What the NIS2 directive asks of a startup's cloud platform, how to tell whether a company is in scope or a supplier to one that is, and what to fix first.
NIS2 is the EU's cybersecurity directive for the sectors that keep a country running: energy, transport, banking, health, water, digital infrastructure, cloud and managed services, and more. Each member state turned it into national law, with a deadline of 17 October 2024, and several were late. The law puts the duty on the company's management, with fines that scale with turnover. It asks for a short list of security measures that belong in any startup's platform anyway, plus incident reporting on a clock.
Read the guideWhat the Digital Operational Resilience Act asks of a fintech's cloud platform, and what its contract rules mean for suppliers to banks and insurers.
DORA is an EU regulation, so it applies directly in every member state without a national version. It has applied since 17 January 2025 to financial entities: banks, payment and e-money institutions, investment firms, crypto-asset service providers, insurers, pension funds, and more. It's about the technology under the finance. That covers how a company manages ICT risk, classifies and reports incidents, tests its resilience, and controls the third parties it depends on.
Read the guideHow the EU AI Act sorts AI systems into risk tiers, which tier your product is likely in, when the rules apply, and what they mean for the way a team builds.
The AI Act is an EU regulation that applies directly in every member state. It sorts AI systems by risk. The Act bans a few uses outright and lists a defined set as high-risk, with real obligations. Some systems only owe transparency, and the rest owe nothing beyond general law. A separate chapter covers general-purpose models, and it binds the model makers rather than the teams who build on them.
Read the guideWhat the GDPR asks of a startup's cloud platform in engineering terms: controller or processor, the records to keep, and the controls that prove it.
The General Data Protection Regulation has applied directly in every member state since 25 May 2018. It covers any organisation established in the EU that handles personal data. It also covers any organisation outside the EU that offers goods or services to people in the EU or watches their behaviour. Personal data means anything that relates to an identifiable person: an email address, an IP address, a user ID in a log line. For a startup, that's nearly every table in the database.
Read the guideHow to keep customer data in EU regions on AWS, Azure, and Google Cloud, what still leaves, and the controls that prove it to a customer or auditor.
"Our data stays in the EU" is a promise I see a lot of EU startups make. On AWS, Azure, and Google Cloud it's mostly achievable and mostly a matter of configuration. The default isn't there, though, and a few services reach outside any region a team picks. Residency, meaning where the bytes sit, differs from sovereignty, meaning who a court can compel to hand them over. It's worth asking customers which one they actually want.
Read the guideMy AI engineering workflow for a team: how I set up Claude Code, Codex, and similar agents with instruction files, retrieval, shared memory, and code review.
An AI coding agent is a model in a loop. It reads files, runs commands, and edits code until a check passes or it runs out of ideas. The model matters less than what surrounds it: the instructions it reads, the context it can reach, the memory it keeps between sessions, and the checks it has to pass. I've set this up across more than a dozen of my own repositories on Claude Code and Codex, and the same few layers keep deciding the outcome.
Read the guideWhat changes when an agent writes the code: the new attack paths, the controls that close them on AWS, Azure, and Google Cloud, and the EU reporting clock.
Veracode has tested AI-generated code against the same set of tasks since July 2025. Its October 2026 report puts the average security pass rate at 62%, the first real improvement in the series, which still leaves 38% of samples with a known vulnerability. In the summer edition, cross-site scripting and log injection passed only about 15% and 12% of the time. The code compiles almost every time, so the flaws arrive looking finished.
Read the guideA free guide to GitOps guardrails on GitHub: rulesets, independent reviewers, required pull requests and checks, Conventional Commits, and branch names.
OpenGitOps, a CNCF working group, defines GitOps through four principles. The desired state is declarative, versioned and immutable, pulled automatically, and continuously reconciled. In practice, an agent such as Argo CD or Flux watches a Git repository and keeps the running system in line with it. That makes a merge to the default branch a deployment, and the repository's rules the real change control.
Read the guide