About the Author

2. Recreating Legacy Processes

Adopt and adapt, don’t replicate the past.

Legacy thinking is the single biggest barrier to IRM success. Organisations often feel compelled to re-create their old tool configurations, reports, and workflows within a new platform.

This defeats the purpose of transformation. Implementing IRM should be an opportunity to question why processes exist, not simply how to reproduce them.

Challenge legacy habits. The real value comes from redesigning risk management processes for today’s needs, not rebuilding the past in a new system.

3. Scaling Too Quickly

Start small, prove impact, then expand.

IRM maturity is not achieved overnight, it is a multi-year transformation. Equally, organisations cannot wait years to demonstrate value.

The most successful initiatives begin with focused, high-yield pilots. Start with a small number of critical business processes, the organisation’s “crown jewels”, and deliver measurable outcomes within the first three to six months.

Early success builds credibility, secures ongoing funding, and creates the momentum needed to scale the programme sustainably.

4. Shaky Foundations

Lay foundations capable of supporting strategic growth.

IRM transformations unfold in phases, and each phase must align to a well-defined target operating model. Early design decisions, particularly around data structures, taxonomies, and governance, determine how effectively the programme can scale later.

Both a skyscraper and a bungalow require solid foundations, but they are engineered very differently. Before you begin building your IRM programme, be clear about which one you intend to construct.

5. Overly Complex Scope

Only capture what’s essential for oversight and control.

One of the most common pitfalls in IRM implementations is over-scoping. Trying to model every asset, control, or process quickly creates unnecessary complexity and slows adoption.

Instead, right-size your scope to what is required for meaningful governance, assurance, and insight.

Granularity should enable better decision-making, not burden teams with excessive administration.

6. Reinventing The Wheel

Industry standards accelerate maturity.

Reinventing frameworks from first principles wastes valuable time. Industry models such as ISO, COSO, NIST, and others are proven, mapped to multiple regulations, and widely accepted by auditors and regulators alike.

Adopting them as a baseline enables consistency, comparability, and faster maturity without sacrificing customisation where it truly matters.

7. Failure to Treat Risk Management as Data-Driven

Data enables consistency, automation, and informed decisions.

Effective Integrated Risk Management is data-driven, not document-driven. Organisations should use existing enterprise data to power workflows, identify trends, and inform policies.

Automation should be applied wherever logic and validation can replace manual review. This frees human capacity for higher-value activities such as analysis, foresight, and strategic decision-making.

8. Underestimating Cultural Change

Tools don’t change culture, leaders do.

Technology alone will not transform a risk culture.

Successful IRM programmes require visible senior sponsorship, sustained investment in change management, and clear communication across the organisation. Training, incentives, and messaging must reinforce that IRM is part of how the business operates, not just another reporting requirement.

Without engagement at every level, even the most advanced platforms fail through lack of adoption.

9. Unrealistic Expectations About Speed

IRM implementations take time because changing behaviour takes time. Specialist capabilities, expert configuration, and stakeholder alignment all require deliberate effort.

If speed is essential, accept that disruption will follow. Sometimes the fastest path is a clean start, leaving historical data and legacy processes behind in favour of a modern, scalable model.

The Bottom Line:

IRM is not about technology; it’s about resilience.

Success depends on aligning people, data, process, and purpose, supported by technology that amplifies, not defines, capability. Organisations that treat IRM as an evolving business discipline, rather than a software project, will ultimately build stronger, more adaptive enterprises ready for the risk landscape ahead.

The post 9 Reasons Integrated Risk Management Programmes Fall Short appeared first on Wrangu.

About the Author

Yes, AI is here. Yes, it promises to transform the governance, risk, and compliance (GRC) landscape. But let’s face it, are you truly ready to harness its power?

Throughout my career, I’ve worked with organisations of all shapes and sizes, from multinational giants to agile start-ups. Yet few were truly prepared for AI to solve their challenges. Why? Because they lacked the foundations needed for AI to deliver meaningful results.

Many have purchased AI tools. But have they solved their problems? No. AI cannot work in isolation.

The Real Potential of AI in GRC

Used effectively, AI can streamline core GRC processes that have traditionally been time-consuming and manual:

Foundation 2 → Data Readiness

Next, and most critically, you need data that is reliable, consistent, and usable to train AI models effectively. AI is a powerful tool, but it is not a silver bullet. As Grady Booch wisely said, “A fool with a tool is still a fool.”

In my experience, organisations tend to fall into one of these categories:

• Too siloed and fragmented, burdened by disparate processes and years of unaligned data.
• Moving from spreadsheets with ambition but no foundational systems or long-term vision.
• Stuck on outdated tools, eager for modernisation but trapped by archaic processes.

Or, often, a mix of all three.

Data is the foundation on which the AI house is built, it must be strong, or it will collapse. Preparing the ground and understanding the data you have is important before you start.

Foundation 3 → A Shared, Long-Term Vision

Successful AI adoption requires vision, communication, and cooperation.

Like all major GRC projects, this is not a one-and-done effort. Sponsors must recognise that managing risk, like maintaining security, is continuous. It demands investment in organisational change management, cultural transformation, and a unified vision with interconnected processes driving a common goal:

To mitigate uncertainty and empower the business to thrive.

Whether you follow the three lines of defence, four, or five, it doesn’t matter. What matters is that processes are structured, embedded, and adopted.

Just as data analytics required a clear purpose before creating measurable impact, AI needs a defined vision before it can deliver value.

Foundation 4 → Governance, Structure, and Accountability

AI algorithms are only as effective as the data and governance behind them. Quality, ethics, and robustness are vital for trustworthy outcomes. Frameworks such as the EU AI Act, the OECD AI Principles, and the NIST AI Risk Management Framework all highlight this importance.

Organisations need:

• Data and AI governance – Clear accountabilities and standardised processes for data management.
• Transparency and explainability – AI decisions must be understandable and auditable.
• Fairness, safety, and accountability – Systems must be designed to avoid bias, prevent harm, and ensure responsibility.
• Leadership and vision – Strong oversight to align AI initiatives with organisational strategy.
• Training and iteration – Ongoing refinement to improve accuracy and relevance.
• Collaboration and skills – The ability to work effectively with AI, including prompt design and critical evaluation of outputs.

