Blog

Technical depth on AI, Azure, Next.js, and the engineering decisions behind them.

47 posts

Scraping the web into your vector DB: EDPB's new rules

At its 122nd plenary on 7 July 2026 the EDPB adopted draft Guidelines 03/2026 on web scraping for generative AI and draft Guidelines 02/2026 on anonymisation, the first comprehensive GDPR framework for large-scale scraping of public web data into AI pipelines. We walk through the legitimate interest test, the new legal weight of robots.txt and ai.txt, the Article 9 lifecycle safeguards, and what it means for teams ingesting web content into RAG on Azure.

July 8, 2026459 viewsSecurity & Compliance

AI Act deadlines moved: what still lands August 2, 2026

On 16 June 2026 the European Parliament approved the Digital Omnibus amendments 423-57, moving Annex III high-risk AI Act obligations to 2 December 2027 and product-embedded obligations to 2 August 2028. Article 50 transparency duties and the Commission's GPAI enforcement powers were not delayed, which leaves Swedish enterprises six weeks to ship chatbot disclosure, content marking and a documented GPAI position before 2 August 2026.

June 17, 2026468 viewsSecurity & Compliance

Who will knock on your door about AI in Sweden? IMY, mostly

On 15 June 2026 IMY confirmed its role as market surveillance authority for the EU AI Act, with responsibility covering AI systems in areas such as law enforcement and credit assessment, alongside PTS and Finansinspektionen. For Swedish enterprises this puts GDPR and AI Act supervision under one regulator, and IMY's sandbox role offers a way to get data protection guidance before enforcement reaches full strength in 2027.

June 15, 2026704 viewsSecurity & Compliance

CADA explained for Azure customers: EU cloud sovereignty

On 3 June 2026 the European Commission proposed the Cloud and AI Development Act, a regulation that introduces four Union assurance levels for cloud sovereignty and aims to at least triple EU data centre capacity within five to seven years. For Swedish public-sector and regulated teams on Azure, the framework will decide which workloads can stay on a US hyperscaler and which need an EU-controlled alternative, so the classification work should start now.

June 10, 2026365 viewsSecurity & Compliance

Sweden's cloud policy: digital sovereignty for Azure teams

Sweden's first national cloud policy (Fi2026/01233) bans no provider but makes jurisdictional exposure, portability and exit capability the questions every public-sector cloud decision must now answer in writing. For Azure estates, a defensible position means classified workloads, enforced Swedish and EU residency, customer-managed keys for sensitive data and a tested export path.

June 1, 2026557 viewsSecurity & Compliance

EU AI Act High-Risk Readiness: 11 Weeks to August 2026

High-risk obligations under the EU AI Act apply August 2, 2026. For teams shipping AI inside the Annex III categories, that is 11 weeks of runway. This is the readiness state most teams reach by skipping the strategy decks: what actually changes, what the four obligations that require code look like, and where compliance spending misfires before the deadline.

May 10, 2026898 viewsSecurity & Compliance

NIS2 in Sweden: The Practical Engineer's Checklist

Sweden's cybersäkerhetslag (2025:1506) took effect on 15 January 2026, and the engineering detail sits in the ordinance and the MCFFS regulations rather than the headlines. This checklist covers scope and the essential versus important split, registration with FRA, the eight supervisory authorities, the three incident reports and their deadlines, supplier contract clauses, and the Azure and Microsoft 365 controls behind each of the ten measure areas.

March 10, 2026744 viewsSecurity & Compliance