Opinionated, evidence-grounded takes on where governance, risk, and compliance are heading - and what an honest security posture really requires.
Most Australian entities ran their CPS 230 contract work off renewal dates. Insert the new terms when the agreement comes up, and the problem solves itself.
A vendor hands you a certificate. You need to conclude something about one model, inside one product, making one class of decision about your customers. The certificate will not tell you that.
Sixteen weeks from now a date lands that does not ask you to replace a single algorithm. 31 December 2026 is the EU's first post-quantum checkpoint.
Your client hired you to run their CUI environment. That decision moved your service inside their assessment. Not next to it. Inside it.
In one week, a European reporting duty switches on for software you shipped in 2019 and stopped thinking about in 2021. Most of the Cyber Resilience Act does not apply until December 2027.
A month ago the AI Act stopped being something your legal team reads and became something a market surveillance authority can act on. Not all of it. That is where most gap lists go wrong.
