NIS2 compliance: what the directive requires and how institutions get there
Who is in scope, the ten minimum security measures, the 24-hour reporting clock, personal liability for management, and the order in which to do the work.
What is digital sovereignty? A working definition for European institutions
Not a flag on a cloud contract. A testable definition: the demonstrated ability to keep operating, under your own law, when any single dependency is removed.
The EU AI Act compliance checklist for deployers
Most organisations are deployers, not providers. The fourteen checks that apply to them, in date order, with the article behind each one.
The EU AI Act explained: what applies now, what moved, and what European institutions must do next
Every deadline after the Digital Omnibus, every role, every authority in Germany and Greece, and the sovereignty question the Act leaves open.
Building an AI governance framework a European institution can defend
Most AI governance frameworks are written for an auditor and read by nobody. This one is built backwards from the question a board will actually ask.
Institutional AI strategy in Europe: from pilot theatre to operating posture
Pilots are cheap and prove nothing. A European institution's AI strategy is the set of commitments it can still honour when the vendor, the regulator or the politics change.
An EU AI Act compliance roadmap for high-risk deployments
Classification, gap assessment, documentation, conformity assessment, post-market monitoring — in the order that survives contact with an actual deployment.
Data residency vs data sovereignty: what European operators keep getting wrong
A regional cloud sticker is not sovereignty. The operational difference between residency, sovereignty and continuity — with three tests to apply on your next procurement.
Trusted AI for the public mission
Why institutional AI deployments fail at the boundary between model and mandate — and the framework that closes it.
Digital sovereignty as resilience, not protectionism
Sovereignty in critical infrastructure is a posture, not a vendor list. A field guide for European operators.
The EU AI Act and the operators of critical infrastructure
What Article 6 high-risk classification means in practice for energy, water, healthcare and financial market infrastructure.