Insights
Regulation, technology and the way regulated organisations actually run. Written by the people who do the work, not by a marketing team.
Featured
The Cost of a Decision Collapsed in Three Weeks. Most Architectures Cannot Collect.
On 15 September 2026, a company called TypeSafe released a model named Jev that did something unusual: instead of writing an answer, it returned a value chosen from a list of options supplied with the question. In the three weeks that followed, Cloudflare released Clef, Amazon’s…
AllRegulatory complianceResilience & securityRisk & assuranceTechnology & digital
Model Risk Is Not New. What Changed Is Who Uses the Model.
For fifteen years, a bank could answer a simple question with a number. How many models do you run? The model inventory gave the figure, and next to…
The Change Nobody Initiated
A process that worked in March produces subtly worse output in September. Nobody changed the code. No release went out. There is no ticket, no incident, no alert.…
Europe just moved on cloud sovereignty — and the question every provider will face isn’t “if”, it’s “which level”
On 3 June 2026, the European Commission adopted its proposal for the Cloud and AI Development Act (CADA) — a Regulation built to close a gap the numbers…
The Cyber Resilience Act countdown has started
The Cyber Resilience Act (Regulation (EU) 2024/2847) is the first horizontal cybersecurity law covering all products with digital elements placed on the EU market — hardware, software, and…
Too Much Central Control Kills Development. Too Little Produces Chaos.
In Five Barriers CEOs Must Overcome for AI Impact, published in March, BCG puts a number on something most people running AI programmes can feel but struggle to…
Adoption Tripled. Governance Went Backwards.
Two numbers from this year, moving in opposite directions. Regular use of AI on corporate devices went from 15% of employees to 45% in twelve months, according to…
The EBA Did Not Ask for More Documentation. It Asked Whether Yours Holds.
On 18 September, the EBA published its Guidelines on the sound management of third-party risk for non-ICT services (https://www.eba.europa.eu/publications-and-media/press-releases/eba-publishes-its-final-guidelines-management-third-party-risk-delivering-more-proportionate-and). The EBA presents them as a simplification, focused on…
Four Things Keep Going Wrong. They Are One Thing, Arriving in Four Stages.
Four things keep going wrong. They look like four separate problems, which is why they get separate owners — strategy to the executive committee, governance to risk, tool…
Your Supervisors Sent Messages This Summer. They Are One Instruction Set.
Between late June and mid-August, four developments landed in the Luxembourg financial sector. Not all of them were addressed to every entity — one went only to significant…
Why we write. Most of what we know was learned on an engagement, not in a textbook. Publishing it is how you judge our thinking before spending anything.