# Martin Foerster

Martin Foerster shares practical guidance on EU regulation and governance for businesses, including NIS2 supply-chain security, cloud-provider switching under the Data Act, and AI risk and accountability. The posts focus on turning requirements into concrete steps such as contract changes, decision inventories, and clear ownership.

- Profile: https://b2binfluencer.marketing/creators/martin-foerster/
- LinkedIn: https://www.linkedin.com/in/foerstermartin
- LinkedIn followers: 3,811
- Topics: artificial-intelligence, supply-chain, ai-governance
- Based on 13 dated posts, latest 2026-10-04

## Summary

They are most useful for turning EU rules into concrete contract, ownership and risk steps.

- Best for: A RegTech or compliance advisory company targeting regulated B2B clients with practical EU regulatory content.
- Not for: Consumer technology mass-reach product launch, guaranteed impressions, lifestyle video, or documented sponsored-post package.
- Check first: Confirm they accept sponsored work, formats, rates, comparable results, and audience sector data.

### Takeaways

- A rule is not in force until a contract says so.
- AI risk comes from the decision a system influences, not the tool.
- Production AI needs named owners, not an AI team.

## Main ideas

- **A rule is not in force in your organisation until a contract says so**: Foerster focuses on contracts and renewal timing, where EU compliance work happens—not on questionnaires and policy statements. A vendor questionnaire records only what a supplier claimed at one point in time. NIS2 Article 21(2)(d), they argue, calls for security requirements in the contract, a supplier duty to notify you of an incident affecting your service, defined rights over documentation, testing and subcontractor changes, and an internal response path for a supplier report at 23:00. The same test applies to the EU Data Act: existing cloud contracts may still contain egress fee schedules, vague assistance obligations and no defined transition period. Those clauses do not become valid just because both parties signed them. Foerster’s priority is to rank suppliers by the function they support, not contract value; fix the top tier at the next renewal; and document a risk position and date for the rest. Renegotiation is slow, and starting when the audit is scheduled means presenting a plan rather than a contract.
- **AI risk comes from the decision a system influences, not the tool on the procurement list**: Foerster argues that listing AI tools is not enough. The useful question is which decisions those systems influence: a vendor name does not tell you whether a system drafts a summary, ranks job candidates, recommends a credit outcome, handles a customer complaint or triggers an operational action, each with a different risk profile. For a useful AI inventory, they recommend recording the business decision or process affected; whether the system drafts, recommends, ranks, predicts or acts; the level of human review; the data involved; the accountable owner; the risk classification and review date; and what changes trigger reassessment. AI Act obligations and most compliance expectations depend on context: risk follows intended use and consequence, not a model name. Build the decision inventory first, they advise, and put the tool inventory underneath it.
- **Production AI needs named owners, not an AI team**: Foerster says the hardest point in an AI project is the handover to production, not the prototype. The common failure, they argue, is distributed responsibility: the innovation team builds the system, operations uses it, security checks access, legal owns the policy, procurement manages the supplier, and no one owns the overall operating risk. That is where responsible AI becomes a document rather than a practice. Before a use case scales, three roles need to be explicit: a business owner accountable for the outcome and permitted use; a technical owner accountable for the system and change management; and a risk or control owner accountable for assessments, reviews and records. One person can fill multiple roles, but the AI team is not an owner. A pilot can rely on attention and manual checks in a way production cannot.
- **A new legal right does not mean the risk has been handled**: Foerster separates the legal change from the operational one. The Data Act gives customers of data processing services the right to switch providers, with a defined maximum notice period, a transition window, and an obligation on the provider to support the move and return data in a structured, commonly used format. Switching charges are being phased out; from 12 January 2027, providers may no longer charge them. Foerster links this directly to DORA: an exit strategy for a critical or important function now has statutory support, weakening the argument that leaving is commercially unfeasible. But their conclusion cuts against the obvious compliance-marketing reading: exit is now a right, not an easy process, and removing a fee does not remove the six months of engineering work behind it.
- **Explaining regulation by making readers test their own setup**: The posts follow a consistent teaching pattern. Each opens by challenging an assumption: for example, that the NIS2 supply-chain obligation is about a contract change, not a questionnaire, or that an AI inventory may be focused on the wrong thing. Next come a specific regulatory or report hook, a short checklist or sequencing recommendation, and a closing question about the reader’s own organisation. The question tests whether a practice already exists; a description of the rule cannot do that. The posts name regulatory hooks including NIS2, the German BSIG, the Data Act, DORA, the EU AI Act and GDPR, alongside cited reports and internal benchmark material.

