Practical analysis of customer requirements, security and AI.
For leaders handling customer requirements, operating evidence and AI choices that need a clear decision.
- Third-Party RiskAccess Control
CPR leak: you hold lawful access to customer systems. Who gets the alert before the invoice?
The CPR leak shows why a security officer and a monthly statistic are not an alert. According to the ministry, an invoice drew attention to the misuse.
5 min read - Third-Party RiskIncident Response
The supplier is hit, not you. Who decides that it is also your incident?
Your systems are running. An incident at the supplier stops the delivery. Who may declare it yours, at what threshold, and which customers get told?
8 min read - Cyber Resilience ActProduct Security
The CRA's first deadline is not in 2027. Can your product team report within 24 hours?
The first CRA reporting requirements apply from 11 September 2026. Test the route from security signal to early warning, notification and user communication.
8 min read - AI GovernanceDecision-Making
When a new use of AI needs approval
When someone proposes using AI for a specific task, the idea may be easy to describe and still be difficult to decide.
7 min read - NIS2Cybersecurity Governance
NIS2 in year two: your policy stack was never the whole test
Use Denmark's NIS2 supervision material for a 30-minute drill that tests whether one operating evidence trail is current and traceable in normal work.
8 min read - EU AI ActAI Governance
Who owns AI governance? Start with decision rights
A practical method for assigning named AI decisions, evidence, escalation and review without transferring legal accountability or replacing legal advice.
11 min read - NIS2Supply Chain Security
When a customer asks for NIS2 supplier evidence
A buyer-specific method for reviewing NIS2-related supplier requests when your own company is outside direct scope.
8 min read
What do you need to decide or make work?
Tell us what needs to work and why it matters now. Add the deadline and the main blocker.
You will receive a direct answer on fit, what the first deliverable could be and what information is needed to begin.