What is actually changing in AI and data regulation across the EU, the United States and the UK — and, for each change, the one thing a board will be asked to produce.
Updated each quarter · Free to read · Free to share
New rules. Public scrutiny. Each entry names the obligation — and the evidence you can show a regulator, or defend to investors if a fine follows.
A rule that is an administrative burden in one sector is an operating constraint in another. These are the four verticals where the current wave bites hardest, and the obligation that arrives first in each.
Systems managing generation, supply and critical infrastructure fall squarely inside EU AI Act high-risk scope, while NIS2 makes the management body personally accountable for supply-chain security.
Operational data trusted for years without independent verification becomes the record a regulator reads after an incident. Reconstructing lineage afterwards is the finding, not the remedy.
Network telemetry is high volume and low lineage. Essential-entity status under NIS2 is not optional, and the evidence expected covers providers as well as your own perimeter.
Where AI sits inside a regulated device, clinical data provenance is the first thing an inspector asks for — and the commercial consequence is removal from market rather than a financial penalty.
Your sector not here? The method does not change by sector — the evidence pack does. See all sectors we serve.
Reading the regulation is the easy half. The hard part is knowing what your peers decided to evidence, what they decided to accept, and what they found when they tried.
Twelve people, once a month. One speaker who has run the problem, then discussion under Chatham House Rule.
Thirty minutes with someone who has run this before. We map where your evidence already exists, where it does not, and what closing the gap actually takes.
