https://ansvar.eu/blog Field notes on auditable AI for legal, compliance, and security work. en Thu, 09 Jul 2026 09:00:00 GMT https://ansvar.eu/blog/threat-model-to-compliance-evidence https://ansvar.eu/blog/threat-model-to-compliance-evidence Thu, 09 Jul 2026 09:00:00 GMT team@ansvar.eu (Jeffrey von Rotz) A threat model and a NIS2/DORA/ISO gap analysis describe the same system. Map each threat to the measure it satisfies, with article-level citations. threat-modeling nis2 dora compliance mcp https://ansvar.eu/blog/eu-ai-act-obligations-by-role https://ansvar.eu/blog/eu-ai-act-obligations-by-role Mon, 06 Jul 2026 09:00:00 GMT team@ansvar.eu (Jeffrey von Rotz) Provider, deployer, importer, distributor, GPAI provider — each EU AI Act role carries its own obligations. The role test, article references, and live dates. eu-ai-act compliance ai-governance regulatory-intelligence mcp https://ansvar.eu/blog/cited-answers-vs-rag-for-regulated-work https://ansvar.eu/blog/cited-answers-vs-rag-for-regulated-work Thu, 02 Jul 2026 09:00:00 GMT team@ansvar.eu (Jeffrey von Rotz) RAG citations are decorative — no provenance contract links chunk to answer. Regulated work needs typed corpus tools, deterministic validation, and refusal. rag citations compliance mcp legal-tech https://ansvar.eu/blog/swedish-law-as-an-mcp-server https://ansvar.eu/blog/swedish-law-as-an-mcp-server Mon, 29 Jun 2026 09:00:00 GMT team@ansvar.eu (Jeffrey von Rotz) 6,041 Swedish statutes from Riksdagen, segmented to section level and served as an MCP — query by SFS number, chapter, and paragraf, every result cited. swedish-law mcp legal-data citations compliance https://ansvar.eu/blog/automating-the-dpia-evidence-trail https://ansvar.eu/blog/automating-the-dpia-evidence-trail Thu, 25 Jun 2026 09:00:00 GMT team@ansvar.eu (Jeffrey von Rotz) A GDPR Article 35 DPIA has an automatable core and a judgment core. AI assembles the cited evidence trail; the DPO signs necessity and proportionality. gdpr dpia privacy compliance-automation mcp https://ansvar.eu/blog/dora-article-28-third-party-mapping https://ansvar.eu/blog/dora-article-28-third-party-mapping Mon, 22 Jun 2026 09:00:00 GMT team@ansvar.eu (Jeffrey von Rotz) DORA Article 28 sets the third-party obligations; the contract clauses live in Article 30. Each subsection mapped to ISO 27001 and SCF controls. dora third-party-risk iso-27001 compliance mcp https://ansvar.eu/blog/nis2-vs-iso-27001-clause-mapping https://ansvar.eu/blog/nis2-vs-iso-27001-clause-mapping Thu, 18 Jun 2026 09:00:00 GMT team@ansvar.eu (Jeffrey von Rotz) Every NIS2 Article 21(2) measure mapped to ISO 27001:2022 Annex A — and the three real gaps: reporting clock, management liability, supply chain depth. nis2 iso-27001 compliance regulatory-intelligence mcp https://ansvar.eu/blog/what-is-an-mcp-gateway-for-compliance https://ansvar.eu/blog/what-is-an-mcp-gateway-for-compliance Mon, 15 Jun 2026 09:00:00 GMT team@ansvar.eu (Jeffrey von Rotz) Chat and RAG hallucinate regulatory citations. An MCP gateway adds routing, fan-out, tier auth, and deterministic citation validation — and when you need one. mcp compliance mcp-gateway citations regulatory-intelligence https://ansvar.eu/blog/effective-risk-cve-noise-llm-era https://ansvar.eu/blog/effective-risk-cve-noise-llm-era Mon, 25 May 2026 09:00:00 GMT team@ansvar.eu (Jeffrey von Rotz) AI tooling files more CVEs than any analyst can read. Effective-risk rescoring deterministically scores CVE × asset × controls, citing every score change. vulnerability-management cvss risk-scoring mcp ai-security https://ansvar.eu/blog/how-we-threat-model-ai-with-mcp https://ansvar.eu/blog/how-we-threat-model-ai-with-mcp Wed, 20 May 2026 09:00:00 GMT team@ansvar.eu (Jeffrey von Rotz) STRIDE was built for 1999 monoliths. How we adapted it for agentic systems and shipped it as a workflow your own AI client runs through the Ansvar gateway. threat-modeling ai-security mcp linddun tara