Those of us in the GRC field bear a special responsibility. Governance and ethical guardrails are essential to realising AI’s potential while protecting the integrity of our organisations and the data we manage.

As Jason Lemkin aptly put it, “AI agents are incredibly powerful, but they cannot be trusted, and that is by design. If you want to use AI agents, you need to 100% understand what data they can touch, because they will touch it, and you cannot predict what they will do with it.”

AI can and will transform GRC, but only for those who lay the groundwork, building the systems, culture, and data foundation that allow the technology to shine.

The post Making AI Work for GRC: The Key Foundations for Success appeared first on Wrangu.

Rather than get frustrated, I decided to read, and since DORA is hot on everyone’s lips, I decided to dig a bit deeper. 

Like most people I started with the regulation, and it was challenging work, but at least it got me going. I then did a lot of research on what other DORA information is out there and in the process of doing so I came across Oliver Wyman. Their insights were clear and helpful. 

So now after reading and researching GDPR (General Data Protection Regulation), NIS2 and now DORA I am starting to see a model behind the regulations. DORA holds a light up to something we have all known for a long time and have chosen to either ignore or sideline. The simple truth is organisations have been running critical business services for years without understanding the true risk or putting the proper protection in place. Why? Because it is hard. 

To quote Oliver Wyman  

“Complying with DORA will not be easy – it requires a purposeful and deliberate business-led technology strategy, and an integrated risk management approach aligned to critical business services.” 

However, there is reason to be optimistic. 

The introduction of DORA finally gives financial institutions the push to do what should have been obvious. Let me set out for you what is required: Firstly, they need to identify critical business services through quantitative analysis, understand the true ALE and SLE for each and prioritize accordingly. 

Then they need to model out these critical business services, understand how they fit together, where they have dependencies, identify any single points of failure, and any concentration of risk with third parties 

Finally, they need to build recovery plans that are based on the full picture they have by then defined and really test those plans making sure they surface any weaknesses and that those critical services are fit for purpose. Any identified weaknesses should be raised to senior management. 

On an ongoing basis the business must then proactively monitor the services and continue to identify vulnerabilities, track incidents and if relevant report them to relevant bodies, which is one of the keys to the resilience that DORA will create – sharing information within the industry in trusted circles means each set of data strengthens the whole. 

In a world of cyber warfare, ransom attacks and geopolitical upheaval, we the public need to have faith in our financial institutions, we cannot afford another banking crisis as in 2008 and 2023. 

DORA gives us the roadmap for Resilient by design and using the business services as the centre you can build up a complete picture of health using the five pillars. Let Me run you through the 5 pillars of that design and key elements: 

Pillar 1 risk management and governance 

This is your foundation. With this layer you build you policies and processes, you identify your risk framework, your controls and governance to document the roles and responsibilities. Understanding what processes, you have in place, and which may need to be implemented. From incident management to backup policy, from Vulnerability scanning to Audit review. 

Key questions; do you have a quantitative risk process in place?; who is responsible for Business Continuity management?;  how do you monitor and detect unusual behaviour? 

If you are starting with DORA, performing a gap analysis either internally ,or with help, to understand what you do have and what is missing is a necessary first step. 

Trying to implement without this would not be advised. 

A highlight in pillar 1 is this: 

Financial entities shall use and maintain updated ICT systems, protocols, and tools.  

Now there is a requirement to use the right tools for the right job and they must be kept up to date. 

This is a great opportunity to look at your gap analysis and see if multiple requirements can be satisfied by consolidating onto a more modern platform-based software that can perform multiple processes on a single platform and share data. 

Pillar 2 ICT related incident reporting 

This is your front line of defence; this is where you are setting up early warning indicators to detect problems and alert the teams.  

If incidents do occur, you need to understand the scope and scale of an incident. Was there data loss? Which services were affected? Were financial counter parts affected? 

The goal here is to understand exactly what happened so that you can analyse and report major ICT related incidents to the relevant authorities quickly as well as feeding that information back into the problem and change process so that it does not happen again. 

To do this properly all information needs to be available, correlated and managed in a well-documented and practiced process. 

 Pillar 3 Digital operational resilience testing 

This is where all the business strategy and IT technology needs to come together in a robust, resilient design, monitored and constantly updated model. This is where DORA starts to fit in the jigsaw of EU regulations. While GDPR is privacy by design and NIS2 is Security by design. DORA adds to the model by putting resilience at the heart of design architecture. 

DORA defines a risk-based approach to operational resilience testing, with critical Business Services tested at least once a year. 

This needs to be done in detail as defined in Article 24  

• The digital operational resilience testing program shall provide for the execution of a full range of appropriate tests.  

• Including vulnerability assessments and scans, open-source analyses, network security assessments, gap analyses, physical security reviews, questionnaires and scanning software solutions, source code reviews where feasible, scenario-based tests, compatibility testing, performance testing, end-to-end testing, or penetration testing.  

This gives the Business Continuity team the focus and support for the valuable service they provide, creating visibility for the board and senior management ensuring that this is no longer just an IT issue. It affects the bottom-line profit and should be treated as such. 

Operational resilience and Business Continuity management are now front and center requiring the proper funding and tools. Understanding the complex interconnectivity of services, hardware, software, and vendors is no longer a job for spreadsheets. Having all relevant data brought together in a single place is the only way teams can make intelligent decisions, and that data must be accurate and current if companies are to truly protect their services. To keep pace with the changing view of the world, the teams must look to automate and cut down on the manual repetitive work allowing them to focus on the right place. 

If they fail, the company fails, it is that simple. 

 It is no surprise that focusing on adding value, and triaging the most critical work, will become increasingly important as systems and companies grow in the 21st century. 

Pillar 4 ICT Third Party Risk 

Financial entities shall manage ICT third-party risk as an integral component of ICT risk within their ICT risk management framework and in accordance with key principles for ICT third party risk management issued by the regulatory authority.  Article 28 

Third party management has always been managed differently from internal risk. Historically procurement and cost management have driven decisions, now, however, after the war in Ukraine and the supply chain difficulties that resulted, third parties are being looked at in a whole new light. 

