Analysis of the regulation and how it really applies
No filler content: we write when there is a new fact or a recurring mistake to correct. One letter every two weeks, and you can unsubscribe with one click.
Latest articles
The pillar guide: what Art. 14 requires, the 24h/72h/final-report chains, exploited vs reported, sanctions and what to do before 11 September.
The reporting obligations arrive fifteen months before the essential requirements. What changes, concretely.
When the early-warning obligation is really triggered, with three real qualification cases.
The deadline runs from the moment of awareness: how to fix and document it.
Two administrative prerequisites that run on timelines not your own: prepare them now.
Deciding not to report is legitimate, but it must be reasoned and documented: how a manufacturer defends itself.
Three real qualification cases, with the reasoning we would write in the register and the one that does not hold up under inspection.
Thresholds, roles and channels. Why alerting the entire mailing list is the surest way to have no one respond.
What to ask the researcher, what never to ask, and how the tracking number reduces surprise disclosures.
From Syft to Dependency-Track: how to link third-party components to products and find the right maintainer contact.
Vulnerabilities and severe incidents follow different chains. The most common mistake in the internal processes we have seen.
The structure of a case file that holds up: facts, timelines, decisions, communications. With the index we use ourselves.
The Thursday letter
Every two weeks: one regulatory update explained in ten lines, one mistake seen in the field, one thing to fix before the next report. Nothing else.