Opinionated, evidence-grounded takes on where governance, risk, and compliance are heading - and what an honest security posture really requires.
Leaving your GRC vendor may be about to get cheaper. Taking your audit trail with you is a separate problem. It is the one that decides whether you can actually leave. The EU Data Act takes away the exit fee.
AIFMD II did not arrive in one piece. It arrived in two. The first wave reached the rulebook in April 2026.
Most privacy teams talk about Maryland's cure period as if it were a safety net. It is not a net. It is a door the regulator may choose to open. And the statute already says which violations that door can open for.
Most German goods dealers think money-laundering law is about cash. Take no large cash payments, the reasoning goes, and the Geldwäschegesetz (GwG) has nothing to say to you.
If software already screens your applicants, approves or declines your loans or allocates your shifts, you have about 13 weeks. Not to write a policy.
Your first California cybersecurity audit report is due in April 2028. That date is a distraction. The period the auditor examines opens in about three months.
