Martin Foerster shares practical guidance on EU regulation and governance for businesses, including NIS2 supply-chain security, cloud-provider switching under the Data Act, and AI risk and accountability. The posts focus on turning requirements into concrete steps such as contract changes, decision inventories, and clear ownership.
AI risk comes from the decision a system influences, not the tool.
Production AI needs named owners, not an AI team.
Check first: Confirm they accept sponsored work, formats, rates, comparable results, and audience sector data.
Main ideas
A rule is not in force in your organisation until a contract says so · AI risk comes from the decision a system influences, not the tool on the procurement list · Production AI needs named owners, not an AI team
Martin Foerster is known for practical guidance on EU regulation and governance for businesses.
Their LinkedIn posts explain how rules connect to operational decisions, from cloud-exit contract terms under the EU Data Act to supplier security under NIS2 and accountability for AI systems.
The posts also describe Harpocrates as helping regulated companies turn DORA, NIS2, the EU AI Act and GDPR into audit-ready processes.
Readers interested in making compliance requirements concrete can follow their work for examples and actionable questions.
Foerster connects regulatory requirements to the decisions and controls organizations must put in place.
Rather than stopping at a list of tools or a general compliance reminder, they give readers practical next steps: inventory the decisions AI affects, assign business, technical and risk owners before an AI system enters production, or negotiate specific supplier-security terms into contracts.
Their cloud-exit post adds an important qualification: a legal right to switch providers does not remove the engineering work needed to leave.
This combination of concrete actions and operational limits makes the posts useful to compliance, legal, procurement and governance readers.
Martin Foerster’s posts argue that EU rules become real only when they change something inside an organisation: a contract clause, a decision register or a named owner.
Read more
The recurring test is whether a requirement survives a personnel change, supplier update or incident—not whether the team can describe the regulation.
A related point: a new legal right does not mean a risk is handled.
The Data Act made cloud exit a right without making it easy, and phasing out a fee does not remove months of engineering work.
A rule is not in force in your organisation until a contract says so
Foerster focuses on contracts and renewal timing, where EU compliance work happens—not on questionnaires and policy statements.
Read more
A vendor questionnaire records only what a supplier claimed at one point in time.
NIS2 Article 21(2)(d), they argue, calls for security requirements in the contract, a supplier duty to notify you of an incident affecting your service, defined rights over documentation, testing and subcontractor changes, and an internal response path for a supplier report at 23:00.
The same test applies to the EU Data Act: existing cloud contracts may still contain egress fee schedules, vague assistance obligations and no defined transition period.
Those clauses do not become valid just because both parties signed them.
Foerster’s priority is to rank suppliers by the function they support, not contract value; fix the top tier at the next renewal; and document a risk position and date for the rest.
Renegotiation is slow, and starting when the audit is scheduled means presenting a plan rather than a contract.
The NIS2 post ends with a specific contract test: for your most critical supplier, does the contract require incident notification, and within how many hours?
AI risk comes from the decision a system influences, not the tool on the procurement list
Foerster argues that listing AI tools is not enough.
Read more
The useful question is which decisions those systems influence: a vendor name does not tell you whether a system drafts a summary, ranks job candidates, recommends a credit outcome, handles a customer complaint or triggers an operational action, each with a different risk profile.
For a useful AI inventory, they recommend recording the business decision or process affected; whether the system drafts, recommends, ranks, predicts or acts; the level of human review; the data involved; the accountable owner; the risk classification and review date; and what changes trigger reassessment.
AI Act obligations and most compliance expectations depend on context: risk follows intended use and consequence, not a model name.
Build the decision inventory first, they advise, and put the tool inventory underneath it.
The closing question asks whether a team’s list of AI-supported decisions would differ from its list of AI tools—the gap Foerster says most inventories leave open.
The argument appears in two nearly identical posts, presenting it as a settled position.
Foerster says the hardest point in an AI project is the handover to production, not the prototype.
Read more
The common failure, they argue, is distributed responsibility: the innovation team builds the system, operations uses it, security checks access, legal owns the policy, procurement manages the supplier, and no one owns the overall operating risk.
That is where responsible AI becomes a document rather than a practice.
Before a use case scales, three roles need to be explicit: a business owner accountable for the outcome and permitted use; a technical owner accountable for the system and change management; and a risk or control owner accountable for assessments, reviews and records.
One person can fill multiple roles, but the AI team is not an owner.
A pilot can rely on attention and manual checks in a way production cannot.
Foerster’s scenario is an AI pilot moving into production: who formally accepts the risk? In their view, the answer must be a named operating model that survives team changes, supplier updates and real incidents.
A new legal right does not mean the risk has been handled
Foerster separates the legal change from the operational one.
