Blog

GRC insights, framework guides, and practitioner perspectives.

Featured

High-Risk AI Systems Under the EU AI Act: The Classification Test After the Digital Omnibus

Which AI systems are high-risk under the EU AI Act? Annex III, the Article 6(3) derogation, the profiling bar, and the new deadlines after Regulation (EU) 2026/1744.

11 August 2026

evaluative

"We're out of scope" is not a CRA answer

Medical devices, vehicles, aviation, marine equipment, spare parts and non-commercial open source are excluded from the Cyber Resilience Act. Every one of those exclusions is narrower than it reads, and none of them touch your NIS2 duties.

10 August 2026

procedural

The CRA lands on your procurement desk too: what to ask your suppliers

The Cyber Resilience Act regulates manufacturers, not the organisations that buy from them. What you can legitimately ask suppliers before December 2027, the ten questions that get substantive answers, and the contract clauses worth having now.

10 August 2026