Writing on what actually applies.
Practical notes on AI Act enforcement, GDPR operationalisation, ISO 42001, SaMD, and the gap between compliance documentation and compliance reality. Written for operators, not lawyers.
All articles.
SaMD and GDPR data minimisation: the architectural decision that protects the entire stack
Software as a Medical Device is, by its nature, data-hungry. GDPR's data minimisation principle sits in direct tension with clinical utility — and the reconciliation is architectural, not contractual. Most SaMD companies discover this at the wrong stage of product design.
Third-party risk management for AI integrations: the diligence most programmes are not running
Classic TPRM was built for vendors that process data and run services. AI integrations introduce new risk surfaces — model behaviour, training data provenance, evaluation transparency, governance posture — that standard vendor questionnaires do not surface. If your TPRM programme has not been updated for AI, your supply-chain risk is larger than your register shows.
NIS2 scope creep: why companies that thought they were out are finding themselves in
NIS2 was sold as a directive for critical infrastructure. Its transposition across Member States has produced a scope that reaches deeper into digital supply chains than most scale-ups budgeted for. If you sell into energy, health, transport, or the public sector, the obligations may already apply to you — even if your own sector is not on the list.
GPAI obligations: what downstream providers keep getting wrong
The EU AI Act's provisions on general-purpose AI models create obligations that cascade through the value chain. Most scale-ups that integrate third-party AI assume the provider carries the weight. That assumption is wrong more often than it is right.
ISO 42001 and ISO 27001: what overlaps, what does not, and what it means for your ISMS
ISO 42001 is an AI management system. ISO 27001 is an information security management system. They share structure, share evidence, and can share a common operating backbone — but the controls that matter most are different. Here is where they meet, where they diverge, and how to run one programme covering both.
GDPR and the EU AI Act: where the two regimes stack, and where they fight
Most AI governance programmes treat GDPR and the EU AI Act as adjacent compliance exercises. They are not. They overlap meaningfully, conflict in specific places, and require deliberate design to satisfy both without double-running every control.
Prefer a conversation to an article?
30-minute scoping call. Direct line to Hachem.
Request scoping →