Thanks to DORA Article 27 , how companies contract and maintain an understanding of what data is processed and at which locations is as important as cost. The obligations of collaboration in the face of an ICT incident mean that third parties need to be fully engaged with clear processes to resolve problems fast. 

So that’s why DORA is hot on Third party risk! What caught everyone out with the supply chain crisis on the back of the war in Ukraine was a lack of understanding of where and how their business-critical services were delivered. Leading to situations where, while the services were spread out, no one truly saw the concentration of risk. Company A gets their supplies from company B & C, resilience with separate sources, right? The problem was companies B & C used company D for parts, result … broken supply chain. 

With this new regulation, companies and third parties are required to dig deeper and truly understand the complete view of the supply chain and where there is a concentration of risk. 

Concentration risk 

• When performing the identification and assessment of ICT concentration risk, financial entities shall take into account whether the conclusion of a contractual arrangement in relation to the ICT services would lead to any of the following: contracting with an ICT third-party service provider that is not easily substitutable or having in place multiple contractual arrangements in relation to the provision of ICT services with the same ICT third-party service provider or with closely connected ICT third-party service providers.  

Article 29 

So now while looking at supplier risk, companies must also now look closer at whether they are “putting all their eggs in one basket” where they cannot replace a supplier with another and mitigate the risk accordingly. 

Pillar 5 Information Sharing 

 To stay resilient to the changing state of the world you need good intelligence. Financial institutions are targets for cyber criminals and targeted attacks; in essence they are at war every day without you even knowing it. 

To quote Sun Tsu  

“Military intelligence is the key to war; without it, you cannot win.” 

Pillar five is all about bringing the financial institutions together; to share the vulnerabilities and attacks they have had in a carefully controlled way so that all can learn from it and the whole is greater than the sum of its parts. 

If one falls, they could all fall, so this pillar pushes for better communication to prevent such an event.  

There are already tools available to share information anonymously in what are called trusted circles, and one of the biggest challenges DORA will face will be who should decide what to share, when they should share and how they communicate. The regulation does not say how, only that they should. 

Proportionality principle 

If everything above now has you in a cold sweat, and sounds like an impossible task, there is a ray of hope. 

Yes, this is serious; and yes, this is important with real investment needed in time, resources, and tools. There is no getting away from that, and there should not be because it is too important to do half measures. 

However, the EU does understand that not all financial institutions are equal. 

Article 4 the Proportionality principle states: 

1. Financial entities shall implement the rules laid down in Chapter II in accordance with the principle of proportionality, taking into account their size and overall risk profile, and the nature, scale and complexity of their services, activities and operations.
2. In addition, the application by financial entities of Chapters III, IV and V, Section I, shall be proportionate to their size and overall risk profile, and to the nature, scale and complexity of their services, activities and operations, as specifically provided for in the relevant rules of those Chapters.
3. The competent authorities shall consider the application of the proportionality principle by financial entities when reviewing the consistency of the ICT risk management framework on the basis of the reports submitted upon the request of competent authorities pursuant to Article 6(5) and Article 16(2). 

 In other words, the bigger the institution and the bigger the services that are being provided the more effort needs to be taken to protect it based on its risk.  

Conclusion 

DORA demands a lot of the financial industry – and for good reason. When a crisis hits, it creates a knock-on effect and dominos fall. This became real with Leman Brothers and later with Silicon Valley Bank. To make companies take notice, the EU have set the financial penalties 

In relation to financial penalties, entities found to be in violation of the Act’s requirements may face fines of up to 2% of their total annual worldwide turnover or, in the case of an individual, a maximum fine of EUR 1,000,000. The amount of the fine will depend on the severity of the violation and the financial entity’s cooperation with authorities. 

Financial entities that fail to report major ICT-related incidents or significant cyber threats as required under DORA may also face fines. Third-party ICT service providers designated as “critical” by the European Supervisory Authorities (ESAs) may face fines of up to EUR 5,000,000 or, in the case of an individual, a maximum fine of EUR 500,000 for non-compliance with the Act’s requirements. The ESAs will have the authority to impose these fines. 

 Now this might look scary, but like everything in this world we need motivation to get started when something looks too big to tackle. DORA is big yes, but it is probable that a large amount of what your company is doing today can be used or revamped to support compliance with DORA. You will only know how big the job is in front of you if you start the gap analysis and map the road ahead. 

DORA entered force on 16th of January 2023 and will apply from 17th of January 2025. 

With the right support from senior management, the right team, tools, and the right roadmap, being compliant with DORA is possible. Remember it’s all about protecting the critical business services of your company. It’s not too late, start the conversation today. 

Disclaimer: This content was not produced using AI but is the random outpouring of my brain which I hope was of use to someone.  

The post DORA, Resilience by Design appeared first on Wrangu.

I. Setting the stage.  

The AI Act comprises of 180 Recitals and 113 Articles, and it’s structured in 13 Chapters, and 13 Annexes.  

It is noteworthy that the most extensive chapter of the AI Act is dedicated to the high-risk AI systems which makes a lot of sense given that the Regulation is conspicuously a risk-centred legislative construction. I will come back to it when I analyse the steps an organisation must undertake for complying with the AI Act.   

In simple terms, the AI Act applies to operators of AI systems, meaning providers, deployers, importers and distributors of AI systems, of course, if they would make available on the market, put in place on the market or into service an AI system.  

At a first read, the definitions in Article 3 of the AI Act seem straight forward nevertheless, watch out for a multitude of interpretations. For example, I ended up discussing with both our product development management and legal associates if an organisation developing an AI system for their internal use only would qualify as a provider, given that the organisation would not put the system on the market.  

According to Article 3 paragraph (3) provider means a natural or legal person, public authority, agency, or other body that develops an AI system or a general-purpose AI model or that has an AI system, or a general-purpose AI model developed and places it on the market or puts the AI system into service under its own name or trademark, whether for payment or free of charge. Paragraph (11) provides that putting into service means the supply of an AI system by the provider for first use directly to the deployer or for own use in the Union for its intended purpose.  

