Blog
Compliance insights
Practical guides on NIS2, GDPR, DORA, and cybersecurity for startups and SMBs.
NIS2 Registration: How and When to Register in Each EU Country
Where to register under NIS2 in each Member State, the deadline, and the information the directive requires. Many deadlines have passed; Austria's runs to the end of 2026.
NIS2 Transposition Status by Country: All 27 EU Member States
24 of 27 Member States have a NIS2 law in force; France, Ireland, Spain do not. The national law, start date and authority for each country, checked monthly.
A2A Security: Securing Agent-to-Agent Communication (Protocol 1.0)
What the A2A 1.0 specification requires for authentication, agent card signing, task access and push notifications, the attacks OWASP describes, and a checklist for teams connecting agents.
OWASP Top 10 for Agentic Applications (2026) Explained, With Controls
ASI01 to ASI10 in plain English: what each agentic AI risk means for a company that uses agents, an example, and the first controls to put in place.
AI Agent Identity and Delegated Permissions: Who Is the Agent Acting As?
Shared accounts and borrowed tokens make agents impossible to control or audit. How to give each agent its own identity, delegate only what a task needs, and prove it to an auditor.
How to Audit an MCP Server: A Step-by-Step Security Review
Eight steps to review the MCP servers your company uses or builds, based on the MCP specification and the OWASP MCP Top 10, with what evidence to collect at each step.
Cyber Resilience Act for Importers and Distributors: Articles 19 to 23
Who counts as an importer or distributor, the checks before you sell, what to do about vulnerabilities and non-conforming products, the 10-year records, when you become the manufacturer, and the fines.
The Right to Erasure Under GDPR Article 17: When You Must Delete, and When You May Refuse
The six grounds for erasure, the five exceptions, the one-month deadline, telling recipients under Article 19, backups and anonymisation, and the seven problems regulators found in the EDPB's 2025 coordinated action.
GDPR Special Category Data: The Article 9 Conditions Explained
The categories in Article 9(1), why data can be special by inference, the ten conditions in Article 9(2), why you still need an Article 6 basis, and the DPIA, DPO and record-keeping duties that follow.
Standard Contractual Clauses: Which Module Do You Need?
The four modules of the 2021 standard contractual clauses and how to choose one, the options and annexes you must complete, why the clauses cannot be edited, when they do not apply, and the mistakes that make them ineffective.
Selling Software to Banks and Insurers: What DORA Means for ICT Providers
Why DORA reaches you through your financial customers, the clauses you will be asked to sign, what changes when you support a critical or important function, subcontracting, register data, and when direct oversight applies.
EU Data Act for Connected Products: Access by Design, User Data Rights and What Makers Must Do
Which products and services are covered, the access-by-design duty for products placed on the market after 12 September 2026, the information buyers must get, users' rights to their data, trade secrets and the small-company exemption.
AI Act Transparency Rules (Article 50): Chatbots, Deepfakes and AI-Generated Content
Who must tell people they are dealing with AI, who must mark generated content and by when (2 December 2026 for older systems), deepfake and AI text disclosure, the exceptions, and the code of practice.
The Six Lawful Bases Under GDPR Article 6: How to Choose the Right One
Consent, contract, legal obligation, vital interests, public task and legitimate interests: what each requires, how the Court of Justice reads "necessary", and a method to pick and record one basis per purpose.
When Is an Incident Significant Under NIS2? The Thresholds in Implementing Regulation 2024/2690
The general test in Article 23(3), the general criteria that apply to digital providers, and the specific thresholds for cloud, data centre, CDN, DNS, TLD, managed services, marketplaces, search engines, social networks and trust services.
The Cyber Resilience Act and Open Source: Maintainers, Stewards and Companies Using FOSS
When open-source software is in scope of the CRA, what the light-touch regime for open-source software stewards requires, and what manufacturers must do with the open-source components in their products.
AI Literacy Under the AI Act: What Article 4 Requires After the 2026 Omnibus
Who must act, what changed when the Digital Omnibus replaced Article 4 in July 2026, how the duty is enforced, and a proportionate AI literacy programme you can document.
