https://sameerkhairkar.com/ EU digital regulation, made operational: practical resources for DORA, NIS2, the EU AI Act and GDPR. en-GB Tue, 01 Sep 2026 11:03:55 +0000 Sameer Khairkar https://sameerkhairkar.com/blog/2026/09/01/a-control-framework-is-six-hundred-unchecked-claims-about-a-law/ https://sameerkhairkar.com/blog/2026/09/01/a-control-framework-is-six-hundred-unchecked-claims-about-a-law/ A 200-control framework makes roughly 600 checkable claims about a law, and nobody checks them because there is no mechanism. regcheck is that mechanism: seven automated checks against the consolidated text, with a non-zero exit code. Tue, 01 Sep 2026 00:00:00 +0000 Sameer Khairkar EU AI Act Tools https://sameerkhairkar.com/blog/2026/09/01/which-regulation-wins-there-is-a-rule-for-that/ https://sameerkhairkar.com/blog/2026/09/01/which-regulation-wins-there-is-a-rule-for-that/ DORA, NIS2, GDPR and the AI Act land on the same desk and appear to contradict each other. Three CJEU principles decide which one wins, and they are consulted in a fixed order. Tue, 01 Sep 2026 00:00:00 +0000 Sameer Khairkar Meta https://sameerkhairkar.com/blog/2026/08/31/your-vendor-questionnaire-never-asks-who-owns-the-company/ https://sameerkhairkar.com/blog/2026/08/31/your-vendor-questionnaire-never-asks-who-owns-the-company/ Third-party questionnaires ask what data a vendor touches and where it runs. They almost never ask who owns the company, which is a sanctions obligation with no size threshold and close to strict liability. Mon, 31 Aug 2026 00:00:00 +0000 Sameer Khairkar NIS2 https://sameerkhairkar.com/blog/2026/08/12/the-digital-omnibus-didnt-delay-the-ai-act-it-rewrote-parts-of-it/ https://sameerkhairkar.com/blog/2026/08/12/the-digital-omnibus-didnt-delay-the-ai-act-it-rewrote-parts-of-it/ Regulation (EU) 2026/1744, the Digital Omnibus on AI, did more than delay the AI Act. Six substantive changes, read from the consolidated EUR-Lex text rather than the press summaries. Wed, 12 Aug 2026 00:00:00 +0000 Sameer Khairkar EU AI Act https://sameerkhairkar.com/blog/2026/08/12/stop-asking-how-important-your-server-is/ https://sameerkhairkar.com/blog/2026/08/12/stop-asking-how-important-your-server-is/ Asset registers rate servers on their own merits and produce numbers nobody can defend. BSI-Standard 200-2 and ISO/IEC 27005 do it the other way round: rate the process once, and let everything underneath inherit. Wed, 12 Aug 2026 00:00:00 +0000 Sameer Khairkar ISO 27001 https://sameerkhairkar.com/blog/2026/08/11/clause-4-decides-your-certificate-before-you-pick-a-single-control/ https://sameerkhairkar.com/blog/2026/08/11/clause-4-decides-your-certificate-before-you-pick-a-single-control/ ISO/IEC 27001 Clause 4 decides the ISMS before a single control is chosen. Four subclauses, four questions, and a scope decision that everything downstream inherits and the certificate names. Tue, 11 Aug 2026 00:00:00 +0000 Sameer Khairkar ISO 27001 https://sameerkhairkar.com/blog/2026/08/11/the-hard-part-of-iso-27001-is-not-the-policies/ https://sameerkhairkar.com/blog/2026/08/11/the-hard-part-of-iso-27001-is-not-the-policies/ Most ISO 27001 template packs hand you the policies and leave the proving as an exercise. Inverting that, so the workbook is the centre and every requirement is a row that cannot be quietly skipped. Tue, 11 Aug 2026 00:00:00 +0000 Sameer Khairkar ISO 27001 https://sameerkhairkar.com/blog/2026/08/10/the-esas-just-told-you-what-dora-expects-about-ai-driven-attacks/ https://sameerkhairkar.com/blog/2026/08/10/the-esas-just-told-you-what-dora-expects-about-ai-driven-attacks/ The ESAs joint statement of 31 July 2026 on frontier AI models used to find and exploit vulnerabilities, and what it implies for DORA asset and function mapping. Mon, 10 Aug 2026 00:00:00 +0000 Sameer Khairkar DORA https://sameerkhairkar.com/blog/2026/07/30/nobody-knows-how-to-scope-a-control-framework/ https://sameerkhairkar.com/blog/2026/07/30/nobody-knows-how-to-scope-a-control-framework/ Three columns in the Secure Controls Framework are empty on purpose: MCR and DSR are where you record which of 252 instruments bind you. A tool that fills them, and the CC BY-ND licence lesson behind it. Thu, 30 Jul 2026 00:00:00 +0000 Sameer Khairkar Tools https://sameerkhairkar.com/blog/2026/07/29/dora-oversight-and-the-whole-regulation-on-one-page/ https://sameerkhairkar.com/blog/2026/07/29/dora-oversight-and-the-whole-regulation-on-one-page/ DORA Chapter V section II and the EU-level oversight of critical ICT third-party providers, plus the whole regulation mapped article to Level 2 standard on one page. Wed, 29 Jul 2026 00:00:00 +0000 Sameer Khairkar DORA https://sameerkhairkar.com/blog/2026/07/28/dora-and-the-register-of-information-your-vendor-list-is-now-a-regulated-filing/ https://sameerkhairkar.com/blog/2026/07/28/dora-and-the-register-of-information-your-vendor-list-is-now-a-regulated-filing/ DORA Article 28(3) and ITS 2024/2956: what the register of information must contain, and why one line of the regulation becomes a quarter of the implementation effort. Tue, 28 Jul 2026 00:00:00 +0000 Sameer Khairkar DORA https://sameerkhairkar.com/blog/2026/07/27/dora-articles-28-to-30-your-vendors-are-now-your-problem-in-writing/ https://sameerkhairkar.com/blog/2026/07/27/dora-articles-28-to-30-your-vendors-are-now-your-problem-in-writing/ DORA Articles 28 to 30 on ICT third-party risk: the principles, the register, and the contractual clauses the regulation now requires, including the enhanced Article 30(3) set. Mon, 27 Jul 2026 00:00:00 +0000 Sameer Khairkar DORA https://sameerkhairkar.com/blog/2026/07/26/dora-chapter-iv-testing-and-the-tlpt-that-is-not-a-normal-pen-test/ https://sameerkhairkar.com/blog/2026/07/26/dora-chapter-iv-testing-and-the-tlpt-that-is-not-a-normal-pen-test/ DORA Chapter IV, Articles 24 to 27: the digital operational resilience testing programme, and how threat-led penetration testing differs from the annual pen test most firms already buy. Sun, 26 Jul 2026 00:00:00 +0000 Sameer Khairkar DORA https://sameerkhairkar.com/blog/2026/07/25/dora-chapter-iii-incident-reporting-where-the-clock-is-measured-in-hours/ https://sameerkhairkar.com/blog/2026/07/25/dora-chapter-iii-incident-reporting-where-the-clock-is-measured-in-hours/ DORA Chapter III, Articles 17 to 23: incident management and the reporting cascade, with the statutory deadlines that turn an outage into a regulated filing measured in hours. Sat, 25 Jul 2026 00:00:00 +0000 Sameer Khairkar DORA https://sameerkhairkar.com/blog/2026/07/24/dora-article-16-the-simplified-regime-is-lighter-not-optional/ https://sameerkhairkar.com/blog/2026/07/24/dora-article-16-the-simplified-regime-is-lighter-not-optional/ DORA Article 16, the simplified ICT risk management framework: who qualifies, what it still requires, and why it is a lighter regime rather than an exemption. Fri, 24 Jul 2026 00:00:00 +0000 Sameer Khairkar DORA https://sameerkhairkar.com/blog/2026/07/23/dora-articles-13-and-14-the-quiet-articles-that-decide-if-you-improve/ https://sameerkhairkar.com/blog/2026/07/23/dora-articles-13-and-14-the-quiet-articles-that-decide-if-you-improve/ DORA Articles 13 and 14 on learning and communicating after an incident. No hard thresholds, and in practice the difference between a mature resilience function and a merely compliant one. Thu, 23 Jul 2026 00:00:00 +0000 Sameer Khairkar DORA https://sameerkhairkar.com/blog/2026/07/22/the-document-list-bafin-walks-in-with/ https://sameerkhairkar.com/blog/2026/07/22/the-document-list-bafin-walks-in-with/ BaFin published its own list of the documents it expects under DORA. Every one of them, mapped to the article that justifies it, plus the gap between that list and what most policy stacks actually contain. Wed, 22 