Governance Risk Compliance

Miss a deadline, and you're out of compliance. Miss the trend behind the deadline, and patients get hurt.   Medical device incidents happen every day. Most teams chase deadlines and miss the bigger picture.   Every report has a clock. But knowing when to report is only the start.   What experienced vigilance teams know:   Meeting deadlines keeps you compliant.   Managing patterns keeps patients safe.   Those 2-day, 5-day, 10-day, and 30-day clocks?   They’re not just regulatory requirements. They’re early warning signals.   High-performing companies treat vigilance deadlines as data collection points.    Here are 4 ways you can start today:    1. Master Your Reporting Timelines   • 10 days for EU deaths and public health threats • 5 days for FDA events needing remedial action • 10 days for serious incidents in Canada and Australia   Each deadline reflects a severity tier.  Track them to see your risk profile trend over time.   2. Document Your Classification Logic   • Record criteria for “serious deterioration.” • Define what constitutes a “public health threat.” • Set clear thresholds for “remedial action.”   Auditors check consistency.  Clear logic shows you understand the rules and apply them the same way every time.   3. Align Your Global Reporting   • Japan: 15-day reports for serious injuries • Brazil: 30-day submissions for malfunctions posing serious risk • Australia: 10-day notifications for deaths   Different clocks for similar events = opportunities to standardize internally.   4. Build Systems Around Deadlines   • Set alerts for 2-, 5-, 10-, and 30-day triggers. • Create templates for each timeline (required fields, attachments, sign-offs). • Map submission portals to deadline categories (EUDAMED, MedWatch, NOTIVISA, etc.).   When vigilance management is systematic, compliance follows naturally.   And when compliance runs on rails, your team can prevent the next incident. Not just report the last one. ⬡⬡⬡⬡⬡⬡⬡⬡⬡⬡⬡⬡⬡⬡⬡⬡⬡⬡⬡⬡⬡⬡⬡⬡⬡⬡⬡⬡⬡⬡⬡⬡⬡⬡⬡⬡⬡⬡⬡⬡⬡⬡ MedTech regulatory challenges can be complex, but smart strategies, cutting-edge tools, and expert insights can make all the difference. I'm Tibor, passionate about leveraging AI to transform how regulatory processes are automated and managed. Let's connect and collaborate to streamline regulatory work for everyone! #automation #regulatoryaffairs #medicaldevices

GRC Made Simple: How Governance, Risk & Compliance Work Together Governance, Risk, and Compliance (GRC) aren’t just buzzwords or separate functions, they’re essential building blocks that work together to keep organizations safe, responsible, and future-ready. Let’s break it down: 1. Governance – Setting the Direction Governance defines how decisions are made and ensures that the organization is being run responsibly. It covers: - Respecting laws and regulations - Following recognized standards (like ISO 27001, NIST CSF) - Aligning policies and processes with business goals and ethical values - Establishing roles, responsibilities, and clear decision-making The result? Clear accountability and structured decision-making across the organization. 2. Risk – Understanding What Could Go Wrong Risk management is about being proactive, not avoiding risk, but identifying and preparing for it. It includes: - Identifying risks across all levels enterprise, business units, vendors, and IT systems - Assessing how likely and how impactful each risk could be - Implementing controls to reduce those risks - Continuously monitoring and updating based on new threats The result? Confident, informed decisions based on actual risk exposure. 3. Compliance – Making Sure You Do What’s Required Compliance ensures that your business meets external regulations and internal standards. It involves: - Keeping up with laws, regulations, and industry requirements - Performing self-assessments and gap analysis - Preparing for internal and external audits - Proving that policies and controls are working The result? Trust from regulators, customers, and your leadership team. Why GRC Matters. When GRC works together, your organization: - Reduces operational disruptions and regulatory risks - Stays ready for audits and inspections - Strengthens cybersecurity and data protection - Builds trust and long-term resilience In the current fast-moving, high-risk world, moving from siloed processes to a connected GRC strategy is no longer optional, it’s essential. #GRC #Governance #RiskManagement #Compliance #Cybersecurity #ISO #3PRM #NIST #InternalControls #RiskAwareness #AuditReadiness #BusinessResilience #ITSecurity #OperationalExcellence #TPRM

