Skip to main content
Client access Talk to us

Latest edition

Blog · 267 analyses

Regulation, AI and cybersecurity, with sources in view.

Context for better decisions.

Analysis on AI, cybersecurity, regulation, governance and digital systems. With sources, practical consequences and one clear next action.

All analyses

All analyses

73–84 of 267

Current knowledge, organised by topic, date and practical consequence.

Conceptual editorial composition about three eu ai-cyber calls opened: start with impact evidence, not the consortium
Before seeking partners, write a one-page evidence case: user, measurable problem, baseline, topic-specific contribution, technical hypothesis, AI risk, available data, adoption, and outcome metric. Proceed only if the call text and official documents confirm eligibility, scope, and costs.AI-generated image under Velqory editorial direction.
Artificial intelligence15 min read

Three EU AI-cyber calls opened: start with impact evidence, not the consortium

Three Digital Europe calls opened on 1 September and close on 14 January 2027: CYBER-11-EULEG, CYBER-11-AI4SME, and CYBER-11-CYBERAI. They cover capacity for legal requirements, SME adoption, and AI-based cybersecurity tools with robustness and trustworthiness.

Read analysis
Conceptual editorial composition about ai act information request: respond with a claim, source, and owner map
Activate a response room spanning legal, product, security, data, and leadership. Decompose each question into atomic claims, authority, systems, and period; assign each claim an owner, primary source, reproducible extraction, independent review, uncertainty, and approval.AI-generated image under Velqory editorial direction.
Regulation15 min read

AI Act information request: respond with a claim, source, and owner map

The Commission's published enforcement framework explains that the AI Office may issue simple requests for information or requests by formal decision. An incorrect or misleading reply may be sanctioned; for a request by decision, failure to reply or an incomplete reply may also lead to a fine.

Read analysis
Conceptual editorial composition about nist ir 8615: hardware security needs procurement language and lifecycle evidence
For critical components, replace the vague requirement ‘secure hardware’ with a verifiable profile: identity and provenance, root of trust, firmware, boot, debug, memory, keys, update, failure, disclosure, end of support, and the artefacts delivered to the buyer.AI-generated image under Velqory editorial direction.
Cybersecurity15 min read

NIST IR 8615: hardware security needs procurement language and lifecycle evidence

NIST published IR 8615 on 1 September, summarising the SUSHI@NIST workshop on hardware security. The report calls for interoperable, evidence-based trust models, vocabularies, and guidance, plus pilots and procurement incentives to reduce barriers across the semiconductor ecosystem.

Read analysis
Conceptual editorial composition about a ciso with direct reporting needs decision rights, not merely a title
Use the act as an organisational test, not a universal template. For every CISO responsibility define RACI, mandatory information, authority to stop or accept temporarily, escalation threshold, cover, conflicts, budget, reporting frequency, and the decision that remains with the board.AI-generated image under Velqory editorial direction.
Governance14 min read

A CISO with direct reporting needs decision rights, not merely a title

Decision 924/2026 created a CISO unit at Portugal's Institute of Informatics under the direct hierarchy of the Board. Its mandate combines strategy, ISMS, risk, access, incidents, regulator communication, compliance, security by design, and culture.

Read analysis
Conceptual editorial composition about kubernetes 1.37: storage version migration ga makes stale versions observable work
Include an explicit migration before removing old CRD versions or retiring previous encryption keys. Inventory resources and storedVersions, apply one object per resource, observe conditions, confirm completion, and only then change serving, CRD status, or cryptographic material.AI-generated image under Velqory editorial direction.
Digital systems15 min read

Kubernetes 1.37: Storage Version Migration GA makes stale versions observable work

In Kubernetes 1.37, the storagemigration.k8s.io/v1 API and built-in Storage Version Migration controller reached Stable and are enabled by default. Migration rewrites existing objects into the preferred storage version and exposes declarative status, replacing manual scripts that were difficult to observe.

Read analysis
Conceptual editorial composition about ai act complaints: preserve the ai decision before context disappears
Any organisation operating AI should be able to freeze, at the moment of challenge, the system version, input, output, applied policy, human intervention, data source, permitted logs, and owner. It should then separate user response, investigation, preservation, and the decision about the competent authority.AI-generated image under Velqory editorial direction.
Artificial intelligence13 min read

AI Act complaints: preserve the AI decision before context disappears

The Commission provides a complaint channel for people and organisations to report alleged infringements within the AI Office's exclusive remit. The form asks for the country and a detailed description, accepts documents, is not anonymous, and generates a reference that should be retained.