Nevertheless, one of my legal associates dragged my attention that things are getting more complicated for GPAI. In this regard, the Preamble (97) offers relevant context which reads: When the provider of a general-purpose AI model integrates an own model into its own AI system that is made available on the market or put into service, that model should be considered to be placed on the market and, therefore, the obligations in this Regulation for models should continue to apply in addition to those for AI systems. The obligations laid down for models should in any case not apply when an own model is used for purely internal processes that are not essential for providing a product or a service to third parties and the rights of natural persons are not affected. Considering their potential significantly negative effects, the general-purpose AI models with systemic risk should always be subject to the relevant obligations under this Regulation. 

My point is that the complexities of the AI Act are complex enough, if I may express myself like this, to the point that organisations would need to delegate its interpretation to their in-house and/or external specialists.  

II. Complying with the AI Act in steps.  

Pausing for a bit and taking a step back, I must concur with colleagues advising that organisations must maintain an inventory of their IT tools.     

Step 1. Is my IT tool an AI system?  

Once that accomplished, on the journey to comply with the AI Act, the first step organisations must undertake is to assess if the IT tools they are developing or deploying qualify as AI systems (stand alone or components).   

Step 2. Is my AI system a prohibited AI practice?  

That being assessed and concluded upon, organisations must check if the AI systems they have in scope are on the list of prohibited AI practices as they are codified in Article 5 of the AI Act. This is an annual assessment since the Commission itself is delegated the right and the responsibility to amend the list once a year. If that is the case, organisations must already know that prohibited AI practices must be decommissioned within six months from the entry into force of the AI Act.  

Step 3. Is my AI system a high-risk AI system?  

Next step is, of course, to assess if the AI systems qualifies as a high-risk AI system. Article 6 of the AI Act defines what it is supposed to be considered a high-risk AI system. According to Articles 6.1. and 6.2. of the AI Act, there are two relevant criteria for this assessment: first, the AI system is a stand-alone or a component of an AI systems covered by the Union harmonization legislation listed in Annex I required to undergo a third-party conformity assessment; second, the AI system falls into one of the areas listed in Annex III.  

In conclusion, in above cases stemming from Article 6.1. and 6.2. of the AI Act the legislator retained a presumption of significant risk of harm to the health, safety, or fundamental rights of natural persons. 

Article 6.3. provides for exceptional cases when the above risks might be negated:  

An AI system shall not be high-risk if it does not pose a significant risk of harm to the health, safety, or fundamental rights of natural persons, including by not materially influencing the outcome of decision making.  

This shall be the case where one or more of the following conditions are fulfilled: 

1. the AI system is intended to perform a narrow procedural task. 
2. the AI system is intended to improve the result of a previously completed human activity. 
3. the AI system is intended to detect decision-making patterns or deviations from prior decision-making patterns and is not meant to replace or influence the previously completed human assessment, without proper human review; or 
4. the AI system is intended to perform a preparatory task to an assessment relevant for the purposes of the use cases listed in Annex III. 

Organisations must be aware that if the conclusion of the assessment is that the AI system is not a high-risk this outcome must be documented before the AI system is put on the market or into service. Therefore, either way organisations are not exempt from the registration obligation provided in Article 49 (2):  

Before placing on the market or putting into service an AI system for which the provider has concluded that it is not high-risk according to Article 6(3), that provider or, where applicable, the authorised representative shall register themselves and that system in the EU database referred to in Article 71. 

Step 4. What is my acting capacity?  

If the assessment concludes that the AI system is indeed a high-risk AI, organisations must determine their acting capacity. In other words, is the organisation going to provide, import, distribute or deploy the AI system? Depending on the organisation’s acting capacity different compliance obligations must be accounted for. For instance, more onerous obligations are imposed on providers of the high-risks AI systems.  

Step 5. What should I comply with?  

In a nutshell, the AI system can be put in place on the market or into service only if a conformity assessment has been undertaken, the Declaration of Conformity (DoC) has been drawn up and the CE marking has been obtained.  

According to Article 16 (f): Providers of high-risk AI systems shall ensure that the high-risk AI system undergoes the relevant conformity assessment procedure as referred to in Article 43, prior to its being placed on the market or put into service. 

The CE marking indicates that the AI system is safe. It is the reason why lawyers are assimilating the AI Act with a product safety framework.  

There are two types of conformity assessments, an internal assessment carried out by the provider itself and an assessment carried out with the involvement of a notified body.  

The conformity assessment is part of the quality management system that providers must put in place. The outcome of the conformity assessment is very much dependent on the risk management system and its operation. According to Article 9 of the AI Act: A risk management system shall be established, implemented, documented, and maintained in relation to high-risk AI systems. Basically, the risk management system is nothing else but an assessment of the known and foreseeable risk that the high-risk AI system can pose to health, safety or fundamental rights when used according to its intended purposes, but also in a context of reasonably foreseeable misuse. Other than that, the risk management system must include targeted risk management measures designed to address the risks identified to the point that relevant residual risk associated with each hazard, as well as the overall residual risk of the high-risk AI systems, are judged to be acceptable. In other words, a risk assessment must be conducted to make sure that the AI system is safe or, otherwise, trustworthy. I love the term trustworthy, is very commercial, but I must say that this is more of a safety assessment.  

Although the above lines are very much focused on compliance obligations of the providers of high-risk AI systems, the AI Act is imposing compliance obligations along the value chain. And therefore, importers and distributers, are obliged, among other things, to ensure that the system is in conformity with the AI Act by verifying that the relevant conformity assessment procedure has been carried out by the provider of the high-risk AI system. Ultimately, specific deployers must perform an assessment of the impact on fundamental rights that the use of the system may produce.  

That being said, depending on the organisation acting capacity, a set of compliance obligations must be followed through. Here is where organisations will have to rely on specialized advice from their lawyers or compliance professionals.  

III. Conclusion  

I would not end this article without pointing out that the AI Act is a very complex legislation. This article is meant to be a short guidance written with the purpose of putting a structure to the complexity. Nevertheless, this is just a first step I’m undertaking, and I will follow up with more illuminating articles where I will break down the compliance obligations depending on each stakeholder acting capacity. Up until then don’t hesitate to contact my Centre of Excellence at Wrangu for support with the AI Act. Currently my Centre of Excellence provides support in matters relating to privacy and AI Regulations. If you need support in risk management or security regulations I can put in contact with my peers from the other Centres of Excellence. 

