Marc ten Eikelder, Author at Kiteworks

Deferred Is Not Cancelled: What the EU AI Act Already Requires While Everyone Waits for 2027

by Marc ten Eikelder September 30, 2026September 30, 2026 | Regulatory Compliance

Introduction A political agreement pushing the EU AI Act’s high-risk obligations out to December 2027 has led a lot of organisations to file the whole regulation under “next year’s problem.”...

Critical Designation Leaves Your Accountability Unchanged

Your Vendor’s Problem Is Now Yours: What Critical Third-Party Designation Actually Changes

by Marc ten Eikelder September 30, 2026September 30, 2026 | Third Party Risk

Introduction When European regulators started designating certain ICT providers as critical under DORA, some organisations read it as good news: a vendor now facing direct supervisory oversight sounded like someone...

GDPR Article 32: Continuous Security Measures Required

Years Later, Article 32 Still Isn’t Optional: What “Technical Measures” Actually Means in Practice

by Marc ten Eikelder September 30, 2026September 30, 2026 | GDPR Compliance

Introduction GDPR has been enforceable for years, and Article 32 remains the single most commonly cited provision in major fines. Not consent banners, not international transfer mechanisms. Security. Organisations that...

Engineering Sovereignty Into Data Deployment Models

Sovereignty by Design: Why Where Your Data Lives Has to Be a Choice, Not a Default

by Marc ten Eikelder September 30, 2026September 30, 2026 | Kiteworks News

Introduction Most vendors answer the sovereignty question with a map. Pick a region, and your data lives there. That satisfies the question a procurement checklist asks, but it’s a much...

Proving Cyber Resilience Requires Continuous Records

Critical Infrastructure Runs on Trust It Can’t Prove: Closing the Evidence Gap Before the Regulator Finds It

by Marc ten Eikelder September 30, 2026September 30, 2026 | Regulatory Compliance

Introduction Ask an energy utility, a hospital network or a water provider whether their operations are secure, and the answer is almost always yes. Ask them to prove it, with...

NIS2 Evidence Gaps: Beyond Reporting Deadlines

The Clock Is Ticking, the Evidence Isn’t: What Incident-Reporting Laws Like NIS2 Actually Require

by Marc ten Eikelder September 30, 2026September 30, 2026 | Regulatory Compliance

Introduction A significant cyber incident hits at 11pm on a Friday. Under NIS2, the clock on the first regulatory deadline starts the moment the organisation becomes aware of it, not...

DORA Compliance Strategies for French Banks

How French Banks Comply with DORA Requirements

by Marc ten Eikelder September 27, 2026September 27, 2026 | Regulatory Compliance

French banks face unprecedented operational resilience challenges under DORA. The Digital Operational Resilience Act establishes comprehensive requirements for ICT risk management, incident reporting, and third-party risk oversight that fundamentally reshape...

Legal Hold Requirements for UK Law Firms: Beyond Standard Document Management Systems

by Marc ten Eikelder September 27, 2026September 27, 2026 | Regulatory Compliance

UK law firms face increasingly complex legal hold obligations that stretch far beyond the capabilities of traditional document management systems. When litigation emerges or regulatory investigations commence, solicitors must preserve,...

How Swiss Hospitals Secure Patient Data Under Health Data Act

by Marc ten Eikelder September 27, 2026September 27, 2026 | Regulatory Compliance

Swiss healthcare organizations face unprecedented scrutiny over patient data protection as regulatory enforcement intensifies and cyber threats targeting medical institutions escalate. The Health Data Act establishes comprehensive requirements for securing...

EU Banks: Mastering Sovereign Cloud Governance

Why Cloud Sovereignty Requirements Are Changing for EU Banks

by Marc ten Eikelder September 24, 2026September 24, 2026 | Regulatory Compliance

European banks face unprecedented pressure to maintain control over their data while leveraging cloud infrastructure for competitive advantage. Traditional approaches to cloud adoption often conflict with evolving regulatory expectations around...

CMMC 2.0 Compliance for European Defense Suppliers

CMMC 2.0 Implementation for European Defense Suppliers: Strategic Framework for Cross-Border Compliance

by Marc ten Eikelder September 24, 2026September 24, 2026 | CMMC Compliance

European defense suppliers operating within the U.S. supply chain face increasingly complex compliance requirements under the CMMC 2.0 framework. This regulation mandates stringent cybersecurity controls for organizations handling CUI and...

EU AI Act Data Governance for Spanish Enterprises

How the EU AI Act Changes Data Handling Requirements for Spanish Enterprises

by Marc ten Eikelder September 23, 2026September 23, 2026 | Regulatory Compliance

The European Union AI Act establishes comprehensive governance frameworks that fundamentally alter how Spanish enterprises must approach data privacy and algorithmic accountability. These requirements extend beyond traditional GDPR compliance, creating...

French Customer-Held Key Compliance Essentials

Customer-Held Keys: What French Financial Regulators Actually Require

by Marc ten Eikelder September 23, 2026September 23, 2026 | Regulatory Compliance

French financial institutions face increasingly stringent requirements around cryptographic key management and data sovereignty. Understanding what customer-held keys mean in practice—and how French regulators expect organizations to implement and govern...

UK Banks: Building Effective GDPR Data Governance

How UK Banks Achieve GDPR Compliance for Customer Data

by Marc ten Eikelder September 23, 2026September 23, 2026 | GDPR Compliance

UK banks face mounting pressure to demonstrate comprehensive data protection while maintaining operational efficiency and competitive advantage. The GDPR creates specific obligations for financial institutions handling vast volumes of sensitive...

5 Steps to BSI C5 Type 2 Compliance for German Defense Contractors

by Marc ten Eikelder September 22, 2026September 22, 2026 | Regulatory Compliance

German defense contractors face increasingly complex data security requirements as they handle sensitive military information and collaborate across international supply chains. The Federal Office for Information Security’s BSI C5 Type...

Security and Compliance Blog

Learn security strategies, compare vendors, and implement best practices to prevent breaches and compliance violations from risky third party communications.

Posts by Marc ten Eikelder

Your Vendor’s Problem Is Now Yours: What Critical Third-Party Designation Actually Changes

Sovereignty by Design: Why Where Your Data Lives Has to Be a Choice, Not a Default

Critical Infrastructure Runs on Trust It Can’t Prove: Closing the Evidence Gap Before the Regulator Finds It

The Clock Is Ticking, the Evidence Isn’t: What Incident-Reporting Laws Like NIS2 Actually Require

How French Banks Comply with DORA Requirements

Legal Hold Requirements for UK Law Firms: Beyond Standard Document Management Systems

Why Cloud Sovereignty Requirements Are Changing for EU Banks

CMMC 2.0 Implementation for European Defense Suppliers: Strategic Framework for Cross-Border Compliance

Customer-Held Keys: What French Financial Regulators Actually Require

5 Steps to BSI C5 Type 2 Compliance for German Defense Contractors

Get started.