A founder I know had been building for three years... Strong product. Growing team. Investors were circling. She had everything she needed to expand into the UK market and finally hit the revenue milestone she'd been chasing since day one. Then due diligence started. No documented data privacy policy. Governance gaps the legal team flagged immediately. Security controls that looked fine internally but couldn't survive external scrutiny. The investor didn't walk away. But the close took four extra months, two law firms, and more money than she'd budgeted for the entire expansion. Four months. In a scaling company, that's an eternity. The thing nobody tells you when you're heads-down building: The dream: new markets, bigger contracts, faster raises, compounding revenue, doesn't get unlocked by ambition alone. It gets unlocked by infrastructure. The quiet, unglamorous work of setting up a GRC framework before you need one. ✅ Governance that shows investors you can be trusted with capital. ✅ Risk controls that let you enter new markets without scrambling. ✅ Compliance structures that close enterprise deals instead of delaying them. That founder got there eventually. But she'll tell you herself, the founders who scaled past her that year weren't smarter or better funded. They just had their house in order before the opportunity knocked. Compliance isn't what slows companies down. The absence of it is. #StartupGrowth #Compliance #GRC #FounderMindset

Rumors of the death of US privacy enforcement were premature. ⬇️ Recap of the 5 myths busted on privacy in the US for non-US companies, from my presentation at the Naschitz, Brandes, Amir & Co. - AYR - Amar Reiter Jeanne Shochatovitch & Co. Privacy Day event: Myth 1: I'm under the radar so I'm safe from enforcement -> No, you're not. 🟣Regulators are enforcing against non-US entities with zero boots on the ground. (FTC in Avast & non-public FTC investigations).  🟣The US State privacy laws are also extra-territorial in application. 🟣Your competitors are telling on you to regulators.   🟣Your clients are less inclined to engage you because they are (more) worried about their own compliance. 🟣Private plaintiffs and classes are filing thousands of lawsuits. Myth 2: I can deal with it later  -> Later may be too late.  🟣Buyers (in M&A deals) are increasingly looking into privacy earlier and in more depth.   🟣Customers prefer someone that makes it easy for them to comply with their own higher privacy risk (If they need a DPIA (risk assessment) or a third party bias audit (for AI use) and you don't have one, they will look for someone who does).  🟣Sometimes too late is too late and  without the right setup in place the defect is not curable. (DoorDash case). Myth 3: US privacy is "inadequate" and the Trump Admin doesn't care  -> No US enforcement is very complex, and active.   🟣The FTC is enforcing seriously with a focus in sensitive data, children's data, auto-renewal, pricing, fake reviews, "AI washing" and more.  🟣Sectoral laws like HIPAA (for health data) are being enforced, including for cookies.  🟣50 states have consumer protection laws that apply to privacy violations  🟣20 states have privacy laws, issuing $3 billion in fines in 2025. 🟣California has new CCPA regulations with requirements on cyber audits, DPIA, and transparency. Texas, Connecticut, Oregon and others are enforcing.  🟣Lots of class action lawsuits on all types of violations including: websites, chatbots, health data and biometrics.  Myth 4: US AI regulation is "inadequate" & Trump Admin doesn't care  -> No There are A LOT of difference state laws on AI and Federal may be coming.  🟣There are a number of dedicated AI laws like the Colorado AI Act & Texas TRAIGA. 🟣There AI disclosure, deepfake, AI Companion & transparency in training data laws. 🟣The Executive Order on AI envisions a preemptive, Federal AI law and encourages Congress to get there. Myth 5:  "I did GDPR so I'm fine" -> No.  US laws are different, and GDPR doesn't cover you. 🟣Different privacy notice, DPA and privacy rights.   🟣You need more DPIAs than under GDPR; they need to be more robust, and, in California, your C-Suite needs to submit confirmation, under penalty of perjury, that your DPIAs are in order.  🟣You need to deal with biometrics laws and children's data laws.   🟣US AI enforcement is strict and is already in play in the US. Thank you Dalit and Eyal for inviting me!  

