NIS2 supplier requirements changed who carries the risk. The obligation to manage supply chain security attaches to the covered entity, which means the security posture of whoever builds and maintains your software became part of your own exposure. If your supplier cannot evidence its practices, the finding lands on your side of the table.
Portuguese public tenders are all public, and companies still lose contracts that suited them. ConcursosGov turns the daily flow of Portal BASE notices into a short list a team can decide on in minutes. It is live now, with a 14-day trial.
The questions to ask an AI agency have almost nothing to do with models. Seven of them separate suppliers, because they are about documentation, about who answers to the regulator, and about what stays in your house when the contract ends.
It pays off when volume is high, exceptions are rare, rules are stable and the decision is reversible. It fails when any one of those four does not hold, and the cost shows up in maintenance rather than in the initial budget.
NIS2 supplier requirements changed who carries the risk. The obligation to manage supply chain security attaches to the covered entity, which means the security posture of whoever builds and maintains your software became part of your own exposure. If your supplier cannot evidence its practices, the finding lands on your side of the table.
NIS2 supplier requirements changed who carries the risk. The obligation to manage supply chain security attaches to the covered entity, which means the security posture of whoever builds and maintains your software became part of your own exposure. If your supplier cannot evidence its practices, the finding lands on your side of the table.
Start with what you can verify on your own, before speaking to anyone. The public list of PME Líder companies, the public contracts record on the Base portal, the open source the company publishes and its filed accounts. Four sources independent of any sales conversation.
Five things changed. Keys moved from RSA to ECDSA. Contactless reading arrived over ISO/IEC 14443, protected by the PACE protocol. A six-digit CAN code was introduced for contactless access. The chip contacts moved to the back of the card. And there is no API that tells you which version is in front of you.
Eleven sectors are named in Article 5f(2) of the eIDAS Regulation as amended: transport, energy, banking, financial services, social security, health, drinking water, postal services, digital infrastructure, education and telecommunications. The deadline is 24 December 2027.
Because extraction is the easy part. What separates a demonstration from a production system is disambiguation, meaning knowing that three different spellings are the same entity and that two identical spellings are not, and knowing when the model should refuse to answer rather than risk it.