The 2026-2028 EU Digital-Law Deadline Calendar: One Board View of Every Trigger Date
The AI Act, CRA, Data Act, new PLD and EUDI Wallet all fire on overlapping schedules between 2026 and 2028. A single dated map so the board can sequence spend.
Pillar: Pillar 07 - Investment & Portfolio Control
Pillar 07 · Govern
The DORA Oversight Fee and Critical Third-Party Cost Model
DORA designation as a critical ICT third-party provider brings an annual oversight fee and a permanent compliance cost centre. Model both before the debit note arrives, not after.
Chargeback for AI: Token Budgets and Cost Allocation per Business Unit
Opaque AI spend becomes governable only when it is attributed. How to build per-business-unit chargeback for token consumption, from gateway tagging to budget alerts.
Platform Consolidation vs Best-of-Breed: The Question That Actually Decides It
“Consolidate onto one platform” and “pick best-of-breed for each function” both get argued as if one is universally right. Neither is. The question that actually matters is which specific cost each approach is asking you to accept — and most organisations pick a side before anyone has named the cost honestly. Consolidation’s advocates point to …
The Seams That Let You Replace a Vendor Later — Designed In, Not Retrofitted
You cannot retrofit replaceability into a system after it’s been built the wrong way for three years. The seams that let you swap a vendor later have to be designed in from the first architecture decision — and almost nobody makes that decision deliberately, because it costs a little more up front for a benefit …
The Vendor Evaluation Questions a Feature Comparison Will Never Ask
Every vendor RFP asks the questions a vendor is well-rehearsed to answer well. The questions that actually reveal risk are the ones a good salesperson visibly hesitates on — and most evaluation processes never ask them, because they don’t fit neatly into a feature-comparison scorecard. I’ve written about the build-vs-buy framework that has to survive …
The EU Data Act Gave You the Right to Leave Your Cloud Provider — Check Your Contract
The EU handed every cloud customer a statutory right to leave their provider without penalty. Most contracts, including ones signed well after the right became enforceable, still don’t reflect it — and the deadline to stop paying to leave arrives 12 January 2027. I’ve written elsewhere about measuring vendor lock-in before you sign. The Data …
Writing a Technology Strategy That Actually Fits on Two Pages
Most technology strategy documents are unread by design. Forty pages, a dozen slides of architecture diagrams, an executive summary nobody wrote last because nobody was forced to compress the argument first. A strategy that can’t fit on two pages usually isn’t a strategy — it’s an inventory wearing a strategy’s title. The length isn’t the …
Governance Is Not Who Decides. It’s How You Find Out.
Ask any organisation who’s responsible for a given technology decision and you’ll get an answer immediately. Ask them how they’d know if that person made the wrong call, and how long it would take to find out, and the confidence usually evaporates. Governance isn’t about who decides. It’s about how the organisation finds out, and …
Architecture Before Technology Selection: A Repeatable Decision Sequence
I’ve written about why regulation, and the data model, both have to precede the tool. This is the practical version of that argument — not the philosophy, the actual repeatable sequence, usable on any technology decision regardless of size, that keeps the reasoning from collapsing into “let’s just look at some vendors” by the second …