What we watch

Business risks join the library

The library now covers the money risks most small companies carry, not only security ones: running out of cash, depending on one large customer, late payment and a loss bigger than the insurance. Two new questions — whether revenue covers costs, and how much comes from the largest customer — decide which apply and how they are scored.

The risks small companies rank highest, beyond security

Five risks that the published surveys of what businesses fear most put near the top for small companies, and the library did not cover: our own outage, hiring and keeping people, a competitor or platform taking the market, a public incident damaging trust, and a rule change arriving unnoticed.

Source: Allianz Risk Barometer; Aon Global Risk Management Survey

Intellectual property and open-source licences

Three risks that due diligence asks about early: work never assigned to the company, a copyleft licence inside the product, and AI output that reproduces someone else's work.

Card data, children's data and payment accounts

Three answers in the profile now lead somewhere: holding card numbers, holding children's data, and taking payments through Stripe.

Contracts, tax, sanctions, founders and regional outages

Five more risks a small company carries whatever it builds: a contract with uncapped liability, VAT or sales tax owed where we never registered, a sanctioned customer, the founders falling out, and the cloud region we run in going down. Running out of cash now notes what tighter funding markets and higher rates do to a forecast.

The library's first release

Suggested risks and controls for small companies that build software, with a first pack for AI companies selling to finance and healthcare. From now on the library is checked every month, and each release says here what changed and why it reached you.

The EU AI Act's high-risk duties move to December 2027

The Digital Omnibus on AI, in force since 27 July 2026, moved the duties for high-risk uses listed in Annex III — credit scoring, insurance pricing, hiring — from 2 August 2026 to 2 December 2027, and those for AI inside regulated products to 2 August 2028. The transparency duties for systems that talk to people or generate content did not move.

Source: Regulation (EU) 2026/1744 (Digital Omnibus on AI)

The UK's rules on automated decisions changed in February

From 5 February 2026 the UK GDPR's Article 22 was replaced by Articles 22A–22D. Decisions made solely by automated means are allowed on more grounds than before, with safeguards — a way to contest the decision and to get a person to look at it — and stricter limits where special-category data is involved.

Source: Data (Use and Access) Act 2025, section 80 and Schedule 6; SI 2026/82

Colorado replaced its AI Act before it took effect

SB 26-189 repealed the 2024 Colorado AI Act and replaced it with notice and disclosure duties for automated decisions about people, from 1 January 2027. The duties to run a risk management programme and impact assessments are gone. A legal challenge may still move the date.

Source: Colorado SB 26-189