Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
The Commission published non-binding Cyber Resilience Act guidance on 27 July 2026. A plain split of what is law, what is guidance and what software makers should do with each.
Regulation (EU) 2026/1744 entered into force on 27 July 2026 and moves AI Act high-risk dates to December 2027 and August 2028. Binding law, with a few obligations that did not move.
EO 14415 of 20 July 2026 tells the Department of War to require supply chain mapping and an indentured bill of materials that includes software. Nothing binds contractors until policy and rules follow.
DoD suspended CMMC Phase II on 13 July 2026 and a 3 September class deviation removed third-party assessment requirements from contracts. NIST SP 800-171 self-attestation still applies.
The FAR Council re-proposed its CUI rule on 23 June 2026 with 72-hour incident reporting and NIST SP 800-171 Rev 3. It is still a proposal, so nothing is binding yet.
Since 2 August 2026 the AI Office can enforce GPAI duties and Article 50 transparency rules apply. A split of binding law, voluntary code and what software makers should check first.
The AICPA sets no minimum period for a SOC 2 Type 2 report. Here is how to choose 3, 6 or 12 months for your first one, and what a short window costs you.
A bridge letter covers the gap between your SOC 2 report period and today. Management signs it, the auditor does not, and it is not a substitute for a report.
What to say, what to send and what never to promise when a prospect asks for SOC 2 before your first audit. Includes a reply you can adapt today.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