The post A step-by-step guidance to complying with the AI Act appeared first on Wrangu.

The movements of personal data to and from countries outside the E.U. are paramount in the context of a global economy relying heavily on international cooperation and commercial ties across-nations. Nevertheless, the importance of such transfers being recognized, the increased risk to the protection of personal data exposed to international exchanges cannot be ignored either. The GDPR aims to mitigate such risks by setting-up appropriate safeguards to protect personal data disseminated beyond the E.U. borders, into the so-called inadequate jurisdictions.  

According to the 2nd paragraph of Recital 101 of the GDPR: “The increase in such flows has raised new challenges and concerns regarding the protection of personal data. However, when personal data are transferred from the Union to controllers, processors, or other recipients in third countries (…), the level of protection of natural persons ensured in the Union by this Regulation should not be undermined, including in cases of onward transfers of personal data from the third country (…) to controllers, processors in the same or another third country (…).” 

The GDPR is therefore, without prejudice to transfers of personal data beyond the E.U. borders, facilitating them if certain legal requirements are complied with. The imposition of such legal requirements is justified by the need to ensure that the individuals whose personal data are subjected to cross border data transfers continue to benefit the same rights and the same level of protection as they enjoy in the E.U.  

In other words, as the E.U. advisory bodies already posited, the GDPR was adopted to serve a dual-purpose: facilitating the free flow of personal data within the E.U., while preserving the fundamental rights and freedoms of individuals, particularly their right to the protection of personal data. 

 2. E.U. guardrails for cross-border data transfers  

 The introduction of legal guardrails for cross-border data transfers from the E.U. to other jurisdictions spurs continuous debates both in support or against. On one hand, some U.S. multinationals argue that the legislation in this matter should be more liberal with fewer requirements on cross-border data transfer, allowing for greater freedom. On the other hand, the E.U. institutions are acting with a protectionist mindset or, I would argue, in pursuit of judicial pragmatism.  

 The result of all the energy spent on cross-border data transfers since the adoption of GDPR has been the successful promotion of two Court of Justice of the E.U. (CJEU) law cases, where previous adequacy decisions regarding the U.S. have been abolished one by one. I would argue that the invalidation of Safe Harbour and Privacy Shield by the CJEU took place in this context, as opposed to being a purely philosophically or politically motivated decisions, as some are positing.  

Edward Snowden’s revelations about the use of large-scale programs for monitoring the Internet and telephone conversations by the U.S. intelligence services played a seminal role in that and from that moment on. Of course, there is much more than the Snowden’s case, if we only think about the never-ending delay of the U.S. Congress in adopting a comprehensive privacy law that would create equal data protection rights for all Americans and all data on the American soil.  

The Snowden disclosures shed light on numerous global surveillance programs, predominantly run by the NSA and the Five Eyes Intelligence Alliance, which includes New Zealand, the U.K., and Canada.  

In response to Snowden actions, Maximilian Schrems filed a complaint with the Irish Data Protection Commissioner challenging Facebook Ireland’s transfer of his personal data to the U.S., alleging that it exposed his data to U.S. surveillance in violation of EU law. Schrems’ complaint was rooted in the principle embedded in EU data protection law, emphasizing that personal data subject to EU standards must be treated equivalently when exported or not exported at all. This principle was reinforced by Recital 116 of the GDPR, highlighting the increased risk to individuals’ data protection rights when data moves across borders. 

Initially assuming Facebook relied on the EU-US Safe Harbor Decision, Schrems later discovered Facebook’s use of Standard Contractual Clauses (SCCs) for data transfers. Despite this revelation, the Irish Data Protection Commissioner, considering Schrems’ complaint frivolous, argued its inability to prohibit transfers if Facebook relied on Safe Harbor. Schrems contested this stance in Irish courts, ultimately leading to the CJEU’s Schrems I decision in 2015, which invalidated Safe Harbor. However, the Commissioner informed Schrems post-decision that Facebook used SCCs, prompting Schrems to amend his complaint accordingly. 

The European Commission’s accelerated discussions with the U.S. Department of Commerce resulted in the Privacy Shield Decision, aimed at facilitating U.S.-E.U. data transfers. However, the Irish Commissioner’s investigation into Facebook’s transfers and US surveillance found the protection inadequate under E.U. law. Despite Facebook’s arguments regarding national security exclusions and the validity of the Privacy Shield, Schrems maintained that the Privacy Shield misrepresented U.S. surveillance laws and lacked authority to interpret SCCs. The case eventually made its way to the CJEU through the Irish High Court, culminating in the Schrems II judgment. 

3. Safeguardingthe E.U. cross-border data transfers 

In the aftermath of the CJEU Decision 2016/1250 in Case C-311/18 invalidating the Privacy Shield or better known as Schrems 2 judgment, the European Data Protection Board (EDPB) has released Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data.  

 The Recommendations comprises, among others, of a 6-steps roadmap for data exporters to verify, on a case-by-case basis and, where appropriate, in collaboration with the importers, if the law or practice of the third country impinges on the effectiveness of the appropriate safeguards contained in the Article 46 of the GDPR. Organisations relying on standard data protection clauses, binding corporate rules, codes of conduct or certification mechanisms must: 

1. Map all transfers of personal data to third countries and verify if they are adequate, relevant, and limited to what is necessary in relation to their purposes.  
2. Verify the transfer tool relied upon. 
3. Assess if there is anything in the law and/or practices in force in the third country that may impinge on the effectiveness of the appropriate safeguards of the transfer tools relied upon, in the context of the specific transfer.  
4. If needed, identify and adopt supplementary measures that are necessary to bring the level of protection of the data transferred up to the EU standard of essential equivalence. 
5. Take any formal procedural steps the adoption of the supplementary measure may require.  
6. Re-evaluate at appropriate intervals the level of protection afforded to the personal data transferred to third countries and monitor if there have been or there will be any developments that may affect it. 

