CIO priorities for 2025 include modernizing security approaches, addressing evolving threats, managing legacy operational technology, tightening fundamental controls, and embracing AI as both a challenge and opportunity. A balanced strategy focuses on foundational cyber hygiene and operational resilience while allowing space for innovation.
https://www.fastcompany.com/91323841/what-should-a-cios-priorities-be-for-2025
EU's AI strategy lags behind the US and China. To become competitive, it should:
Addressing defense AI and promoting global leadership in open-source AI is vital. Europe has the resources; bold actions are required to catch up.
https://cepa.org/article/what-if-the-eu-was-really-serious-about-ai/
R&G Tech Studio podcast discusses the EU AI Act, focusing on AI literacy requirements for organizations. Hosts Rohan Massey and Edward Machin explain the broad definition of AI systems under the Act and emphasize the importance of AI literacy for both providers and deployers, irrespective of risk categories. Organizations must tailor AI literacy training based on contextual needs, employee roles, and resources. They suggest that companies begin developing AI literacy strategies now, despite limited guidance, to ensure compliance and effectively manage AI-related risks.
CIOs must understand the diverse identities within their IT organizations, recognizing that the “we” in IT includes various groups with differing values and engagement levels. Successful CIOs need to be transparent about their own identity and foster engagement by ensuring employees have effective tools, reducing unnecessary work, and managing vendor relationships. By broadening the concept of “we,” CIOs can enhance collaboration and collective responsibility for IT value creation and security across their organizations.
https://www.cio.com/article/3968848/managing-the-many-wes-of-it.html
QSAs recently discussed PCI DSS 4.0.1 updates at a Source Defense roundtable, focusing on requirements 6.4.3 and 11.6.1. Key topics included merchant eligibility, iframe protection limitations, and compliance challenges amid eSkimming threats.
EU proposes thresholds for computational resources to clarify compliance for general-purpose AI (GPAI) models under the AI Act effective August 2025. The guidelines, subject to industry feedback via a survey, aim to establish when AI models become subject to regulatory requirements. Key points include defining GPAI models based on compute use (>= 10^22 FLOP), obligations for record-keeping, copyright policies, and potential compliance benefits for signatories to a forthcoming code of practice. Critics argue reliance on FLOP is flawed as it may inadequately reflect model capabilities and risks. Moreover, modifications over certain compute thresholds may elevate compliance burdens.
https://www.pinsentmasons.com/out-law/news/eu-clarify-ai-act-scope-gen-ai
EU's “security AI” plans face criticism for lack of transparency, risking human rights and civil liberties. A new report highlights loopholes in the AI Act that enable police and border agencies to use experimental AI technologies without public oversight.
EU AI Office issued draft guidelines for obligations on general-purpose AI (GPAI) models applicable from August 2025. Stakeholders can provide feedback until May 22, 2025. The guidelines clarify the AI Act's provisions for GPAI, defining it as models performing multiple tasks, needing technical documentation and copyright compliance. Systems exceeding 10^25 FLOPs qualify as GPAI with systemic risk (GPAI-SR) and have stricter requirements. Fine-tuning these models may create new compliance obligations. Companies should establish AI governance, map AI applications, and prepare for the upcoming regulations. Compliance for earlier models must be achieved by August 2027.
2025 Global Threat Landscape Report Highlights:
Separating the CISO (Chief Information Security Officer) from the IT department and having them report to the CFO can enhance their ability to communicate cybersecurity risks in business terms, thereby improving executive collaboration and reducing conflicts of interest. This shift allows CISOs to focus on risk management over solely technical controls, fostering strategic discussions about cybersecurity investments and their impact on the overall business. By adapting their language and understanding financial fundamentals, CISOs become better positioned to advocate for funding and align security initiatives with business objectives.
https://www.csoonline.com/article/3964405/reporting-lines-could-separating-from-it-help-cisos.html
