Field notes on regulation as systems engineering.
Regulation changes, but the operating problem is often the same: organisations need to turn obligations into decisions, ownership, evidence and reporting that remain usable between meetings. Ariadnah Insights examines that work across regulatory regimes, beginning with the areas where our experience is deepest. Each article starts with the rule, then follows it into the decisions, dependencies and records that make compliance work in practice.
Browse 26 insightsFind the regulation or operating question you need.
26 insights shown
26 articles
One per cent
A large law firm is spending half a billion dollars on its own AI. The legal press called it a watershed. Measured against the firm's revenue, it is a modest research budget, and that gap is the story.
Cross-regulation · Suppliers & contractsTwo rankings, one decision
On capability alone, a US hyperscaler came first. Once we applied the rest of what our management system requires, the European provider was the better call.
DORA · Suppliers & contractsThe Risk You Didn’t Sign
Nearly one in three major DORA incidents in 2025 originated with a third party. A contract list alone does not show where the dependency actually sits.
DORA · Regulatory reporting & dataOne Contract, How Many Countries?
DORA requires another register row for every service country reported, but gives firms no stable test for deciding which countries belong there.
NIS2 · Governance & management accountabilityNIS2 Article 20: Management Body Responsibilities
NIS2 Article 20 requires management bodies to approve cybersecurity risk-management measures, oversee implementation and follow training. What does credible oversight look like in practice?
DORA · Implementation & practiceWho Reads the Register?
A DORA Register of Information can pass structural checks and still give a poor account of risk. The harder question is who can tell the difference.
DORA · Suppliers & contractsDORA Supply-Chain Reporting: When Granularity Creates Noise
DORA seeks visibility into ICT concentration risk. But repeated service-level supply-chain mapping can create duplicated work and inconsistent supervisory data.
DORA · Technical foundationsWhy DORA requires you to track every software library in your application stack
Modern software applications rely on hundreds of third-party libraries and dependencies. A single application might use dozens of open-source packages, each with its own nested dependencies. When a vulnerability emerges...
DORA · Regulatory reporting & dataHow to report intra-group ICT service providers in your register of information
When a group entity purchases ICT services and provides them to your financial entity, your reporting approach depends entirely on whether you report individually or at consolidated level. This distinction...
DORA · Technical foundationsWhen non-EU service providers lack a LEI: the identifier workaround
If you're working with non-EU ICT service providers that don't have a Legal Entity Identifier, you face a practical compliance challenge. The Implementing Technical Standards (ITS) on the DORA register...
DORA · Assets, services & dependenciesHow to Map ICT Services to Business Functions: A Complete Yet Proportionate Approach
The Problem: When Technology and Regulation Collide The DORA register of information is central to the new European legislation for digital operational resilience. Financial institutions must map and report their...
DORA · Suppliers & contractsICT suppliers in DORA – which contracts must be recorded?
Recording ICT supplier contracts is a fundamental DORA requirement. But there's significant confusion about which contracts are actually in scope. This guide cuts through the complexity to give you clear,...
DORA · Assets, services & dependenciesillustrative example: business functions of a venture capital fund manager
Defining business functions is a central requirement under the Digital Operational Resilience Act (DORA). As part of building your ICT risk management framework, you must identify the business functions your...
DORA · Assets, services & dependenciesBusiness functions in DORA; The cornerstone of your ICT Risk management
Business functions are the cornerstone of your entire ICT risk management framework. Think of it as creating a blueprint of your organization, you need to know what you do (functions),...
DORA · Implementation & practiceDORA for Microenterprises: Why size matters for your compliance journey
Good news for small financial entities: your DORA compliance path is simpler than you might think If you're a board member of a small financial entity facing DORA compliance, here's...
DORA · Regulatory reporting & dataReferential integrity
Many organizations are using Excel to set up and manage their DORA Register of Information (RoI) but Excel simply isn’t built for this task. The problem lies in the complexity...
DORA · Regulatory reporting & dataThe value of the DORA register of information: a helicopter view
The Digital Operational Resilience Act (DORA) represents a significant shift in how financial organizations manage digital risks. For SMEs in the financial sector, this isn't just another compliance checkbox —...
DORA · Technical foundationsNavigating F identifiers in schema 06.01: how to avoid mapping chaos
The Digital Operational Resilience Act (DORA) requires the use of function identifiers (F keys) in schema 06.01, which seems simple at first — but quickly becomes complex. Managing these identifiers...
DORA · Regulatory reporting & dataLEI requirements in the DORA register of information: what you need to know
If you're preparing your DORA Register of Information submission, you need to understand the identifier requirements for ICT third-party providers in template B_05.01. The Implementing Technical Standards (ITS) on the...
DORA · Implementation & practiceWhy Excel isn’t enough for DORA reporting: key lessons from the ESA dry run
Discover the implications of the Digital Operational Resilience Act (DORA) for financial entities in our comprehensive document. With mandatory reporting for ICT third-party service providers set for
DORA · Implementation & practiceHow the Dutch Association of Insurers supports DORA implementation
The Digital Operational Resilience Act (DORA) has a significant impact on the insurance sector. Insurers must comply with this new European regulation by January 17, 2025. In practice, insurers are...
DORA · Suppliers & contractsHow to classify contracts under DORA: standalone, overarching, or associated?
The challenge When completing the Digital Operational Resilience Act (DORA) information register, you must specify the type of each contractual arrangement: standalone, overarching, or subsequent/associated. This classification must be recorded...
DORA · Suppliers & contractsUnderstanding RT.03: mapping ICT contractual relationships under DORA
The purpose of RT.03 RT.03 is the cornerstone of mapping contractual relationships in your ICT service landscape. It's designed to create a clear picture of who's signing what, who's providing...
DORA · Implementation & practiceOur journey with the DORA register: challenges, solutions, and collaboration
Over the past few months, we've immersed ourselves in the complexities of the DORA register (Digital Operational Resilience Act). What is the DORA register? For those less familiar with the...
DORA · Assets, services & dependenciesFinancial data in the DORA register: what to report and how to collect it
If you're grappling with the Digital Operational Resilience Act (DORA) register, you've probably wondered about the financial data requirements. What exactly do you need to report? And how can you...
DORA · Implementation & practiceDORA Asset Management: What regulators expect
Core requirement: Know what you have DORA requires you to create and maintain a comprehensive inventory of all your digital assets. This isn’t optional – it’s a fundamental regulatory expectation...
Want a briefing on how any of this applies to your firm?
A discovery call goes through an example close enough to your operation that you can judge whether this way of modelling compliance fits how you want to work.
Book a discovery call →