The
Accountability
Gap

NIS2: the work starts after the audit

The deadline for the first cybersecurity audit passed on 30 June, and much of the market booked it as an exam passed and done with. Public signals suggest, however, that the supervisory authority, the SZTFH, is now entering the less comfortable phase: inspecting the businesses covered by the audit.

Two things are worth taking from this. An audit is a snapshot, not compliance: supervision will look at whether remediation of the gaps found has started, and whether the protective measures work in day-to-day operations, not only in the documents. And responsibility sits with management: in the logic of the Hungarian cybersecurity act, compliance is owned by management, not by IT. Whoever files the audit report in a drawer now will be explaining themselves against their own report at the next inspection.

Translated from the Hungarian original.

Vibe lawyering reaches the workplace

The Economist reports on what it calls “vibe lawyering”: lay people litigating with AI. The numbers are arresting: Canadian courts flagged fabricated citations in 79 rulings this year against 7 in all of 2024, and self-representation in US federal civil cases has climbed from 11% to 17%.

The angle I would put in front of HR leaders: chatbots encourage claims and inflate the perceived odds of winning. A two-sentence grievance now arrives as a ten-page, AI-drafted discrimination claim, fully cited, sometimes to cases that do not exist. Most employer processes are built for neither the volume nor the format. The response is not to dismiss such claims for how they were written; it is to triage on substance, verify the citations, and answer with the same precision the claimant borrowed. The liability frontier, whether the model provider answers for encouraging the claim, is being tested; worth watching, not yet worth relying on.