Jul 2026 00:00:00 +0000 Sameer Khairkar DORA https://sameerkhairkar.com/blog/2026/07/22/dora-articles-11-and-12-what-recover-has-to-actually-mean/ https://sameerkhairkar.com/blog/2026/07/22/dora-articles-11-and-12-what-recover-has-to-actually-mean/ DORA Articles 11 and 12 on ICT business continuity and backup. Recovery objectives are testable in a way policies are not: either you restored inside your stated objective or you did not. Wed, 22 Jul 2026 00:00:00 +0000 Sameer Khairkar DORA https://sameerkhairkar.com/blog/2026/07/21/dora-article-10-detection-and-the-exact-numbers-that-make-an-incident-major/ https://sameerkhairkar.com/blog/2026/07/21/dora-article-10-detection-and-the-exact-numbers-that-make-an-incident-major/ DORA Article 10 on ICT incident detection, and the classification thresholds in RTS 2024/1772 that decide when an incident becomes major and the reporting clock starts. Tue, 21 Jul 2026 00:00:00 +0000 Sameer Khairkar DORA https://sameerkhairkar.com/blog/2026/07/21/the-dpia-and-the-fria-are-one-assessment-not-two/ https://sameerkhairkar.com/blog/2026/07/21/the-dpia-and-the-fria-are-one-assessment-not-two/ AI Act Article 27(4) says the FRIA complements the DPIA rather than replacing it. Running them as two separate exercises duplicates the work and lets the two risk registers drift apart. Tue, 21 Jul 2026 00:00:00 +0000 Sameer Khairkar EU AI Act GDPR https://sameerkhairkar.com/blog/2026/07/20/dora-article-9-protection-and-prevention-where-the-rts-stops-being-polite/ https://sameerkhairkar.com/blog/2026/07/20/dora-article-9-protection-and-prevention-where-the-rts-stops-being-polite/ DORA Article 9 on protection and prevention, and the point where the RTS stops speaking in principles and starts naming encryption, patching, logging and network segmentation. Mon, 20 Jul 2026 00:00:00 +0000 Sameer Khairkar DORA https://sameerkhairkar.com/blog/2026/07/20/dora-on-one-page--now-interactive/ https://sameerkhairkar.com/blog/2026/07/20/dora-on-one-page--now-interactive/ The DORA package as an interactive graph rather than a table: 14 legal acts, 215 articles, and the implements-links and cross-references between them. Mon, 20 Jul 2026 00:00:00 +0000 Sameer Khairkar DORA Tools https://sameerkhairkar.com/blog/2026/07/19/dora-articles-7-and-8-you-cannot-protect-what-you-have-not-written-down/ https://sameerkhairkar.com/blog/2026/07/19/dora-articles-7-and-8-you-cannot-protect-what-you-have-not-written-down/ DORA Articles 7 and 8 demand a complete, current picture of the ICT systems and functions you run. Most organisations quietly do not have one, and everything downstream inherits that gap. Sun, 19 Jul 2026 00:00:00 +0000 Sameer Khairkar DORA https://sameerkhairkar.com/blog/2026/07/18/dora-article-6-the-framework-on-paper-and-the-rts-that-makes-it-real/ https://sameerkhairkar.com/blog/2026/07/18/dora-article-6-the-framework-on-paper-and-the-rts-that-makes-it-real/ DORA Article 6 and the ICT risk management framework, read together with the delegated regulation that carries the half of the requirement most write-ups leave out. Sat, 18 Jul 2026 00:00:00 +0000 Sameer Khairkar DORA https://sameerkhairkar.com/blog/2026/07/17/dora-article-5-what-the-management-body-actually-signs-up-for/ https://sameerkhairkar.com/blog/2026/07/17/dora-article-5-what-the-management-body-actually-signs-up-for/ DORA Article 5 puts the management body on the hook for ICT risk before a single control is mentioned. What the board actually signs up for, and what the defined terms mean. Fri, 17 Jul 2026 00:00:00 +0000 Sameer Khairkar DORA https://sameerkhairkar.com/blog/2026/07/12/why-this-site-exists/ https://sameerkhairkar.com/blog/2026/07/12/why-this-site-exists/ Most writing about regulation answers what the rules say. The harder question is what to build. Why this site exists and what it publishes. Sun, 12 Jul 2026 00:00:00 +0000 Sameer Khairkar Meta