Compliance
DORA Article 30: a checklist of ICT contract clauses
DORA Article 30 lists what ICT provider contracts must contain, with extra terms for critical functions. A plain checklist for engineering and procurement.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedCompliance
Does the EU AI Act apply to companies outside the EU?
Yes, in many cases. Article 2 reaches non-EU providers who sell into the EU and non-EU firms whose AI output is used there. Here is how scope works.
Oct 18, 20263 min read
Compliance
Does ISO 42001 certification make you EU AI Act compliant?
A myth versus fact look at ISO/IEC 42001 and the EU AI Act: what a management system certificate covers, what the law adds and how to bridge the gap.
Oct 18, 20263 min read
Compliance
Does the GPL cover what a GPL program produces?
Generally, the output of a GPL program is not covered by the program's license. The exceptions matter: templates, bundled art and audio. A short guide.
Oct 18, 20263 min read
Compliance
Does GDPR apply to a company outside the EU?
GDPR Article 3 reaches non-EU businesses that offer goods or services to people in the EU or monitor their behaviour there. How to test your case.
Oct 18, 20263 min read
Compliance
Does FDA's cybersecurity guidance apply to offline devices?
FDA's premarket cybersecurity guidance is not limited to networked devices. It covers anything with software or firmware, even 510(k) exempt products.
Oct 18, 20263 min read
Compliance
Does the CCPA apply to my company? The three thresholds
The CCPA covers for-profit businesses that do business in California and meet one of three thresholds. Check revenue, consumer volume and data sales.
Oct 18, 20263 min read
Compliance
Document a 'not affected' decision after a security story
Concluding that a breach or CVE does not apply to you is a decision worth recording. Here is what to write, who signs off and when to revisit it.
Oct 18, 20263 min read
Compliance
Do you need a data protection officer under GDPR?
GDPR Article 37 requires a DPO in three cases: public bodies, large scale monitoring and large scale special category data. How to decide for your firm.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.