Read more
The Data Act gives customers of data processing services the right to switch providers, with a defined maximum notice period, a transition window, and an obligation on the provider to support the move and return data in a structured, commonly used format.
Switching charges are being phased out; from 12 January 2027, providers may no longer charge them.
Foerster links this directly to DORA: an exit strategy for a critical or important function now has statutory support, weakening the argument that leaving is commercially unfeasible.
But their conclusion cuts against the obvious compliance-marketing reading: exit is now a right, not an easy process, and removing a fee does not remove the six months of engineering work behind it.
Foerster says they would not let anyone report the risk as mitigated just because a regulation strengthens the customer’s position.
Explaining regulation by making readers test their own setup
The posts follow a consistent teaching pattern.
Read more
Each opens by challenging an assumption: for example, that the NIS2 supply-chain obligation is about a contract change, not a questionnaire, or that an AI inventory may be focused on the wrong thing.
Next come a specific regulatory or report hook, a short checklist or sequencing recommendation, and a closing question about the reader’s own organisation.
The question tests whether a practice already exists; a description of the rule cannot do that.
The posts name regulatory hooks including NIS2, the German BSIG, the Data Act, DORA, the EU AI Act and GDPR, alongside cited reports and internal benchmark material.
Representative closing questions ask whether you have reviewed your cloud contracts against the switching provisions or are waiting for the provider to propose an amendment, and whether a critical supplier’s contract requires incident reporting—and within how many hours.
Explains what breaks when an AI project moves from pilot to production, and why newcomers should start with operating ownership rather than model choice.
Read more
Martin Foerster argues that the hardest point in an AI project is not the prototype but the handover to production.
The post identifies a common gap: the innovation team builds, operations uses, security checks access, legal owns policy, and procurement manages the supplier, but no one owns the overall operating risk.
Three roles need to be explicit before scaling: a business owner accountable for the outcome and permitted use, a technical owner accountable for the system and change management, and a risk or control owner accountable for assessments, reviews, and evidence.
One person can wear multiple hats, but the AI team is not an owner.
A pilot can rely on attention and manual checks; production needs an operating model that survives team changes, supplier updates, and real incidents.
The post asks who formally accepts the risk when a pilot moves to production.
For brands planning a campaign
Useful for a collaboration on AI governance ownership or go-live readiness. It supports content that gives regulated clients a handover checklist and a named-accountability model rather than a general responsible-AI statement.
Explains what the EU Data Act changes for cloud contracts and exit planning, making it a practical starting point for procurement, legal, and compliance readers.
Read more
The post explains that Regulation (EU) 2023/2854 has applied since 12 September 2025 and gives customers of data processing services the right to switch providers, with a defined maximum notice period, a transition window, and provider obligations to support the move and return data in a structured, commonly used format.
Switching charges are being phased out: from 12 January 2027, providers may no longer charge them.
Foerster says existing cloud contracts probably still contain terms that conflict with the regulation, such as egress fee schedules, vague assistance obligations, or no defined transition period—and those clauses do not become valid because both parties signed them.
The post connects the change to DORA: exit strategies for critical or important functions now have statutory support, weakening the excuse that leaving is commercially unfeasible.
Their take: the Data Act made exit a right but did not make it easy; removing a fee does not remove six months of engineering work.
The post asks whether readers have reviewed cloud contracts against the switching provisions or are waiting for the provider to propose an amendment.
For brands planning a campaign
A strong hook for legal or compliance advisory content on cloud exit readiness. Preserve the nuance that regulation is not the same as mitigated risk; build a contract-review checklist or DORA exit-strategy workshop around that point.
Explains what NIS2 supply-chain security demands beyond an annual vendor questionnaire, making it useful for readers who need to move vendor risk from survey responses into contracts.
Read more
Foerster points to Article 21(2)(d), which requires essential and important entities to take measures on supply chain security, including security-related aspects of relationships with direct suppliers and service providers.
Most programmes rely on an annual vendor questionnaire, but that only records what a supplier claimed earlier.
The obligation pushes toward security requirements written into the contract, a supplier notification duty when an incident affects the service, defined rights on evidence, testing, and subcontractor changes, and a response path for when a supplier reports something at 23:00.
For existing suppliers, none of this happens without renegotiation, which is slow.
The practical sequence is to rank suppliers by the function they support rather than contract value, address the top tier at the next renewal, and document a risk position with a date for the rest.
Management liability under the German BSIG sits with the board.
Foerster says a signed contract is the only supply chain control that survives a personnel change on either side.
The post asks whether a critical supplier's contract requires them to report an incident, and within how many hours.
