Articles
from the Zentej team.

EU AI Act enforcement starts August 2026. For financial services, NHS and government organisations, the question is no longer whether to govern AI — it's whether your detection and documentation capability is in place before the first examination.

Three clouds, three platform teams and three compliance scores is not a governance model — it's three governance models. The organisations running Azure, AWS and GCP simultaneously face a compounding challenge that most governance tooling was not designed to solve.

The claim is 30 minutes. The delivery mechanism is a seven-step pipeline that prevents non-compliance before it can occur. Here is exactly what happens between landing zone request and the first workload going live.

Generic AI assistants answer from training data. ZAP AI answers from your actual infrastructure — specific resources, specific findings, specific compliance scores. The difference is not marginal. It is the difference between guidance and governance.

DORA entered into force in January 2025. The five most common ICT risk management gaps we see in financial services cloud estates — and what to do about each.

When your infrastructure data, findings and compliance evidence are processed by a SaaS governance platform, your data has left your regulated environment. For financial services, NHS and government organisations, this is not a nuance — it is a regulatory fact.

Engineering teams pull AI containers the same way they pull any other container image. The governance implications are categorically different. Here is what is actually running in production Kubernetes clusters — and why it matters for GDPR, DORA and the EU AI Act.

Cyber Essentials Plus assessment for an NHS trust used to take 3–4 months of preparation time. Here is how ZAP reduces this to a morning — and why that matters for the annual DSPT cycle.

Cloud cost attribution that begins after resources are deployed is always retrospective, always incomplete and always requires manual investigation. Mandatory tagging enforced at deployment changes this permanently. Here is the architecture that makes it work.

Air-gapped cloud deployment is increasingly common in government and defence-adjacent environments. Here is what cloud governance looks like when the environment has no internet connectivity — and where ZAP's self-hosted architecture becomes a hard requirement.

IP address conflicts in cloud networks are more common than most organisations realise. When they occur in production, they cause outages. Here is why IPAM must be the first step in any cloud deployment workflow.

Compliance evidence packs have traditionally been a 3–4 week manual exercise. Here is what needs to be true about your governance infrastructure for evidence generation to take seconds rather than weeks.