Read analysis
Conceptual editorial composition about nis2 in portugal: turn registration and permanent contact into operating evidence
Create one dossier per legal entity linking services, sector, size, exceptions, tax identifier, domains, networks, cybersecurity officer, deputy, and permanent contact. The board approves the rationale; operations tests availability and legal validates material changes.AI-generated image under Velqory editorial direction.
Regulation14 min read

NIS2 in Portugal: turn registration and permanent contact into operating evidence

Decree-Law 125/2025 brought Portugal's new Cybersecurity Legal Regime into force on 3 April 2026. For a potentially covered entity, the immediate risk is not only interpreting its sector: it is being able to prove classification, registration data, the responsible person, and a permanently available contact.

Read analysis
Conceptual editorial composition about pqc roadmap: 97 responses show the bottleneck is execution, not the algorithm
Use the feedback as a test of the internal programme: each critical system should have known cryptographic use, data lifetime, protocol and supplier dependencies, migration target, hybrid option, test window, and reversal path. The goal is verifiable change capacity, not declaring a favourite algorithm.AI-generated image under Velqory editorial direction.
Cybersecurity14 min read

PQC roadmap: 97 responses show the bottleneck is execution, not the algorithm

On 2 September the Commission published feedback on the EU post-quantum cryptography roadmap: it received 97 submissions, 73 with ratings or content feedback, and 63 requesting clarification. Clear timelines, actionable steps, risk prioritisation, hybrid schemes, and crypto agility were identified as useful.

Read analysis
Conceptual editorial composition about public cyber resilience: €243 million needs an outcomes portfolio, not a shopping list
Manage the €243 million as one capability portfolio with owners and outcomes: covered services, detection, isolation and recovery time, vulnerabilities, geographic redundancy, tests, and closure of legal gaps. Each procurement should state which outcome it moves and how it will be accepted.AI-generated image under Velqory editorial direction.
Governance15 min read

Public cyber resilience: €243 million needs an outcomes portfolio, not a shopping list

Portugal's PTRR allocates €225 million to strengthen state cybersecurity and digital resilience and €18 million to develop and implement the national cybersecurity strategy. The text connects technology, sovereign cloud, redundancy, operations, NIS2, materiality, and crisis response.

Read analysis
Conceptual editorial composition about kubernetes 1.37 scales hpa to zero: savings count only if startup meets the slo
Authorise zero per workload only after measuring event arrival, metric delay, HPA reconciliation, scheduling, image pull, startup, readiness, and first response. Set a cold-start SLO and keep a minimum of one where latency, state, or metric availability cannot support zero.AI-generated image under Velqory editorial direction.
Digital systems14 min read

Kubernetes 1.37 scales HPA to zero: savings count only if startup meets the SLO

Kubernetes 1.37 promoted API support for HorizontalPodAutoscaler scale-to-zero to Beta and enabled it by default. Returning from zero requires a suitable object or external metric; CPU and memory from non-existent pods cannot trigger startup on their own.

Read analysis
Conceptual editorial composition about ai in september: a multi-provider gate separating capability, security, and continuity
For September, use a gate with four separate scores: task quality, behaviour under abuse and failure, surrounding-system controls, and contractual continuity. A high score does not offset a disqualifying condition in another dimension; the decision should bind to the tested version and configuration.AI-generated image under Velqory editorial direction.
Artificial intelligence15 min read

AI in September: a multi-provider gate separating capability, security, and continuity

The closing days of August brought three different signals: a DeepMind double-blind evaluation pilot, an evaluation incident described by OpenAI, and containment measures published by Anthropic. None independently decides which AI system should enter an organisation's production environment.

Read analysis
Conceptual editorial composition about dora in september: reconcile the ict register with contracts, functions, and subcontractors
Reconcile the register against independent sources: contracts, procurement and payments, CMDB, architecture, service catalogue, critical functions, suppliers, and subcontractor notices. Orphan relationships, inconsistent identifiers, and impossible dates should block the reporting version.AI-generated image under Velqory editorial direction.
Regulation15 min read

DORA in September: reconcile the ICT register with contracts, functions, and subcontractors

DORA requires covered financial entities to maintain and update a register of all contractual arrangements for ICT services at the applicable levels. September is a useful gate to reconcile the standardised model with summer changes in contracts, services, entities, and subcontracting chains.

Read analysis

How we publish

Each analysis links to the official source and says what changes in practice.

  1. 01Sources in view

    Every analysis links the official documentation it relies on.

  2. 02Operational context

    We translate change into decisions, owners and evidence.

  3. 03Continuous review

    We update the analysis when facts or guidance change.

  4. 04Identified imagery

    We disclose generated photography and credit documentary photography.

From context to execution

Is there an obligation or a system that needs to become operational?

We map the problem, write the scope and build the solution with acceptance criteria.