, and users control personalisation; advertisers and operators need to test how those claims appear in the real flow.
Read analysis
Public discussion of models capable of automating parts of attacks increases urgency, but does not create one legal category replacing NIS2, the AI Act, data protection, or contractual responsibility. Each regime addresses a distinct role and risk.
Read analysis
With Article 50 already applicable and a transition until 2 December for certain prior systems, organisations need to test marking outside the demonstration environment. Exporting, compressing, editing, and republishing can remove the technical signal.
Read analysis
ENISA’s technical guidance links NIS2 Implementing Regulation measures to concrete roles and skills. This exposes a common failure: a policy may exist without someone capable and authorised to execute it.
Read analysis
The Data Act already requires data-processing providers to remove obstacles to switching and simultaneous use of services. Full removal of switching and egress charges arrives on 12 January 2027, but contractual and technical duties should not wait for that date.
Read analysisHow we publish
Every analysis links the official documentation it relies on.
We translate change into decisions, owners and evidence.
We update the analysis when facts or guidance change.
We disclose generated photography and credit documentary photography.
From context to execution
We map the problem, write the scope and build the solution with acceptance criteria.