The third step is commonly known as a Transfer Impact Assessment (TIA). A TIA must be conducted by data exporters, with the assistance of the data importer, prior to any transfer relying on the appropriate safeguards listed in Article 46 of the GDPR. If the country of destination is covered by an adequacy decision, the exporter is not subject to this obligation. The same applies if the transfer is carried out based on one of the derogations listed in Article 49 of the GDPR. 

Carrying a TIA is not a trivial exercise, which is why some Data Protection Authorities and legal experts alike have proposed templates and roadmaps to scoping the exercise from different angles. For example, the French Data Protection Authority (CNIL) has elaborated a Practical Guide in line with the Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data which was adopted on 18 June 2021.  

The CNIL Practical Guide advises that, before undergoing a TIA exercise, the exporters should weight into five aspects, as follows:  

1. The data subject to transfer constitutes personal data according to the provisions of Article 4(1) of the GDPR  
2. A data transfers takes place according to Guidelines 05/2021 on the interplay between the application of Article 3 and the provisions on international transfers as per Chapter V of the GDPR.  
3. Exporter and importer acting capacity (i.e., controllers, joint controllers, processors)  
4. Minimizing the volume of the data subject to transfer or anonymizing the data 
5. The possibility to transfer the data to an adequate country. 

On the other hand, the U.K. Data Protection Authority, the infamous Information Commissioner’s Office (ICO) proposed a Transfer Risk Assessment (TRA). The ICO interprets the word “impact” as “risk” and therefore, proposes a risk assessment. In other words, according to ICO, depending on the quantifiable risk of the processing activity and its risk score, the transfer can be “permitted” or “not permitted”. 

This is a deviation from both the EDPB and CNIL approach which, on the contrary, interprets the CJEU Judgment in Case C-311/18 as imposing an obligation on businesses to conduct an effectiveness assessment with regards to the transfer tool employed for transferring data to inadequate jurisdictions. Therefore, the word “impact” must be read, according to the CJEU, EDPB and CNIL interpretation, considering the consequences that specific legal context might have on the “effectiveness” of contractual commitments and their standing to provide for an “essentially equivalent level of protection” in the country of destination of the data. 

In other words, according to the CJEU, EDPB and CNIL interpretation, impact/s on the level of the essentially equivalent protection must be mended through supplementary measures, if possible. If not possible, even in the case of a theoretical or residual risk to the essentially equivalent level of protection of the data and individuals, the transfer must be suspended or halted. 

Independent of these differences in approaches, a TIA exercise should gauge at least the following aspects:  

1. Applicable legislation for the protection of personal data. 
2. Laws or practices affecting the effectiveness of the transfer tool.  
3. Any rule of law shortcomings that would impinge on data subject possibility to appeal against an illegal access to data. 
4. Importer potential to be subject to a request for access or a direct access to the data.  

 4. Conclusion 

The timing of Edward Snowden’s revelations proved pivotal in the landscape of privacy and data protection law. Just a year earlier, the European Commission had introduced the EU General Data Protection Regulation (GDPR), which was undergoing extensive debate and reforms, still a few years from its eventual adoption. Concurrently, the EU-U.S. Safe Harbor Framework remained operational. Notably, Maximilian Schrems was on the cusp of filing his complaint with the Irish Data Protection Commission, a move that would eventually lead to the invalidation of the Safe Harbor and subsequently of Privacy Shield by the Court of Justice of the European Union and imposition of transfers assessments or TIAs.   

The objective of a TIA is to assess whether the importers in third countries will be able to respect obligations committed to in transfer engagements they will sign up for, in view of the legislation and practices of the third country, especially as they amount to the potential access to personal data by public authorities of the third country, and to document this assessment.  

If necessary, the TIA must assess whether supplementary measures would allow to fill-in gaps ascertained and to ensure a level of protection essentially equivalent with the one prescribed in the EU data protection legislation. 

At Wrangu, we have a legal team on top of privacy and data protection combined with technical experts to deliver privacy solutions like Privacy Hub which includes a TIA module. Download our brochure or schedule a call to see how we can help solve your privacy needs.

The post Regulating Cross Border Data Transfers under GDPR appeared first on Wrangu.

Although it is undisputed that the EU flagship data protection legal regime has been a major digital policy success, judging only by its global influence, many voices called for its reform in particular with regards to Supervisory Authorities handling of cross-border investigations. This approach is very much consistent with the EU Commission plans that “further progress is required to make the handling of cross-border cases more efficient and harmonised across the EU”.  

At the heart of the reform is the one-stop-shop enforcement mechanism which caused a concentration of investigations in the hands of only few Supervisory Authorities (SA), typically in the member states where the big tech giants established their main European operations such as Ireland or Luxembourg.  

Basically, according to the GDPR, the Lead Supervisory Authority (LSA) in cross-border investigations is the SA of the main establishment of the data controller.  

Nevertheless, despite, the GDPR providing for cooperation and dispute resolution mechanisms between the LSA and other concerned SAs, disagreements on procedural details resulted in important delays with repercussions (i.e., individuals left on the sidelines) on an important number of cross-border investigations. This led to the GDPR success being put into question.  

The European Data Protection Board implication  

In this context, on 28 April 2022, the European Data Protection Board (EDPB) issued a statement on enforcement cooperation also known as the Vienna Statement. In this Statement, the EDPB identified a list of procedural aspects that could be further harmonised in EU law to maximise the positive impact of GDPR cooperation. This list addresses, inter alia, the status and rights of the parties to the administrative procedures, procedural deadlines, requirements for admissibility or dismissal of complaints, investigative powers of Supervisory Authorities and the practical implementation of the cooperation procedure. 

The EU Commission proposal for a GDPR 2.0. 

Following suit, on 4 July 2023, the European Commission issued a Proposal for a Regulation laying down additional procedural rules relating to the enforcement of the GDPR. Practitioners are referring to this Proposal as to GDPR 2.0.  

On 19 September 2023 the European Data Protection Board and the European Data Protection Supervisor releases a Joint Opinion 01/2023 on the latter proposal.  

