Is ISO/IEC 42001 Becoming the Default Evidence Layer for EU AI Act Readiness?
A certificate is not a legal conformity assessment. Say that first, because the market is starting to blur the two.
Latest analysis
View all →
The EU Data Act Applies in September 2025: Which Obligations Hit Your Connected Products and Cloud Contracts?
The EU Data Act, Regulation (EU) 2023/2854, has applied since 12 September 2025. That is not a proposal date or a transposition target.
MiCA CASP Authorization: What Does MiCA Actually Require of Crypto-Asset Service Providers?
The transitional window closed on 1 July 2026. Crypto-asset service providers that had been operating across the EU under national regimes have now either secured authorization under MiCA, or they have lost the legal bas…
CMMC Phase 1 Is Live: Is Your Self-Assessment Ready to Win DoD Contracts?
Phase 1 of the CMMC Program is the point where cybersecurity stops being a clause you scroll past and becomes a gate on the award itself.
When the CSRD Omnibus Moves the Goalposts, Why Should Sustainability Data Be Configuration, Not a Rebuild?
Most sustainability teams built their CSRD program the way you build a bridge: survey the ground once, pour the foundations, and assume the terrain will hold. Then the 2025 Omnibus moved the ground.
Is Your Article 30 Record of Processing Activities Audit-Ready, or Just a Spreadsheet You Update Once a Year?
Most records of processing activities are not records. They are archaeology. A spreadsheet built for a data-mapping exercise two years ago, updated the week before an audit, and otherwise untouched while the actual proce…
EHDS Is Phasing In: What Do Health Data Holders Actually Have to Operate?
The European Health Data Space is not a future regulation you can park. Regulation (EU) 2025/327 was adopted on 11 February 2025 and is already in force. The application dates are fixed.
Now That the Colorado AI Act Is Live, What Does SB 24-205 Actually Require of AI Deployers and Developers?
The Colorado AI Act stopped being a future problem on June 30, 2026. As enacted, SB 24-205 wrote its operative duties to apply "on and after February 1, 2026." A 2025 amendment, SB 25-004, pushed the applicability date t…
NYDFS 500 Hits Its 2026 Compliance Date: Is Your Asset Inventory and Access Review Audit-Ready?
Your NYDFS certification is not a form. It is an attestation that the data behind it exists, is current, and could be produced on demand. That distinction is where most covered entities will get caught in 2026.
EMIR 3.0 Active Account Requirement: What Must EU Counterparties Have in Place by 2026?
EMIR did not get rewritten. It got a new gravity well. For more than a decade, the question under the European Market Infrastructure Regulation was binary: is this class of OTC derivative subject to the clearing obligati…
DORA's First Annual Cycle Just Closed: What Must Financial Entities Submit Now?
DORA (Regulation (EU) 2022/2554) entered application on 17 January 2025. The first full annual cycle has now run its course. That changes the question for compliance officers.
Post-Quantum Migration: How Do You Build a Cryptographic Inventory Before the FIPS 203 Deadlines Hit?
The algorithm decision is already made. NIST made it for you when it published FIPS 203 in August 2024 and named ML-KEM the standard mechanism for establishing a shared secret key that survives a quantum computer.
India DPDP Act 2026: What Do the Final Rules Mean for Consent Managers and Breach Timelines?
India built its privacy law in two layers, and most teams only read the first one. The Digital Personal Data Protection Act, 2023 is the statute.
CMMC Compliance Tooling: Should You Buy a Point-in-Time Assessment or Build a Continuous Posture?
Most CMMC programs are built to pass a date. The certification assessment is treated as the deliverable.
EU AI Act Annex III: Which High-Risk Obligations Must Deployers Meet by August 2026?
Most teams treat "August 2026" as the moment every high-risk AI obligation switches on. It is not that clean. The AI Act applies from 2 August 2026 as its general date.
APRA CPS 230 Is Now in Force: What Must Australian Financial Entities and Their Material Service Providers Actually Operate?
CPS 230 commenced on 1 July 2025. The transitional grace for pre-existing service provider contracts runs out on the earlier of the next renewal date or 1 July 2026. That second date is now weeks away.
NIST SP 800-171 Self-Assessment and SPRS Scores: How Do Defense Contractors Keep Contracts Under the CMMC-Aligned DFARS Clause?
A defense contract can now be lost on a number you posted to a government database yourself.
Digital Markets Act Enforcement: What Keeps Designated Gatekeepers Under Continuous Compliance Pressure?
A gatekeeper designation under the EU's Digital Markets Act is not a verdict you serve and move past. It is the start of a compliance relationship that never closes.
DORA One Year On: Is Your Register of Information and TLPT Scope an Audit Project or a Standing Query?
DORA entered application on 17 January 2025. A year on, most financial entities have a register of information and a testing programme.
ISO/IEC 42001 in Practice: What Does an AI Management System Actually Require You to Operate?
Your legal team signed off on an AI vendor last quarter. Your data science group shipped a model into a customer-facing workflow the quarter before.
The CER Directive's First Hard Deadline Is 17 July 2026 — Are You About to Be Named a Critical Entity?
The CER Directive has a date on it now, and it is close. By 17 July 2026, every EU member state must finish identifying which organizations on its territory count as critical entities.
Is Your SFDR Posture a Disclosure Document or a PAI and Article 8/9 Control Surface?
