NIS2 supplier requirements changed who carries the risk. The obligation to manage supply chain security attaches to the covered entity, which means the security posture of whoever builds and maintains your software became part of your own exposure. If your supplier cannot evidence its practices, the finding lands on your side of the table.
NIS2 supplier requirements changed who carries the risk. The obligation to manage supply chain security attaches to the covered entity, which means the security posture of whoever builds and maintains your software became part of your own exposure. If your supplier cannot evidence its practices, the finding lands on your side of the table.
Start with what you can verify on your own, before speaking to anyone. The public list of PME Líder companies, the public contracts record on the Base portal, the open source the company publishes and its filed accounts. Four sources independent of any sales conversation.
Five things changed. Keys moved from RSA to ECDSA. Contactless reading arrived over ISO/IEC 14443, protected by the PACE protocol. A six-digit CAN code was introduced for contactless access. The chip contacts moved to the back of the card. And there is no API that tells you which version is in front of you.
Eleven sectors are named in Article 5f(2) of the eIDAS Regulation as amended: transport, energy, banking, financial services, social security, health, drinking water, postal services, digital infrastructure, education and telecommunications. The deadline is 24 December 2027.
Because extraction is the easy part. What separates a demonstration from a production system is disambiguation, meaning knowing that three different spellings are the same entity and that two identical spellings are not, and knowing when the model should refuse to answer rather than risk it.
Five things changed. Keys moved from RSA to ECDSA. Contactless reading arrived over ISO/IEC 14443, protected by the PACE protocol. A six-digit CAN code was introduced for contactless access. The chip contacts moved to the back of the card. And there is no API that tells you which version is in front of you.
Every few months, we get the same question: can we authenticate users with the Portuguese Citizen Card directly in our own application? Yes. The official middleware is open source and supports the Cartão de Cidadão, Chave Móvel Digital and professional attribute certification.
Software quality evidence is not the same thing as a testing programme, and the difference is what the first serious supervisory review tends to expose. Most regulated financial institutions have QA engineers, test suites, CI/CD pipelines and dashboards that show green. Far fewer have evidence.
The most useful question about generative AI visual marketing in 2026 is not what the tools can do, since that answer has become impossibly broad. It is where they create durable value rather than a productivity gain that evaporates once every competitor adopts the same tool.