Joint Controllers Under GDPR Article 26: When It Applies and What the Arrangement Needs
The test for joint control, five Court of Justice rulings from fan pages to consent frameworks, how it differs from controller to processor, and what to put in the Article 26 arrangement.
Data Protection by Design and by Default (GDPR Article 25): A Practical Checklist
The two duties in Article 25, the factors that decide what is appropriate, design measures for each GDPR principle following EDPB Guidelines 4/2019, and the defaults product teams should ship.
Transfer Impact Assessment (TIA): How to Do One After Schrems II
When you need a TIA and when you do not, the EDPB's six steps, the elements Clause 14 of the standard contractual clauses requires, supplementary measures that work, and how US transfers changed after the Data Privacy Framework.
EU Data Act Cloud Switching Rules: What SaaS and Cloud Providers Must Offer
Who counts as a data processing service, the clauses every cloud and SaaS contract now needs, the switching timeline, the end of switching charges on 12 January 2027, and what customers should ask for.
Cyber Resilience Act Requirements: The Annex I Checklist for Manufacturers
Every Annex I requirement in plain language, the manufacturer duties in Article 13 (risk assessment, support period, SBOM), product classes and which conformity assessment you need.
Do You Need a Data Protection Officer? GDPR Articles 37 to 39 Explained
The three cases in Article 37(1), how regulators read core activities, large scale and regular and systematic monitoring, national rules, who can be your DPO, and what the role involves.
Does DORA Apply to My Firm? Entity Types, Exclusions and Lighter Rules
The 20 types of financial entity in Article 2, what DORA means for ICT providers, the exclusions in Article 2(3), microenterprises and the simplified ICT risk management framework.
EU Compliance Questions in Your AI Assistant: Five Worked Examples With an MCP Server
NIS2 scope, a DORA major incident, a stolen laptop, a data broker privacy notice and an exploited vulnerability: what an assistant gets back from deterministic tools.
Incident Response for AI Agents: Prompt Injection, Rogue Actions and Reporting
What an agent incident looks like, how to contain it in the first hour, which reports may be due under GDPR, NIS2, DORA, the CRA and the AI Act, and a scenario to rehearse.
Assessing AI Agent Providers: A Questionnaire for NIS2, DORA and GDPR Article 28
What GDPR Article 28, NIS2 Article 21 and DORA Articles 28 and 30 require before you let a provider's agent touch your data and systems, and the questions to ask.
Securing MCP Servers and AI Agent Tools: A Practical Checklist
The attacks the MCP specification and OWASP name, the controls that stop them, and how they map to NIS2 Article 21, DORA and GDPR Article 32.
EU AI Act Timeline After the 2026 Digital Omnibus: What Applies When
The dates in force since 2025, what changed on 27 July 2026, the transparency rules that apply now, and the high-risk deadlines moved to December 2027 and August 2028.
AI Agents and GDPR: Legal Basis, Automated Decisions and DPIAs
Roles, legal basis, Article 22 after the SCHUFA and Dun & Bradstreet rulings, DPIAs, logs and retention, and the checks EDPB Opinion 28/2024 expects before you deploy someone else's model.
GDPR for SaaS Startups: The Minimum You Need on Day One
Your two GDPR roles, the six documents customers and investors will ask for, security and breach basics, transfers, and when you need a DPO or an EU representative.
NIS2 Penalties: Fines, Supervision and Enforcement Explained
The fine levels, the factors authorities must weigh, what counts as a serious infringement, supervision and enforcement powers, and the rule against double fines with GDPR.
DORA for Crypto-Asset Service Providers (CASPs)
Why MiCA-authorised CASPs and issuers of asset-referenced tokens fall under DORA, how MiCA points to DORA for ICT, and which DORA obligations matter most for crypto firms.
DORA Threat-Led Penetration Testing (TLPT): Who Must Do It and How
Who is selected for TLPT under Delegated Regulation 2025/1190, the phases and minimum 12-week red team test, tester requirements, and what everyone else tests instead.