GDPR 2.0. covers certain procedural aspects aimed at avoiding procedural disagreements between SAs, making the process faster and easier for the complainant, and helping the SAs with more robust decisions.  

Here are some key points in the Commission’s Proposal:  

1. Cross-border complaints. A complaint relating to cross-border data protection or privacy matters will be admissible basis on a unique form completed by the complainant. Within certain procedural terms the receiving SA will send the complaint to the LSA. A complaint may be resolved by amicable settlement between the complainant and the parties under investigation. The translation of the complaint and supporting document will fall under the administration of the supervisory authority with which the complaint was lodged.  
2. Reaching consensus. The LSA will regularly update and provide relevant information to the concerned SAs. The LSA will additionally submit a draft summary of key issues to the concerned SAs for their comments. Where disagreements arise the LSA will engage with the SA concerned based on their comments on the summary of key issues in an endeavour to reach a consensus at an early stage. Where consensus cannot be reached the European Data Protection Board will be called to adopt an urgent binding decision on the scope of the investigation based on the comments of the supervisory authorities concerned and the position of the lead supervisory authority on those comments. 
3. Hearing of complainant prior to full or partial rejection of a complaint. The SA with which the complaint was lodged must inform the complainant of the reasons for the intended full or partial rejection of the complaint and set a time-limit within which the complainant may make known her or his views in writing.  
4. Preliminary findings. LSA will draft and submit preliminary findings before the infringement draft decision. When notifying the preliminary findings to the controller/s and/or processor/s under investigation, the LSA will equally provide them with access to the administrative file while allowing them to write a reply.  
5. Non-confidential version of submissions. An entity submitting information that it considers to be confidential must clearly identify such information giving reasons for the confidentiality claims. The entity must provide a separate non-confidential version of the submission or otherwise, identify the documents or parts of documents which it considers containing business secrets or other confidential information or to identify the parties for which the documents are considered to be confidential.  

Conclusion

GDPR 2.0. is a procedural regulation exclusively, with a limited scope, aiming at setting up enhanced rules to avoid that the SAs would use very lengthy litigation measures before they come to an agreement in cross-border litigation.  

For that reason, GDPR 2.0. is nudging authorities to reach an agreement ahead of litigations by harmonising certain parts of the procedures. At the same time, the proposed rules give EDPB new powers to issue fast decisions ahead of the lengthy formal dispute resolution procedures which have often been pointed at for being the reason for stalling the process of enforcement of the GDPR.  

As regards to timeline for adoption, given the limited scope of this Regulation, the adoption process might be short and might take place under the mandate of the current EU Commission. Else, in case some of the member states impeding that fast adoption, this might be one of those files that is dragged onto the next Commission’s mandate.  

Also, as IAPP is announcing a panel discussion at the upcoming IAPP Europe Data Protection Congress in Brussels, titled “The GDPR Is 5 Years Old: Is It the Age of Maturity?” will explore the topic.  

Wrangu will be present at the IAPP event in Brussels with a team of data protection and privacy professionals on the ground. They will be happy to engage in conversations on the matter and respond to questions.   

At Wrangu, we have a legal team on top of privacy and data protection combined with technical experts to deliver GDPR solutions. Download our brochure or schedule a call to see how we can help solve your GDPR needs.

The post GDPR 2.0. Upcoming big changes for GDPR enforcement in the E.U. appeared first on Wrangu.

Doing Good and Doing Well 

Beyond compliance, avoiding personal liability, and reputational harm there are other important reasons to implement ESG related initiatives. Consumers say they care about sustainability and all the consumer sentiment surveys bear that out and, for the most part, so do their actions. According to a McKinsey Survey, consumer packaged goods with ESG-related claims like “eco-friendly” and “fair trade” saw sales grow nearly 2 percent faster than other consumer packaged goods year over year for the last five years. 

At the same time, consumers are growing wary of potential greenwashing desiring authenticity as a necessary factor in what they buy viewing their consumptive habits as a reflection of who they are. Risks to companies manifest in threats stemming from consumer boycotts prompted by the prominence of messaging that travels quickly on social media. When deciding on business strategy, companies should ask themselves whether they are driving decarbonization and the move to net zero and how? Are they focused on fair labor practices like paying a living wage and safe working conditions?  

While some executives might view a competitor’s “margins as my opportunity,” those sentiments have catalysed a revitalization in the labour movement and put consumers in the uncomfortable position of grappling with a sort of moral dilemma that does not bode well for the future. Millennials and Gen Z care about the planet and are most on guard for inconsistent messaging. This coupled with the potential to bring private rights of action under forthcoming legislation creates a scenario of incentives for companies to make good on their ESG program.  

Wrangu’s Corporate Sustainability Due Diligence Directive product utilizes ServiceNow’s platform strength to provide cost-effective, low-risk, and high-impact supply chain management solutions through transparency, automation, and visualization.

So, what do businesses need to do to be prepared? 

Steps to Take Now 

Notably, these requirements are part of a Directive meaning their application into national law will leave room for variation. Building on our experience with the LkSG (German Supply Chain Due Diligence Act), we have identified the following general steps all companies should take on the road to sustainable business operations.  

1. Map Business Relationships

Under the CSDDD, companies are obligated to set up and carry out due diligence measures in their business process, their subsidiaries, as well as direct and indirect business relationships throughout the value chain. Companies do not need to guarantee that something bad will not happen. Rather, the expectation is to take measures that “can reasonably be expected to result in prevention or minimisation of” violations to human and environmental rights. This includes upstream and downstream relationships meaning your company’s suppliers and the companies you supply products or services to ensuring that your business output does not result in harm. 

This will naturally be a challenge. Supply chains are complex, and this effort will be an operational burden with the Directive spelling out the need to go beyond “first tier” suppliers that have a direct contractual relationship to the company. Businesses need to figure out how they are going to gather this information. One suggestion is to send out questionnaires to existing suppliers gathering information about second, third and tier n suppliers and their business practices around human rights and environmental risks. This kick starts documentation and the ability to demonstrate accountability and compliance with the Directive including gathering actual and potential impacts from independent reports, auditors, and activists.  