## Work to read

- [Responsible AI fails at handover](https://www.linkedin.com/posts/foerstermartin_harpocrates-solutions-eu-regulatory-compliance-activity-7506025008339763200-k37o)
- [The Data Act rewrote your cloud exit clauses](https://www.linkedin.com/posts/foerstermartin_harpocrates-solutions-eu-regulatory-compliance-activity-7508577654594256897-i9fb)
- [Your NIS2 supply chain obligation is not a questionnaire. It is a contract change.](https://www.linkedin.com/posts/foerstermartin_harpocrates-solutions-eu-regulatory-compliance-activity-7507818004705980416-_bUs)
- [Your AI inventory is probably looking at the wrong thing](https://www.linkedin.com/posts/foerstermartin_harpocrates-solutions-eu-regulatory-compliance-activity-7504212710268510210-LOOh)

## Brand relationships

- **Harpocrates** (disclosed_partnership)

## Partnerships

Martin Foerster's five LinkedIn posts offer educational regulatory commentary on NIS2 supply-chain security, cloud switching under the EU Data Act, AI governance, and AI accountability. Each includes the same contact line pointing to Harpocrates and the email mf@harpocrates-corp.com. One post describes Harpocrates as helping regulated companies turn DORA, NIS2, the EU AI Act, and GDPR into audit-ready workflows. The posts show a services business, not a published creator sponsorship offer. Ask directly whether sponsorships are available and, if so, for rates, deliverables, disclosure terms, audience guarantees, and approval timelines.

## Alternatives

- Giulio Coraggio: Choose Giulio Coraggio when the campaign should reach legal, incident-response, and forensic audiences with a message about the regulatory clock during a cyber attack. Two posts connect live events and threat research to reporting duties: the KillSec ransomware takedown, where misconfigured cloud storage and known vulnerabilities gave attackers access, and Google Threat Intelligence finding that half of AI-discovered vulnerabilities enabled remote code execution. Both turn that into the same practical question — when did we know, what was accessible in which jurisdictions, and what do we report under GDPR, NIS2, DORA, or CRA. That suits a crisis-response or notification campaign better than Foerster's program-design angle.
- Michael Taylor: Choose Michael Taylor when the campaign targets procurement, finance, or healthcare supply-chain teams and the value proposition is recovering money from contracts already signed. The posts lay out a contract-compliance operating model — centralize the repository, extract and track obligations, standardize clauses, monitor performance, keep an audit trail, and name an owner — then show a contract-audit case with numbers: 900+ supplier agreements, 50%+ of suppliers paid earlier than required, terms 30+ days shorter than peer benchmarks, and $22M in working capital unlocked. That is closer to a contract-analytics or compliance-audit offer than Foerster's regulatory commentary.
- Eduard Meelhuysen: Choose Eduard Meelhuysen when the campaign needs to reach companies that have not yet checked whether NIS2 covers them. The posts address that awareness gap — the "we're probably not affected" sentence — and give the scope thresholds (50+ employees or €10M+ turnover or balance sheet total, extended to critical suppliers and service providers) plus a free self-assessment. That fits a lead-generation or scope-check offer better than Foerster's posts, which start with organizations already working the rules.

---
AI-assisted summary of public posts. Audience demographics are not available. Engagement appears only where we checked recent posts. Method: https://b2binfluencer.marketing/methodology/