Data Retention Policy: How Long to Keep Personal Data Under GDPR
The storage limitation principle, the four places GDPR expects retention to appear, how to set periods per data category, and how to actually delete or anonymise.
Security Awareness Training: What NIS2 and DORA Expect
Awareness for everyone, role-based training for technical staff, board training, suppliers, and how to show it works, under NIS2, Implementing Regulation 2024/2690 and DORA.
Backup and Recovery Requirements Under NIS2 and DORA
Backup plans, storage away from the main network, access control, integrity checks, restore testing, recovery objectives and redundancy, side by side for NIS2 and DORA.
NIS2 vs ISO 27001: How Much Does Certification Cover?
Where an ISO 27001 management system gives you a head start on NIS2, and the legal duties it does not cover: management liability, 24-hour reporting, registration and supervision.
How to Scope a Penetration Test (and What to Ask the Tester)
Objectives, test types, targets and exclusions, rules of engagement, authorisation, what the report must contain, and the questions to ask before you sign.
Incident Response Tabletop Exercise: 5 Scenarios for Small Teams
Ransomware, invoice fraud, a cloud outage, a misdirected email and a compromised supplier: five scenarios with injects, questions and the reporting clocks they start.
Information Security Policy: What to Include, Section by Section
The eleven elements EU rules list for a security policy, roles and reporting lines, the topic-specific policies underneath, and how to keep it alive.
NIST CSF 2.0 for Small Businesses: The Six Functions in Practice
Govern, Identify, Protect, Detect, Respond and Recover explained for small teams, how profiles and tiers work, and why CSF 2.0 is a useful map for NIS2 and DORA.
Transferring Data to US SaaS: The EU-US Data Privacy Framework Explained
How the 2023 adequacy decision works, why you must check the provider's certification, what the 2025 court ruling means, and what to use when a provider is not certified.
Cyber Resilience Act vs NIS2: Products vs Organisations
One law secures products, the other secures organisations. Who each covers, what it requires, how reporting and fines compare, and why many software companies face both.
DORA Exit Strategies and Exit Plans: Article 28(8) Explained
Exit strategies under Article 28(8), exit plans under Delegated Regulation 2024/1773, the transition period of Article 30(3)(f), and how to write a plan you could actually run.
Data Subject Access Requests: How to Respond Within One Month
What a person is entitled to under Article 15, the one-month deadline and extensions, proportionate identity checks, what the copy must contain, and when you can refuse or charge.
Legitimate Interest Assessment: The Three-Part Test After EDPB Guidelines 1/2024
The three cumulative conditions, how to articulate the interest, the necessity test, the four-part balancing in the EDPB's guidelines, and what to write down.
Cookie Banners: What EU Regulators Actually Check
The ePrivacy consent rule, and the banner practices EU data protection authorities agreed are invalid: no reject button, pre-ticked boxes, deceptive design and fake "essential" cookies.
NIS2 for Managed Service Providers (MSPs and MSSPs)
Whether you are an MSP under NIS2, which country supervises you, the detailed security requirements of Implementing Regulation 2024/2690, and when an incident is significant.
DORA ICT Risk Management Framework: What to Document (RTS 2024/1774)
A document map of the ICT risk management framework required by Delegated Regulation (EU) 2024/1774, article by article, with the simplified framework for smaller firms.
Data Processing Agreement (GDPR Article 28): Clause-by-Clause Checklist
The details every DPA must describe, the eight processor obligations of Article 28(3), sub-processor rules, the Commission's standard clauses and common gaps.
NIS2 and the Board: Management Liability and Training Under Article 20
What Article 20 requires from directors, how personal liability and temporary management bans work under Articles 32 and 33, and a practical board routine.
NIS2 Supply Chain Security: What to Ask Your Suppliers
What Article 21(2)(d) and 21(3) require, the detailed supplier rules of Implementing Regulation 2024/2690, and the questions and contract clauses to use.
DORA Contract Requirements: Article 30 Clause Checklist for ICT Providers
Every clause Article 30 requires, the extras for critical or important functions, the termination rights of Article 28(7), and the 2025 subcontracting rules.