Another potential activity is to introduce contractual clauses requiring new suppliers to identify their suppliers with sufficient guarantees that raw materials, products, and services are procured from where suppliers say they are. This must include some form of redress for bringing violations to an end and consequences for failing to do so.  

2. Review and Update Policies 

Companies need to “integrate due diligence into all their corporate policies” describing the company’s approach to implementing due diligence and have a code of conduct describing the rules and principles that employees and subsidiaries must follow.  

Most companies will have some type of policies and codes of conduct in place. However, these need to be updated to cover the specific requirements of the CSDDD and will require amendments to other policies like employment and supplier contracts.  

Training of employees and business partners will be key to ensuring new policies and procedures and put in place, understood, and actionable. 

3. Adopt a Risk Management System  

The Directive’s requirement to identify “actual and potential adverse impacts” is all about risk management. Risk management is a complex calculus around likelihood and impact of violations taking into account factors like geopolitical conflict, pandemics, local rules and practices on human and environmental rights, and climate change to name a few. The Covid pandemic is a careful reminder of the complexity around managing supply chains.  

Because this is likely to be an important investment, companies should start looking now for experienced providers around compliance, vendor risk, and integrated risk management.  

4. Establish a Complaints Procedure 

A complaints procedure is also a key part of the Directive. Because new requirements stipulate the complaints procedure must be open to the operations of business partners, existing whistleblowing procedures will need to be updated and provisions made to include information gathering.  

5. Document and Publish your Efforts 

This step is both proactive and reactive. Under the Directive, Companies are required to publish an annual report. Not only is this a requirement, but this is also an opportunity for companies to proactively tell their story around sustainability and many already do this. To effectively do this, companies will need documented evidence supporting the claims they make highlighting the importance of keeping records on what decisions were made, the reasons for those decisions, and when decisions will be reviewed.  

Another reason for keeping records, beyond demonstrating accountability and compliance, is the requirement that companies make decisions based on principles like “fair and “reasonable.” Because these principles do not have clear definitions, it is likely that decisions will be challenged. Especially when something goes wrong. To make a defence or provide a justification, companies will again need evidence for doing so. Keeping up-to-date and accurate records will make it easier to respond to requests and complaints and provide information to regulators and defend legal claims.  

Conclusion 

Regulation on corporate sustainability due diligence is coming, and the road to compliance is not a technological quick fix. We recommend that businesses act now to be compliant with forthcoming legislation and sync with their customer, investor and employees demands. 

At Wrangu, we have years of experience and dedicated consultants for developing products and services to solve your compliance, vendor, and integrated risk challenges on the ServiceNow platform. We are an elite level partner that moved quickly to develop solutions around the German Supply Chain Due Diligence Act. Learn more at https://www.wrangu.com/corporate-sustainability-due-diligence-directive/. 

The post Five Steps to Prepare for the EU Corporate Sustainability Due Diligence Directive (CSDDD) appeared first on Wrangu.

Broadly, speaking the CSDDD is aimed at fostering sustainable and responsible corporate behaviour requiring companies to undertake compliance with due diligence requirements on both their own business operations as well as the business operations of their suppliers. This expansive scope means suppliers that do not meet the regulatory threshold will still need to comply as part of the supply chain of larger companies. even if those suppliers do not necessary meet the thresholds specified by the Directive. 

Wrangu’s Corporate Sustainability Due Diligence Directive product utilizes ServiceNow’s platform strength to provide cost-effective, low-risk, and high-impact supply chain management solutions through transparency, automation, and visualization.

The CSDDD is set to apply to: 

• Businesses located in the EU with: 

• 500+ employees on average and net worldwide turnover of €150m in the last financial year; or 
• 250+ employees and a net worldwide turnover of €40m in the last financial year and at least €20m was generated in a high risk sectors like textiles, agriculture, and extractives. 

• Businesses outside the EU with: 

• A net turnover of more than €150m in the EU in the previous financial year; or 
• A net turnover of more than €40m in the previous financial year and at least €20m was generated in a high risk sector.

Much like the German LkSG, the EU Due Diligence Requirements target human rights and environmental issues across the following areas: 

• Policies to incorporate a commitment to uphold the human rights and prevent environmental abuses; 
• Mapping Business Relationships; 
• Risk identification, management, and mitigation; 
• Complaint and Grievance Process; 
• Publishing an Annual Report; and  
• Continuous Monitoring and Improvement. 

The CSDDD also includes a public law supervision and enforcement requirement akin to a supervisory authority with investigative and enforcement powers and, as it currently stands, the CSDDD allows for private enforcement, meaning individuals could bring their own lawsuits, including class actions. Ultimately, non-compliance will result in reputational harm, lost value, fines, and potentially civil liability for individual executives.  

Some Member States are not waiting for the final texts to be agreed.  Germany has already implemented legislation, the LkSG (Supply Chain Due Diligence Act) which went into effect at the beginning of this year as we talked about in our webinar with ServiceNow and wrote about in an earlier blog post. The Netherlands is also moving forward. The Child Labour Duty of Care will soon enter force and the country may well pass its own Responsible and Sustainable International Business Act.  

While a final agreement on the Directive is not yet in place, given expectations of investors, employees, and consumers, global ESG trends, and the extent of the obligations and the impact on supply chain activities, businesses are advised to begin preparations. 

Conclusion

This regulatory change is motivated by necessity from the bottom up and the top down with consumers, employees, investors, and regulators coalescing around a shared commitment to environmental and human rights.  

Bottom line, regulation on corporate sustainability due diligence is coming! In some Member States it is already here and the road to compliance is not a technological quick fix so impacted businesses need to start moving now!  

This is also an important reminder that before even getting to the CSDDD, businesses should consider whether they are one of the 50,000 companies required to produce ESG reporting under the Corporate Sustainability Reporting Directive, already in effect.  

At Wrangu, we have years of experience and dedicated consultants for developing products and services to solve your compliance, vendor, and integrated risk challenges on the ServiceNow platform. We are an elite level partner that moved quickly to develop solutions around the LkSG (German Supply Chain Due Diligence Act). Contact us to learn how we can help. 

The post The EU Corporate Sustainability Due Diligence Directive (CSDDD) is coming appeared first on Wrangu.