Latest edition
Blog · 267 analyses
Context for better decisions.
Analysis on AI, cybersecurity, regulation, governance and digital systems. With sources, practical consequences and one clear next action.
All analyses
253–264 of 267
Current knowledge, organised by topic, date and practical consequence.
Article 28 requires a register of every contractual arrangement for ICT services, and Implementing Regulation 2024/2956 sets the templates. The real 2026 challenge is keeping keys, relationships, and supply-chain tiers complete enough for supervision and operational risk.
Read analysis
The Regulation already applies. For the first product placed on the market after 12 September 2026, Article 3(1) turns format, metadata and access by default into product requirements — not a future portal enhancement.
Read analysis
SP 800-209r1 is open for comment until 8 September. It is a voluntary technical draft — not a Portuguese legal obligation — but it offers a useful opportunity to test whether snapshots, backups, identities, and dependencies survive the same incident.
Read analysis
End-2026 is the Member State provision deadline, not a universal business-acceptance duty. A relying party should classify itself, close registration and attribute requests, and test integration before confusing readiness with legal obligation.
Read analysis
The roadmap recommends that Member States start transitioning by the end of 2026 and that critical infrastructure move by 2030. These are EU roadmap milestones, not a horizontal corporate obligation: the immediate work is cryptographic discovery, long-lived data prioritisation, and supplier testing.
Read analysis
The Commission issued new guidance on 27 July and updated its operational page yesterday. Before the remaining 2027 duties apply, hardware and software manufacturers must already report actively exploited vulnerabilities and severe incidents within 24 and 72 hours.
Read analysis
The ECB published documents yesterday covering standards, integration and a 12-month pilot. Version 0.91 already supports technical mapping, but issuance depends on EU legislation and a later decision by the ECB Governing Council.
Read analysis
Tomorrow the Commission gains effective powers over applicable obligations for providers of the most advanced models. The AI Omnibus delayed high-risk rules, not the entire regulation: this guide separates roles, dates and evidence.
Read analysis
Directive (EU) 2024/1799 had to be transposed and applied from 31 July. The EUR-Lex database consulted today shows zero measures notified by Portugal; that is a verification alert, not permission to invent national law.
Read analysis
Decree-Law 125/2025 is in force and Regulation 756/2026 made the regime operational. This guide explains who must act, what management must decide, how incident reporting works and what evidence should exist.
Read analysis
The date does not call for a generic compliance badge. It calls for concrete decisions about AI interaction, synthetic content, human review and implementation evidence.
Read analysis
An agent stops being just an answer when it can choose steps, use tools and change systems. Before production, the organisation needs to limit what it can do and prove what it did.
Read analysisHow we publish
Every analysis links the official documentation it relies on.
We translate change into decisions, owners and evidence.
We update the analysis when facts or guidance change.
We disclose generated photography and credit documentary photography.
From context to execution
We map the problem, write the scope and build the solution with acceptance criteria.
