Clinical AI Obligations That Never Moved to 2027
A political agreement pushing the EU AI Act’s high-risk obligations out to December 2027, and to August 2028 for AI embedded in regulated medical devices, has led a lot of...
Security and Compliance Blog
Learn security strategies, compare vendors, and implement best practices to prevent breaches and compliance violations from risky third party communications.
Posts by Marc ten Eikelder
Marc ten Eikelder, Senior Director Marketing EMEA, Kiteworks
Marc is responsible for developing and executing comprehensive brand and communication strategies across the EMEA region, with a clear focus on increasing brand awareness, driving demand and company growth. He brings over 20 years of experience in international marketing. His expertise covers a wide range of marketing disciplines, including digital marketing, campaign planning, influencer marketing, CRM, channel marketing, and go-to-market strategies.
Defence Compliance Teams Deserve One Shared Record
Risk, compliance and programme security teams at most defence contractors each work from their own systems: a risk register, a policy configuration, a separate audit log export. Each team can...
Closing the Evidence Gap Before a Regulator Finds It
Public sector operators of critical infrastructure, utilities, transport, water, increasingly face both physical resilience obligations and cybersecurity requirements at once. An operator significant enough to be designated critical infrastructure is,...
Public Sector AI Agents and the Governance Gap
A new civil servant does not get access to every citizen record on day one. They get access scoped to their role, oversight from a manager, and a record of...
France’s NIS 2 Delay Is Not a Compliance Reprieve
A postponement is not a reprieve, and French organizations that read this week’s news as permission to wait are misreading their own exposure. The bill transposing the NIS 2 Directive...
What Critical Third-Party Status Doesn’t Change for Prime Contractors
DORA‘s critical third-party oversight regime applies specifically to financial entities and the ICT providers designated as critical to that sector. Defence primes and their contractors are not directly in scope....
Agencies Relying on Shared Infrastructure Still Own the Risk
DORA‘s critical third-party oversight regime applies specifically to financial entities and the ICT providers designated as critical to that sector. Government agencies are not directly in scope. The pattern it...
How Fragmented Governance Puts Controlled Data at Risk
Most defence contractors do not have one data governance policy. They have several: one for programme systems, another for email, a different one again for file sharing, and often no...
A 72-Hour Report Is Hard When Hospital Systems Log Separately
Hospitals and health networks that qualify as essential entities under NIS2 face a fixed reporting clock once a significant incident is discovered: 24 hours for an early warning, 72 for...
Industrial Operators and the NIS2 Reporting Clock
Industrial operators classified as essential or important entities face a fixed reporting clock once a significant incident is discovered: 24 hours for an early warning, 72 for a detailed notification,...
Controlled Technical Data Needs a Jurisdiction You Actually Chose<
A defence contractor handling controlled unclassified information can usually point to the country its systems are hosted in. Fewer can answer whether the provider operating those systems is itself subject...
Patient Data Location Is a Clinical Governance Question, Not an IT Afterthought
A hospital’s IT department can usually name the data centre hosting its patient records. Fewer clinical and compliance leaders can say confidently which jurisdiction actually governs access to that data...
Your Product Designs Shouldn’t Live Wherever a Cloud Region Happens to Sit
A manufacturer sharing CAD files and supplier data across a global supply chain can usually name the region its file-sharing platform hosts data in. Fewer can say whether the provider...
Where Privileged Files Live Should Be Your Decision, Not Your Provider’s
Legal privilege depends on confidentiality holding, and confidentiality depends on knowing exactly who can reach a file. A law firm that stores client matters in a cloud platform without asking...
Deferred Is Not Cancelled: What the EU AI Act Already Requires While Everyone Waits for 2027
Introduction A political agreement pushing the EU AI Act’s high-risk obligations out to December 2027 has led a lot of organisations to file the whole regulation under “next year’s problem.”...