Opinionated, evidence-grounded takes on where governance, risk, and compliance are heading — and what an honest security posture really requires.
Most sustainability teams built their CSRD program the way you build a bridge: survey the ground once, pour the foundations, and assume the terrain will hold. Then the 2025 Omnibus moved the ground.
Most records of processing activities are not records. They are archaeology. A spreadsheet built for a data-mapping exercise two years ago, updated the week before an audit, and otherwise untouched while the actual proce…
The European Health Data Space is not a future regulation you can park. Regulation (EU) 2025/327 was adopted on 11 February 2025 and is already in force. The application dates are fixed.
The Colorado AI Act stopped being a future problem on June 30, 2026. As enacted, SB 24-205 wrote its operative duties to apply "on and after February 1, 2026." A 2025 amendment, SB 25-004, pushed the applicability date t…
Your NYDFS certification is not a form. It is an attestation that the data behind it exists, is current, and could be produced on demand. That distinction is where most covered entities will get caught in 2026.
EMIR did not get rewritten. It got a new gravity well. For more than a decade, the question under the European Market Infrastructure Regulation was binary: is this class of OTC derivative subject to the clearing obligati…
