What the rules ask for and what proves it

You can satisfy every individual control and still fail the sub-measure. The evaluation framework has two thresholds, and the second one is the surprise. Here is how the formula works and what it means for planning.

Domain infrastructure rarely falls to an unpatched vulnerability. It falls to configuration that once made sense, was left behind, and that nobody looks at any more. These five findings show up in most environments.

An annual presentation about phishing produces a record, not a change. Measure 5 requires awareness raising, but what actually gets measured is behaviour - and behaviour moves on different levers.

The promise is that a model will catch the attack a human missed. The reality is that models do well on tasks with many examples and a clear outcome, and badly where neither exists - which is exactly where the expensive failures live.

Version 2.0 added a sixth function above all the others. It is not cosmetic - Govern answers a finding that kept recurring for years: technical controls do not fix an organisation with no owner for its risk.

Essential entities do not self-assess - they undergo an independent audit. It is carried out by a provider holding the prescribed authorisation, and for state administration bodies by the competent authority. Here is how it runs and what usually is not accepted.

Organisations that introduce an AI system inventory as a separate document discover a year later that they have two registers drifting apart. The overlap is larger than the difference, and the difference fits into four columns.

A cyber insurance questionnaire is not a formality but a risk assessment somebody else is doing about you. The questions get more specific every year, and an inaccurate answer can become grounds for declining a claim.

While the debate runs on high-risk systems, two provisions of the AI Act apply first. One bans certain practices outright, the other requires that the people using these systems know what they are doing.

Up to EUR 10 million or 2 per cent of global turnover for essential entities. But the figure that changes the conversation with a board is the other one: members of the management body are liable personally, out of their own pocket.

The register of contractual arrangements with ICT service providers looks like an administrative exercise until you try to populate it. That is when you discover three departments hold three different supplier lists, and none of them is complete.

Regulation (EU) 2024/1689 does not govern the technology but its application. The same model can be an unregulated convenience and a high-risk system, depending on what you use it for - which means classification starts with an inventory, not a legal analysis.

Business impact analysis usually ends as a table in which every process has a four-hour RTO. If everything is critical, nothing is - and the recovery plan built on it will not survive the first real outage.

The 2022 revision cut 114 controls to 93 and reorganised them into four themes instead of fourteen clauses. The bigger change is the attributes - and they are why an old Statement of Applicability cannot simply be renumbered.

The deadlines for reporting a significant incident do not add up and do not wait for one another. And if the incident also involves a personal data breach, a fourth deadline runs alongside them, under a different instrument and to a different authority.

The risk register is the document everyone has and almost nobody uses. Five patterns repeat from organisation to organisation, and all five are visible on a first reading.

The certificate does not release you from the obligation, but it shortens the path considerably. The question is only which measures it covers, which it touches, and which it does not reach at all - and how to prove that without writing a second set of documentation in parallel.

Article 49 of the Regulation requires a correlation overview mapping every sub-measure onto ISO 27001, ISO 27002, ISO 22301, NIST CSF 2.0, NIST SP 800-53 and CIS v8. Organisations that ignore it write documentation they already have.

You do not choose your category and you do not apply for it. It arrives by letter, and from that day a deadline runs. Here is who decides, on what basis, and what actually changes depending on which group you land in.