Briefings, analysis and checklists in three languages — dated, sourced and reviewed as the rules move.
The provisional omnibus agreement moves Annex III high-risk obligations to 2 December 2027 and product-embedded systems to August 2028. It does not move everything — here is the map.
Regulation (EU) 2024/1624 applies from 10 July 2027. The organisations that will cross that date calmly are doing three unglamorous things now:…
Read →From 11 September 2026, manufacturers must report actively exploited vulnerabilities and severe incidents — 24-hour early warning included. The rest of the…
Read →Chain of title, contractor assignments, open-source licences and data provenance — fixed before the term sheet, not after. A practical sequence.
Read →Most board packs document diligence instead of enabling it. Five structural changes turn a reporting ritual into a decision instrument.
Read →