Short reads on the rules our clients are bumping into. Written for the engineer, the GC, and the founder — in roughly that order.
Audit cadence (clause 7.3) is doing more work than most teams realise. A short walkthrough of why we redline it on every paper that crosses our desk.
What we tell clients to do in hour one, hour eight, and hour seventy-one — and why the calmest people in the room usually end up writing the disclosure.
Three quarters of Annex III systems use the provider's internal control route. Here's the actual paper trail you need — and what you can stop worrying about.
The over-engineered ROPA dies on contact with a real product team. Our short version captures what regulators need without the busywork. Template inside.
The 2025 EU-US framework is on borrowed time. We map what changes if it falls, what doesn't, and which of your contracts have the bigger problem.
Most model cards become stale within a sprint. The fields that keep up are the ones tied to behaviour, not architecture. A field-by-field defence of the short card.
A Python script we use to triage data-subject access requests across CRMs. Open source, opinionated, and saves about half a paralegal day per request.
Three rules for the regulator notification: name the personal data, name the likely impact, name what you've done. A redlined sample, with the language we delete.
Half of vendor papers we see paste in Article 28 verbatim. Here's what regulators read between those lines — and the four words to actually add.