Latest edition
Blog · 267 analyses
Context for better decisions.
Analysis on AI, cybersecurity, regulation, governance and digital systems. With sources, practical consequences and one clear next action.
Showing
37–48 of 54
Current knowledge, organised by topic, date and practical consequence.
The AI Act entered general application on 2 August 2026 and the Commission began enforcing the rules already in force. Generative systems placed on the market before that date have a specific transition for Article 50(2) machine-readable marking until 2 December 2026.
Read analysis
In July, the Commission accepted a corrective plan covering search, completeness, API access, and researcher access. The case creates no new general rule, but it offers a useful test of whether transparency exists beyond the interface.
Read analysis
Member States have until 31 August 2026 to complete milestones and targets. Later actions cannot be considered, and the final payment request with evidence is due 30 September.
Read analysis
Decree-Law 125/2025 placed cybersecurity governance on the formal agenda of management bodies. Delegating preparation to the cybersecurity officer does not transfer the decision.
Read analysis
Generative systems placed on the market before 2 August may receive four additional months for Article 50(2) technical marking. The rest of Article 50 did not receive a blanket delay.
Read analysis
Article 50 of the AI Act now applies. Machine-readable marking, deepfake disclosure, and user information are not the same obligation — and a detached caption can vanish when content is cropped, exported, or reposted.
Read analysis
Directive (EU) 2024/1788 set 5 August 2026 as its transposition deadline. The verified Portuguese act explicitly describes a partial transposition; companies should separate EU text, national acts, ERSE rules, and contractual commitments before assuming everything changed — or nothing did.
Read analysis
The Commission adopted two non-compliance decisions: €460 million for self-preferencing in Google Search and €430 million for steering restrictions in Google Play. The operational lesson is precise — ranking, presentation, cost, and the alternative route must work together.
Read analysis
A manufacturer will have to state how long it handles vulnerabilities, justify that horizon in technical documentation, and align product, components, updates, and support with the promise made before purchase.
Read analysis
The worst way to manage a regulatory deadline is to treat it as the opening of the project. On that day, processes, data, decisions, suppliers, and evidence should already work together.
Read analysis
The initial notification is not an early final report. DORA separates classification, initial communication, intermediate update, and closure so the authority receives essentials early and consolidated evidence later.
Read analysis
The clock does not wait for a perfect forensic report. Once a controller has sufficient awareness of a personal data breach, it must assess risk and, where required, notify the CNPD within 72 hours — using phased updates if facts remain incomplete.
Read analysisHow we publish
Every analysis links the official documentation it relies on.
We translate change into decisions, owners and evidence.
We update the analysis when facts or guidance change.
We disclose generated photography and credit documentary photography.
From context to execution
We map the problem, write the scope and build the solution with acceptance criteria.
