Board Lens
Regulation, governance, and cyber risk translated for the board perspective.
For Boards, C-suite, senior management.
Declining to adopt AI does not take a company out of AI risk
A joint study by Germany's federal cybersecurity authority and the TÜV Association finds that 17 percent of companies registered an attack or fraud attempt in the past year in which AI played or could have played a role. The 42 percent that neither use AI nor plan to are exposed to those attacks all the same. Staying out of AI settles the risk a company creates for itself and leaves the risk attackers bring untouched.
Read the analysis →A text watermark marks the model, and the disclosure duty stays with the publisher
OpenAI has begun marking ChatGPT and Codex text with an invisible watermark for EU users, framed as AI Act compliance. The mark is evidence about the provider's system. Whether a company must disclose AI-generated text on matters of public interest turns on something the mark cannot show: documented human review and a named person with editorial responsibility.
Read the analysis →When a shared supplier is breached, each customer answers for what it sent
Sweden's privacy regulator has fined an HR systems supplier SEK 1.8 million for a breach that touched about 2.2 million people, and kept its inspections of the supplier's customers open. The supplier answers for how the data was protected. Each customer answers for why the data was there at all, and that second question is the one a board can govern.
Read the analysis →The Cyber Resilience Act now reaches back into everything already shipped
A duty that took effect on 11 September 2026 applies to products placed on the EU market years ago, including products that may never have to meet the Regulation's security requirements. What a board governs now is whether the company could report an exploited flaw in its own back catalogue within 24 hours.
Read the analysis →A supplier's rulebook can change without the contract changing
A regulator changed ChatGPT's status under the Digital Services Act without touching a single customer contract, and the service changes land within four months.
Read the analysis →Logging choices now set the evidence ceiling
CISA's new logging guidance turns a technical cost decision into a board question about what a company can prove under regulatory pressure.
Read the analysis →The Clock DORA Starts the Moment You Notice, Not the Moment You Are Sure
The EU Digital Operational Resilience Act gives financial entities a hard reporting clock for major ICT incidents. What is easy to miss is when that clock actually starts, and what that means for a board.
Read the analysis →