GDPR Record of Processing Activities (RoPA): What Article 30 Requires
The fields Article 30 requires from controllers and processors, why the 250-employee exemption rarely helps, the pending reform, and a practical way to build the record.
Does NIS2 Apply to My Company? Sectors, Size Rules and Examples
The 18 sectors, the medium-size rule and how group companies count, the cases that apply regardless of size, essential versus important, and worked examples.
What a GDPR Privacy Policy Must Contain: Articles 13 and 14 Checklist
Every item Articles 13 and 14 require, with article references, what changes when you get data from other sources, and how to write it so people actually understand it.
What Is a Cyber Risk Score and How Is It Calculated?
Likelihood and impact, control-based scores and outside-in ratings: how cyber risk scores are calculated, what they miss, and how to use one well.
How to Answer an Enterprise Customer's Security Questionnaire
What enterprise security questionnaires ask, how to answer honestly without losing the deal, which evidence to attach, and what to do when they ask for a penetration test.
Cyber Resilience Act Reporting: What Manufacturers Must Report Since 11 September 2026
Actively exploited vulnerabilities and severe incidents: the 24-hour, 72-hour and final report deadlines, where reports go, and why products already on the market are covered.
DORA Major ICT Incident Classification: Criteria and Thresholds Explained
The critical-services gate, the materiality thresholds of Delegated Regulation (EU) 2024/1772, recurring incidents and what happens once an incident is major.
How GDPR Fines Are Calculated: The EDPB Method in Five Steps
The legal maximum, the three seriousness bands, the turnover adjustment for smaller companies and the final checks, with a worked example for a small company.
GDPR Breach Notification: The 72-Hour Rule Step by Step
When a breach must be reported, when the 72 hours start, what the notification to the authority must contain, and when you must also tell the people affected.
NIS2 Compliance Checklist for SMBs: Article 21 Measure by Measure
Scope and registration, management duties, the ten Article 21 security measures and incident reporting readiness, each with what to have in place and the article behind it.
DORA Register of Information: What to Include, Template by Template
The 15 templates of Implementing Regulation (EU) 2024/2956, the fields that take the most work, the yearly reporting cycle and a practical order for building the register.
NIS2 Directive Explained: What It Is, Who Must Comply and What It Requires (2026)
NIS2 in plain English: who is in scope, the 10 Article 21 measures, the 24h/72h/1-month reporting deadlines, fines and management liability.
How Much Does a GDPR Data Breach Really Cost? [2026 Data]
Beyond the headline fines — the true cost breakdown of a GDPR breach including legal fees, notification costs, customer churn, and remediation.
DORA Compliance Checklist: 59 Requirements by Article (Free Template, 2026)
Every core DORA requirement with its article reference and microenterprise exemptions, as a checklist you can tick off and print, plus a practical roadmap for smaller financial firms.
How to Write an Incident Response Plan (Free Template)
Step-by-step guide to creating an incident response plan that meets NIS2 and GDPR notification requirements. Includes a free policy generator.
Vendor Risk Assessment: A Practical Guide for Startups
How to assess and manage third-party vendor security risk as a startup. Step-by-step process, tier classification, and contractual protections.
GDPR Data Protection Impact Assessment: Step-by-Step Guide
When is a DPIA required, what must it contain, and how to conduct one step by step. Practical guide for GDPR Article 35 compliance.
NIS2 vs GDPR: What Is the Difference and How They Overlap
Understanding the relationship between NIS2 and GDPR — scope, incident reporting, security measures, governance, penalties, and how to comply with both.
Top GDPR Fines in 2025-2026: Lessons for Your Business
Analysis of major GDPR enforcement actions — what drives the largest fines, patterns across DPAs, and practical lessons for your compliance strategy.
Cybersecurity Checklist for Startups: 20 Things to Do Before Your First Enterprise Client
The 20 security measures that matter most — ordered by impact. Start with the first 10: they give the biggest risk reduction for the effort.
NIS2 Incident Reporting: How to Meet the 24-Hour Deadline
Exactly what to report, to whom, and how to build a process that meets NIS2's 24-hour early warning requirement every time.