Wildwood Surgical Center waited over a year to notify patients after a June 2025 network breach exposed Social Security numbers and medical records to an unauthorised third party. The Toledo facility discovered suspicious activity in June 2025 but sent notification letters in July 2026. The compromised data includes diagnoses, treatment details and financial information, creating severe identity theft risks. This delay highlights a persistent operational flaw in healthcare cybersecurity. Organisations often prioritise containment and legal consultation over immediate transparency, treating notification as a compliance exercise rather than a critical component of patient care and trust. Yet, the deeper vulnerability lies in data architecture. Storing highly sensitive diagnostic records alongside routine billing information on the same accessible network ensures that a single perimeter failure compromises everything from medical history to bank accounts. Audit your data storage architecture immediately. Separate clinical records from financial and personally identifiable information, enforcing strict access controls so a breach in one domain cannot cascade into another. Protecting patient data requires much more than just strong firewalls; it demands intelligent separation so that a single point of failure never destroys an entire life. #CyberSecurity #DataPrivacy #Healthcare

General Michael Hayden and I argue in Foreign Affairs Magazine that, while the American #intelligence #community is the envy of the world, under President Trump some of the same pathologies that make authoritarian regimes prone to intelligence failures are making the U.S. system similarly vulnerable. He disregards the value of intelligence and abuses the agencies that produce it. Increasingly staffed by loyalists rather than seasoned professionals, intelligence agencies risk becoming overly politicized, providing justification for policy decisions rather than informing them. Whether it results in a #terrorist or #cyber attack, a foreign policy miscalculation, or a #military surprise, the consequences of an intelligence failure could be profound. Intelligence failures are inevitable even in healthy systems. Uncovering and properly assessing secrets is hard at the best of times; human fallibility guarantees that there will be errors in process and analysis. But distortions within the system increase the likelihood of failure. The classic case is an authoritarian regime in which the self-assured ruler does not tolerate other views. Intelligence officers in such systems operate in an environment where speaking truth to power is not tolerated, acquiescence is preferred over expertise, sycophancy trumps insight, and “alternative facts” must be presented to maintain the leader’s preferred narrative. Offering good-faith assessments that contradict the ruler’s views is considered disloyalty and invites punishment. Without space for analytical dissent and the presentation of unvarnished views, leaders can receive and act on faulty intelligence. The resulting culture of politicized analysis, self-censorship, and suppression of unwelcome truths mirrors the conditions in autocracies that generate intelligence failure. Read on: https://lnkd.in/eN6GQDSB CC King's College London Department of War Studies King's Centre for the Study of Intelligence (KCSI), Cambridge Security Initiative, Michael V. Hayden Center for Intelligence, Policy, and International Security

“I didn’t know I couldn’t donate. It was only $50.” An H-1B worker made a small political donation. They didn’t realize that foreign nationals can’t contribute to U.S. campaigns. Years later, they became a green card holder. Now they’re worried about applying for citizenship. The donation itself is a problem — it violates federal law. But there’s an even bigger risk. Most campaigns require you to check a box confirming you are a U.S. citizen or green card holder. If you checked that box when you weren’t, it can look like a false claim to citizenship. That’s not just a technical error. It can be a career-ender for your immigration journey. The lesson: Even “small” mistakes can have long shadows. If you’re in the U.S. on a visa, know the limits before you act. And if you’ve made a misstep, get it fixed before USCIS finds it for you.

