SovereigntyFeatured
Europe's missing compliance layer
Europe is building sovereign payments and sovereign AI. The system that reads its own regulation still runs on foreign software.
Martin Foerster · · 3 min read
Thought Leadership
Sovereign compliance
Essays on who gets to interpret European law, and why the infrastructure that reads a regulation is a question of sovereignty, not just software.
Written in Berlin · processed and hosted in the European Union
23 essays
Sovereignty
Compliance GuidesPIAs, DPIAs, and death by spreadsheet
A search query led me here: someone drowning in DPIA templates. So let me actually answer them.
Jan Jensen · · 7 min read
Compliance GuidesHow to replace compliance spreadsheets with software
What a compliance spreadsheet cannot hold as a data structure, the signals it is time to move off it, and how to migrate one regime at a time.
Martin Foerster · · 6 min read
Compliance GuidesWhat is a DPIA, and when does GDPR require one?
A DPIA is required before processing that is likely to result in a high risk to people’s rights. Here is the threshold, the three automatic triggers, what the assessment must contain, and when you must consult the regulator.
Jan Jensen · · 7 min read
Compliance GuidesWhat does EU compliance software cost?
There is no single price, cost is driven by how many regimes, entities and jurisdictions you cover. Here are the real drivers, the common pricing models, and what to compare the number against.
Martin Foerster · · 6 min read
Compliance GuidesEU cybersecurity rules for non-EU manufacturers: does NIS2 apply, or the Cyber Resilience Act?
If you manufacture outside the EU and sell into it, three regimes can reach you: NIS2, the Cyber Resilience Act, and your customers’ supply-chain requirements. Here is which one applies.
Jan Jensen · · 8 min read
Compliance GuidesRegulatory compliance: consultants vs. software vs. in-house
Three ways to handle EU regulatory requirements: external consultants, an in-house team, and compliance software, with an honest comparison of where each one wins.
Martin Foerster · · 5 min read
Compliance GuidesNon-EU company selling into the EU: what must you comply with?
Company owners outside Europe are sure EU law does not touch them because they have no EU office, and they are wrong. GDPR, the AI Act, DORA, and the product rules can all apply when you target the EU market. Here is what each one asks.
Jan Jensen · · 5 min read
Compliance GuidesDoes the EU AI Act apply to us, and at what risk tier?
The EU AI Act applies if you develop, place on the market, or deploy AI systems that touch the EU. Your requirements scale with the risk tier, here are the four tiers and what each one requires.
Martin Foerster · · 5 min read
Compliance GuidesDoes NIS2 apply to my business?
NIS2 applies to medium-sized and larger entities in a defined list of essential and important sectors, plus some entities regardless of size. Here is how to check whether you are in scope, sector first, then size.
Martin Foerster · · 8 min read
RegulationThe wall under EU-US data transfers just moved
A US ruling on who controls the FTC has quietly unsettled the legal basis for moving European data across the Atlantic.
Jan Jensen · · 3 min read
RegulationThe Data Privacy Framework on borrowed time
A US ruling on who controls the Federal Trade Commission has quietly removed a load-bearing assumption beneath every transfer of European data to the United States.
Jan Jensen · · 10 min read
Compliance GuidesDoes DORA apply to my company?
The prospects who raise DORA with me usually think it does not reach them, and they are usually wrong. Two tests decide it, and here is what it requires once you are in scope.
Jan Jensen · · 5 min read
ArchitectureWhen you paste a contract into an AI, who else can read it?
Checking a draft contract or a live incident against European law by running it through a foreign AI transmits the full text to a provider under foreign jurisdiction. That is a disclosure, and it may be one you never learn about.
Martin Foerster · · 3 min read
Compliance GuidesWhich EU regulations does my company need to comply with?
Founders, company owners and CEOs ask me this before every raise and every audit. Which EU rules apply depends on four things, and here is how I scope them.
Jan Jensen · · 6 min read
SovereigntyThe layer Europe’s sovereignty push forgot
The 3 June package targets chips, cloud, and AI. It says almost nothing about the systems that interpret Europe’s own regulation.
Martin Foerster · · 2 min read
SovereigntyThe sovereignty test
A short set of questions that separates genuine digital sovereignty from an EU region with a sovereignty label, applied honestly to ourselves as well.
Jan Jensen · · 2 min read
RegulationCompliance outgrew the spreadsheet
For most companies, compliance still lives in a spreadsheet held together by one overworked person. It breaks in four predictable places.
Martin Foerster · · 3 min read
ArchitectureThe case for keeping your documents where they are
The industry standard is to pull a customer’s documents into the vendor’s cloud. For regulated European firms, that convenience is the exposure.
Jan Jensen · · 3 min read
RegulationYour compliance tool is a third-party risk
DORA made banks map every critical technology provider. Few have turned that discipline on the software they use to manage compliance itself.
Martin Foerster · · 2 min read
GeopoliticsThe payments channel Europe built and never used
In 2019 three of Europe’s largest economies built a mechanism to trade around US sanctions. Its near-total failure is the clearest lesson in dependency Europe has.
Martin Foerster · · 2 min read
SovereigntyWhat sovereign compliance actually means
The term is appearing on every European vendor’s website. Most uses describe where data sits, not who controls it.
Martin Foerster · · 3 min read
ArchitectureWho interprets European law?
For fifteen years European data protection has asked where information is stored. Artificial intelligence has changed the question to where regulation is understood.
Jan Jensen · · 4 min read