Analysis & Insights
Deep analysis on building reliable systems in an unreliable world. How to govern AI, manage vendor risk, and maintain compliance when the map updates slower than the territory.
OpenAI's models found a previously unknown vulnerability, broke out of an isolated test environment and reached parts of Hugging Face's production infrastructure. The incident shows why a supplier list is not the same thing as a map of the digital supply chain, and why "it runs in Microsoft's cloud" is not a security assurance.
On 12 June 2026, Anthropic restricted access to two models following a US export control directive. For European critical infrastructure, the lesson is not about data access. It is about uncontrolled dependency on the tools an organisation is starting to rely on.
We've chosen not to build Bounded on Amazon, Google or Microsoft. Not because we're against American technology, but because we help customers understand and manage their digital dependencies. That means we can't build in dependencies of our own that would make it hard to act if the conditions change.
NIS2 requires companies to continuously understand their vendor chain and have processes in place to minimize risk. Here is why.
The EU has made it explicit that ICT supply chain risk is a lifecycle engineering problem, not a periodic compliance exercise. Here is what that means for your NIS2 strategy.
Gartner predicts that by 2030, 40% of enterprises will suffer a security or compliance incident due to unauthorized AI tools. For in-house legal teams, this is not an abstract future scenario. It is a statistical inevitability.
The prevailing narrative is that AI risk is a policy problem. That a 50-page PDF functions as a control system. These approaches aren't wrong. They are structurally impossible.
After a decade as in-house counsel at scaling tech companies, I learned a hard truth: The hardest problem isn't the law. It's the reality.
Your audit is not a risk management tool. It is a liability shield designed to be read by lawyers after the breach has already happened.
Two years ago, I built Roastguide. On the surface, it was a platform for specialty coffee. Underneath, it was an engineering thesis on structured discovery.
If your organization uses software to screen CVs, rank candidates, or suggest who should advance to an interview, you are likely operating in the High-Risk category of Annex III. This applies even if a human makes the final call.
The EU AI Act is not just a regulation. It is a phase transition for the software industry. Compliance is no longer a document you write. It is a system you build.
Shadow AI is often framed as an IT problem. From a legal perspective, it is something far worse. It is the erasure of the corporate perimeter.