354 articles · page 1 of 18
Week of 5 October 2026
Rural health transformation money runs on three clocks, and only two of them come with funding
In October 2026 states raced to obligate first-year Rural Health Transformation funds. The clock that matters most for rural providers starts after the grants end, when technology bought with them has to pay its own way.
Week of 28 September 2026
Paused, not repealed: what CMMC’s suspension left defense contractors paying for
With third-party CMMC certification suspended and no new schedule six weeks before the old November date, contractors faced a budgeting problem. Some security spending was still owed, some could wait, and some had simply changed price.
Week of 21 September 2026
Agency certificates now expire faster than agency budgets turn over
The first full-term 200-day TLS certificates expired on October 1, 2026, the first day of the federal fiscal year. Agencies that bought, staffed and scheduled certificates on an annual rhythm had to rebuild all three around renewals that no longer fit one.
Week of 14 September 2026
Hospital device data rights arrive one purchase order at a time
The EU Data Act’s access-by-design rule, live from September 12, 2026, reaches only equipment placed on the market from that date. For hospitals with decade-long replacement cycles, tenders carry the new right while the installed base runs on requests.
Week of 7 September 2026
Europe’s 24-hour vulnerability clock reports to regulators first and customers second
From September 11, 2026, the Cyber Resilience Act required manufacturers to warn EU authorities of exploited flaws within 24 hours. Customers were owed notice too, but on no fixed clock, so buyers still need their own intake.
Week of 31 August 2026
Bank cyber gaps now arrive as observations the board never has to see
The OCC and FDIC limited matters requiring attention to material financial harm, a year after the FFIEC retired its common cyber assessment. Many cyber weaknesses will now reach banks as informal observations, so banks must set their own escalation rules.
Week of 24 August 2026
Health systems inherit the patients that IAL2 proofing turns away
A year after NIST’s identity rewrite and CMS’s interoperability pledge, verified credentials were starting to open patient records across networks. Patients who cannot obtain one still depend on their health system, which needs designed routes for in-house proofing and vouching.
Week of 17 August 2026
The dollar AI deals ended in a meter, and meters need ceilings
Six weeks before GSA’s nominal-price AI offers expired, agencies had no successor terms. Usage pricing was the likely replacement, which moves the hard decisions to budget execution: how to fund a meter, who runs it, and how to keep alternatives.
Week of 10 August 2026
Post-quantum signatures are still being chosen, so build PKI to switch twice
Signatures had moved up the post-quantum queue, but two years after NIST’s first standards the choice of signature scheme was still open. Organizations should sort signatures by how long they must stay verifiable, and design each tier for a second change.
Week of 3 August 2026
Article 50 kept its date, and it lands on the chat window
The EU deferred high-risk AI obligations weeks before August 2, 2026, but the transparency duties arrived on schedule. For banks, insurers, hospitals and agencies serving Europeans, the work sits in interface design, content pipelines and publishing sign-off.
Week of 27 July 2026
Why WISeR providers should keep their own record while Congress argues
The Senate’s July vote left Medicare’s AI-assisted prior authorization model running in six states, its future still contested. Providers bound by it now need their own record of decisions, documentation and appeals, because that record serves both daily operations and the policy fight.
Week of 20 July 2026
Stablecoin rules late, statutory clock on time: the GENIUS Act’s awkward first year
Regulators missed the GENIUS Act’s July 2026 rulemaking deadline, but the law’s January 2027 backstop date did not move. Banks could not wait for final text to decide which role to play, and the funding question cut across every choice.
Week of 13 July 2026
Fedwire’s ISO 20022 switch gave banks rich payment data their core systems still truncate
A year after Fedwire moved to ISO 20022, the structured message reached most US banks intact. Its value did not, because data was lost at origination, inside banks’ own systems, or in screening and fraud tools never set up to use it.
Week of 6 July 2026
Medicaid’s frailty test asks for a code and proof of impairment, and clinicians hold both
CMS’s June 2026 rule tied the medically frail exemption from Medicaid work requirements to the past year’s coded diagnoses plus evidence that the condition impairs work. Coding, certification workflows and data sharing now help decide who keeps coverage.
Week of 29 June 2026
July 1 in teaching hospitals: thousands of joiners, movers and leavers in one week
The annual residency changeover is the largest identity event a US teaching hospital runs. Joiners, movers, leavers and the supervision record each fail differently, and each needs its own control and measure.
Week of 22 June 2026
Why Europe’s accessibility law turns every bank release into evidence
A year after the European Accessibility Act began to apply, banks serving EU consumers have learned that conformance decays with every release, template change and vendor update. The durable answer is a running body of evidence across four parts of the service.
Week of 15 June 2026
The client-certificate deadline that moved, and the certificate authorities that didn’t wait
Chrome pushed its cutoff for client authentication in public TLS certificates to March 2027, but certificate authorities kept their own earlier schedules. For any mutual TLS link, the deadline that counts is the one set by whoever issues the certificate.
Week of 8 June 2026
Why World Cup cyber risk sat in the city services residents use every day
Stadiums had federal, state and venue security teams. The exposure host-city agencies owned was in the services around them: resident and visitor channels, transit and traffic systems, 911 and dispatch, and vendors shared across jurisdictions.
Week of 1 June 2026
For a small adviser, Regulation S-P compliance is bought before the breach
When amended Regulation S-P reached smaller advisers and broker-dealers on June 3, 2026, most of them had no in-house incident team. For them, compliance is a set of purchases made in advance: response capacity, evidence and the means to notify.
Week of 25 May 2026
Faster settlement, longer nights: what two years of T+1 tell Europe’s operations desks
The US move to one-day settlement held because firms automated trade-date matching and redesigned who works when. Europe and the UK move in October 2027, and the shift pattern and funding model will be harder to build than the software.