Data subject rights form a cornerstone of Data Protection Laws, yet many organizations continue to stumble in their implementation. Recent rulings from the Office of the Data Protection Commissioner have exposed a troubling trend of laxity or even outright ignorance in how companies respond to these rights. This approach mirrors the flawed logic of ignoring a persistent issue in the vain hope it will resolve itself. The opposite holds true: neglect only amplifies the consequences. Take, for instance, the case of Lee Mutunga vs. Sportpesa. The complainant sought to exercise his right to erase his data, but Sportpesa’s opt-out process proved unnecessarily convoluted. Rather than facilitating a straightforward exit, the company required Mutunga to submit additional details such as his occupation that bore no relevance to closing his account. The company failed to justify this demand, breaching the data minimization principle, which mandates that only data essential to a specific purpose should be collected. This overreach not only frustrated the complainant but also landed Sportpesa in the cross hairs with the ODPC. 👉Why should your organization prioritize data subject rights and ensure they are effectively enabled? Beyond the ethical imperative to respect individual autonomy, there are tangible stakes involved. In the Mutunga case, the Data Commissioner ordered Sportpesa to pay the complainant Ksh 350,000 in compensation for the violation. Furthermore, the Commissioner went a step further, recommending the prosecution of the company’s directors for obstructing investigations and providing misleading information. These penalties underscore a critical truth: non-compliance carries financial, legal, and reputational risks that can far outweigh the effort of building a brand. Here are key lessons for your organization: 📌Establish simple, user-friendly opt-out mechanisms that empower data subjects to exercise their right to erasure or withdraw consent without unnecessary hurdles. 📌Recognize that responding to data subject requests is itself a form of processing, subject to the same data protection principles and lawful bases as any other activity. 📌Adhere strictly to the data minimization principle, collecting only the information essential for verification and be prepared to justify every piece of data requested. #dataprotection #dataprivacy #compliance

🎲 A recent Deloitte analysis highlights how the EU's new AML Regulation will significantly reshape AML compliance across the gambling industry. With Regulation (EU) 2024/1624 becoming fully applicable in July 2027, gambling operators will need to move beyond traditional threshold-based controls and adopt a much more comprehensive, risk-based approach. Some of the key changes include: ⬛ Monitoring cumulative and fragmented transactions below the €2,000 threshold. ⬛ Linking customer activity across both online and retail channels. ⬛ Stronger Customer Due Diligence (CDD) and Enhanced Due Diligence (EDD) requirements. ⬛ Greater emphasis on business-wide risk assessments. ⬛ Increased investment in technology capable of aggregating customer data and identifying suspicious behaviour across multiple touchpoints. For many operators, especially those with extensive retail networks, compliance will no longer be limited to identifying high-value winners. Instead, it will require the ability to build a complete view of customer activity from the very first interaction. As Deloitte notes, this evolution reflects a broader trend in financial crime compliance: effective AML is increasingly based on understanding customer behaviour over time rather than assessing individual transactions in isolation. The article provides a useful overview of both the regulatory expectations and the operational challenges that gambling operators should begin preparing for well ahead of the 2027 implementation deadline. Source: https://lnkd.in/epJRue44

Beyond Compliance: How GRC Becomes the Engine of Real Organizational Resilience In today’s threat landscape, where cyberattacks, operational disruptions, and regulatory shifts are increasingly common, true resilience can’t be improvised. Governance, Risk, and Compliance (GRC) offers more than just alignment with standards—it provides the strategic framework to embed resilience into the core of the organization. By connecting risk awareness with operational performance, GRC transforms static policies into dynamic capabilities that sustain business continuity, security, and trust. Standards like ISO 22301 (Business Continuity) and ISO/IEC 27001 (Information Security) define what organizations must do to protect and recover operations. But without a GRC structure, these frameworks remain fragmented. GRC enables organizations to operationalize these standards by aligning them with ISO/IEC 27005 and ISO 31000, ensuring that risk management isn’t isolated but fully integrated into strategic decisions. This unified risk posture supports preventive actions and strengthens crisis response before it’s needed. Incorporating NIST Frameworks (CSF / SP 800 series) allows GRC to offer a practical, threat-informed perspective, while COBIT and ITIL ensure that governance of technology and services aligns with business goals and continuity expectations. With GRC, these standards are no longer separate compliance checklists—they form a living system. This system provides traceability, ownership, and auditability across the entire organization, reinforcing critical functions and response protocols. Resilience is further enhanced through integration with Zero Trust, which shifts the security model from perimeter-based to identity- and context-driven. Within a GRC framework, Zero Trust principles become enforceable governance controls that continuously validate access, data flows, and operational dependencies. This reduces the risk of insider threats and lateral movement, while supporting continuity and recovery under real-world attack conditions. Ultimately, GRC is the engine that allows organizations to convert frameworks into function, and standards into strategy. It connects leadership, IT, security, legal, and operations under a shared vision of resilience. In doing so, it ensures that business continuity is not an isolated program, but a measurable, governed, and continuously improved capability. When driven by GRC, resilience becomes more than a goal—it becomes a culture.