There is a category error sitting at the center of most SFDR programs. It is the assumption that the Sustainable Finance Disclosure Regulation asks you to produce documents. It does not.
Is Your CSRD/ESRS Reporting Cycle a Sustainability Project or a Data-Governance and Assurance Problem?
Most CSRD programmes start in the wrong building. They start in sustainability or corporate communications, with a glossary, a stakeholder survey, and a deck about purpose.
What Do the SEC Cybersecurity Disclosure Rules Actually Require — Item 1.05 8-Ks and Item 106 Annual Disclosure?
The most expensive misreading of the SEC cybersecurity disclosure rules is also the most common one: that you have four business days from discovering an incident to file. You do not.
NYDFS Part 500's First Full Exam Cycle: What Must Your Matured Cybersecurity Program Now Evidence?
For three years, "we are still inside the transitional window" was a defensible answer to a DFS examiner. That answer is gone. The Second Amendment to 23 NYCRR 500 took effect November 1, 2023.
Now That the Texas Data Privacy and Security Act Is Fully in Force, What Does TDPSA Actually Require?
The Texas Data Privacy and Security Act is no longer a future obligation. The Act took effect July 1, 2024, and its last deferred provision, the authorized-agent and universal opt-out mechanism in Section 541.055(e), too…
Why Are Your SOC 2 Controls Mapped to the Trust Services Criteria but Not Evidenced for Operating Effectiveness?
Your control matrix looks finished. Every line item maps to a Trust Services Criterion. CC6.1 has an owner, CC7.2 has a policy, CC8.1 points at your change process.
Is Medical-Device Cybersecurity a Bolt-On or an EU MDR Conformity Obligation?
If your device runs software, the EU MDR already regulates its cybersecurity. Not as a recommendation, and not in a separate annex you can defer.
How Do the ISO 27001 Management-System Clauses (4-10) Actually Operate Day to Day?
Most teams chasing ISO 27001 spend ninety percent of their energy on Annex A. They build a control matrix, argue about whether they need a clear-desk policy, and treat the rest of the standard as a cover sheet.
PSD2 Today, PSD3 and the PSR Tomorrow: What's Settled Law and What's Still Only Proposed?
Most payment firms are doing the regulatory equivalent of packing for a trip whose itinerary hasn't been confirmed.
What Do the HIPAA Security Rule Safeguards Actually Require — and What Does 'Addressable' Mean?
"Addressable" is the most expensive word in the HIPAA Security Rule, because most teams read it as "optional." It is not optional.
Selling ICT Services Into EU Finance? What DORA Actually Requires From You as the Vendor
If you sell cloud, managed services, software, or any ICT capability into EU banks, investment firms, payment institutions, or insurers, DORA is already in your contracts.
Why Your Data Governance Program Doesn't Cover the EU Data Act
Here is a question worth asking your compliance team this quarter: which of your obligations under the EU Data Act are currently covered by your data governance program? If the answer is "the Data Act is a privacy thing,…
What Cyber-Risk-Management Baseline Does NIS2 Article 21 Actually Require?
Most teams reading NIS2 for the first time go looking for a control list and come back frustrated. Article 21 does not hand you 114 controls the way ISO 27001 Annex A does.
What Makes a GDPR Article 28 Processor Agreement Defensible? A Practical Guide for DPOs
Article 28 is the contractual backbone of every controller–processor relationship under GDPR. Here is what the text actually requires, where organisations fall short, and how to close the gap before a supervisory authority does.
The EU AI Act's GPAI Obligations Are in Force — and the Transparency Rules Are Next
Prohibited AI practices have been enforceable since February 2025. GPAI model obligations landed in August 2025. Now the clock is ticking on Article 50 transparency duties — they apply from 2 August 2026. Here is what you must have in place today, and what to build before next summer.
What Does DORA's ICT Third-Party Risk Register Actually Require?
DORA Article 28 turns the register of information from a vendor list into a supervised, always-current record. Here is exactly what it must contain, who maintains it, and what an inspection probes.
Point-in-time compliance is a fiction. Continuous is the only honest posture.
The annual audit gives you a photograph of a river. Continuous compliance gives you the water itself. It is time to stop framing snapshots as truth and start treating control posture as the living system it actually is.
NIS2 Is Law — But the EU Is Applying It Unevenly. Here Is What You Must Do Now.
The NIS2 Directive's EU-wide transposition deadline passed in October 2024, but member-state implementation is patchy — leaving essential and important entities caught between inconsistent national rules and real enforcement exposure. Here is the plain-language compliance agenda.
Inside the Three-Tier Risk Model: Inherent, Effectiveness, Residual
Most risk platforms give you a number. Aigis GRC gives you three — and the story behind each one. Here is how the inherent–effectiveness–residual stack works, and why it matters when a regulator or board asks you to show your work.
One Control, Many Frameworks: How Cross-Mapping Cuts Audit Prep by More Than Half
Running GDPR, SOC 2, ISO 27001, and DORA audits back-to-back shouldn't mean rebuilding your evidence pack four times. A unified control library maps once and satisfies many — here's how to build one that actually holds up.
One Cycle, Two Frameworks: How a Fast-Scaling Fintech Could Clear SOC 2 and ISO 27001 Together
An illustrative composite — not a specific customer. Running SOC 2 and ISO 27001 as two separate audits burns time, money, and engineering bandwidth a growth-stage fintech rarely has. Here is how a single overlapping evidence cycle could satisfy both.