Skip to content

Live activity

Articles and posts from Adrian Hollister across the blog, LinkedIn and Bluesky: on digital sovereignty, cyber security, data protection, and the cost of depending on US infrastructure.

Digital Sovereignty

Europe wants its armies off American cloud

European defence runs on American cloud: nineteen countries on Microsoft alone. Brussels has drafted the law to change that, and the ministries are fighting it. What the Cloud and AI Development Act does, the oath that settled the sovereignty question, the precedent that shows the machinery has…

Read article →
IT Strategy

Windows 10 ESU year two: pay again or leave Microsoft?

Year one of paid Windows 10 security updates ends on 13 October 2026, and year two costs twice as much. What ESU costs in the UK, what Cyber Essentials accepts, and the four exits compared, including Linux.

Read article →
Digital Sovereignty

Sovereignty as a Strategy, Not a Cost

The compliance case for sovereignty is well rehearsed and slightly dull. The commercial case is newer: a market being created by procurement, and a supplier position that can now be priced.

Read article →
AI & Ethics

AI decision logs: how long to keep them under the EU AI Act, DORA and GDPR

The EU AI Act sets a six-month floor for high-risk AI logs, DORA lands at five years in practice, and the GDPR obliges you to delete. Which rule governs depends on who you are and what is inside the log.

Read article →
Cyber Security

Assurance Without Theatre

A certificate is a statement that a management system exists, not evidence that a model works. The task of a board is to tell the difference, and then to ask for the second thing.

Read article →
IT Strategy

The Supplier You Cannot Exit

Concentration is a continuity question rather than a procurement one: whether the business can still operate when one supplier changes its price, its terms, its model version or its mind.

Read article →
Digital Sovereignty

What a Credible European AI Layer Would Take

A European AI layer does not mean a European ChatGPT. It means a European organisation with a sensitive workload has real options: a model it can run, compute it can contract for under European law, terms it can exit. Credible means buyable, and four requirements follow from that test.

Read article →
Digital Sovereignty

Where Your Data Lives, and Who Can Compel It

Residency answers where data sits. It does not answer who can reach it.

Read article →
Digital Sovereignty

Your AI Answers to a Foreign Government. Part 1: China vs America

What Washington and Beijing have already done with the power to cut off, read and steer the AI Europe depends on.

Read article →
Digital Sovereignty

Beyond ERP: What Replacing SAP and Dynamics with Odoo Actually Looks Like

ERP is the deepest vendor lock-in most organisations carry. Odoo, a Belgian open-source suite, offers a genuinely different model: modular, queryable and deployed in weeks. What a Beyond ERP migration looks like in practice, limitations included.

Read article →
Leadership

The Questions a Board Cannot Delegate

A board can delegate the building of an AI system. It cannot delegate the duty to know what that system decides, on whose data, under whose law, and who answers when it is wrong.

Read article →