Practical analysis of customer requirements, security and AI.
For leaders handling customer requirements, operating evidence and AI choices that need a clear decision.
- AI GovernanceSecurity Questionnaires
Your customer goes over your AI with a fine-tooth comb, too
An AI policy does not answer the AI section of a customer security questionnaire. Here are the four questions and the documentation the customer can check.
8 min read - Third-Party RiskIncident Response
The supplier is hit, not you. Who decides that it is also your incident?
Your systems are running. An incident at the supplier stops the delivery. Who may declare it yours, at what threshold, and which customers get told?
8 min read - Cyber Resilience ActProduct Security
The CRA's first deadline is not in 2027. Can your product team report within 24 hours?
The first CRA reporting requirements apply from 11 September 2026. Test the route from security signal to early warning, notification and user communication.
8 min read - AI GovernanceDecision-Making
When a new use of AI needs approval
When someone proposes using AI for a specific task, the idea may be easy to describe and still be difficult to decide.
7 min read - NIS2Cybersecurity Governance
NIS2 in year two: your policy stack was never the whole test
Use Denmark's NIS2 supervision material for a 30-minute drill that tests whether one operating evidence trail is current and traceable in normal work.
8 min read - EU AI ActAI Governance
Who owns AI governance? Start with decision rights
A practical method for assigning named AI decisions, evidence, escalation and review without transferring legal accountability or replacing legal advice.
11 min read - NIS2Supply Chain Security
When a customer asks for NIS2 supplier evidence
A buyer-specific method for reviewing NIS2-related supplier requests when your own company is outside direct scope.
8 min read
Start with the matter that is current.
A short description is enough. Name the requirement or AI use and when the decision is needed. Add the people involved.
The reply says whether the matter fits. It also outlines the likely first deliverable and the information needed to begin.