Pillar 08 · Govern
Whether you tokenise cards in your own vault or rely on network tokens is an architecture decision disguised as a payments optimisation. How to choose deliberately on PCI scope, auth rates and lock-in.
The DORA subcontracting RTS forces you to model the full chain supporting critical functions. That is a graph-data and monitoring problem, not a contract-review one.
A large share of your AI Act evidence lives inside your vendors. Here is the flow-down of contractual attestations and technical proof to demand from model and tool suppliers before you sign.
The 2023 interagency guidance and regional-bank stress made cloud and core-provider concentration a board-owned risk. How US banks should quantify dependence and evidence exit optionality.
A software bill of materials is only worth anything if you can prove where it came from. Here is how to generate, sign and attest SBOMs and provenance in the pipeline so supply-chain claims become verifiable evidence.
The CRA moves the manufacturer duty onto whoever commercialises open-source software, not the volunteers who wrote it. Map where your use of OSS makes you the accountable economic operator.
A vendor SBOM sitting in a drawer is worthless. The value comes from ingesting it and continuously matching components against vulnerability and known-exploited feeds to produce a live third-party risk signal.
Under the CRA, manufacturers stay accountable for integrated third-party and open-source components. A practical playbook for attestations, SBOM ingestion, triage and contracts.
Under the AI Act, re-branding, fine-tuning or changing a system’s intended purpose can turn a deployer into a provider and hand it the full provider obligation set. Here is the role test to run before procurement decides for you.
The Data Act removes cloud switching and egress charges entirely from 12 January 2027, and caps them at cost until then. That is a prompt to renegotiate provider contracts now, not a date to wait for.