For brands planning a campaign
Supports contract-focused NIS2 content and expert positioning on supplier tiering, renewal timing, and legal-procurement collaboration. Avoid generic questionnaire framing; show how to turn the obligation into clauses and response paths.
Explains what an AI inventory should capture when risk classification depends on use and consequence rather than vendor names, making it a good starting point for governance teams building registers.
Read more
Foerster argues that most companies can list the AI tools they use, but that is not the inventory that matters.
The key question is which decisions those systems influence.
A vendor name does not show whether a system drafts a summary, ranks job candidates, recommends a credit outcome, handles a customer complaint, or triggers an operational action; each has a different risk profile.
A useful AI inventory captures the business decision or process affected, whether the system drafts, recommends, ranks, predicts, or acts, the level of human review, the data involved, the accountable owner, the risk classification and review date, and what changes trigger reassessment.
Foerster says AI Act obligations and most compliance expectations are contextual: risk comes from intended use and consequence, not from a model name on a procurement list.
The practical advice is to build a decision inventory first, with the tool inventory underneath.
The post asks whether a team's list of AI-supported decisions would differ from its list of AI tools.
For brands planning a campaign
Useful for AI Act readiness content that moves from tool lists to decision inventories. A campaign could offer an inventory template or workshop mapping affected decisions to obligations, owners, and review triggers.
Question-led regulatory education with practical sequencing4
EU regulation translated into operating requirements3
Contracts and renegotiation as the real supply-chain control2
AI governance starts with a decision inventory, not a tool inventory2
Accountability at the pilot-to-production handover1
EU regulation translated into operating requirements
Martin Foerster’s recurring subject is the practical gap between EU rules and companies’ day-to-day controls.
Read more
Posts cover the Data Act’s cloud-switching provisions, NIS2 supply-chain security, and AI governance under the AI Act, DORA and GDPR. The argument is consistent: legal text alone does not change procurement, contracts, ownership or audit evidence.
For brands planning a campaign
A RegTech or compliance advisory brand can create a content collaboration on mapping regulations to workflows, showing clients how a specific rule changes a contract clause, owner or evidence trail.
Contracts and renegotiation as the real supply-chain control
In the NIS2 post, Martin Foerster says a vendor questionnaire only records what a supplier claimed at one point in time, while Art.
Read more
21(2)(d) pushes toward security terms, incident notification duties, evidence rights and subcontractor controls written into contracts. The Data Act post applies similar logic to cloud exit clauses: existing contracts may still contain egress fees, vague assistance terms and no defined transition period that conflict with the regulation.
Rank suppliers by the function they support rather than contract value, fix the top tier at renewal, and document a dated risk position for the rest.
For brands planning a campaign
A brand can position Martin Foerster around contract-renegotiation content for compliance, legal and procurement teams, especially clients facing NIS2 or cloud-provider switching deadlines.
AI governance starts with a decision inventory, not a tool inventory
Martin Foerster argues that listing AI tools is not a useful inventory.
Read more
The useful questions are which decisions those systems influence, whether they draft, recommend, rank, predict or act, and what human review and accountable owner are in place. Risk comes from intended use and consequence, not from a model name on a procurement list.
Capture the affected business decision, system role, level of human review, data involved, accountable owner, risk classification and review date, along with triggers for reassessment.
One AI-inventory post restates the same argument as another; treat them as one recurring position, not two separate topics.
For brands planning a campaign
An AI-governance vendor or advisory brand can collaborate on decision-first inventory templates, workshops or explainers that move buyers away from tool-counting exercises.
Accountability at the pilot-to-production handover
The responsible-AI post identifies the handover from prototype to production as the hardest point.
Read more
Martin Foerster says a pilot can survive on attention and manual checks, but production needs an operating model: a business owner accountable for outcomes and permitted use, a technical owner accountable for the system and change management, and a risk or control owner accountable for assessments, reviews and evidence. One person can wear multiple hats, but the AI team is not an owner.
For brands planning a campaign
A brand can use this theme for executive-facing content on AI operating models, risk acceptance and who formally owns production AI risk after a pilot scales.
Question-led regulatory education with practical sequencing
The posts repeatedly open by challenging a common assumption, then contrast weak practice with a stronger operating choice.
Read more
They use short checklists and sequencing advice, cite specific regulations or reports, and close with a diagnostic question about the reader’s organisation. Examples include asking whether cloud contracts have been reviewed against switching provisions, whether a critical supplier must report an incident and within how many hours, and whether a list of AI-supported decisions would differ from a list of AI tools.
Use a blunt reframe, a concrete regulatory hook, a short operational checklist and a closing question that tests the reader’s current practice.
For brands planning a campaign
A brand can sponsor or co-create question-led explainers and self-assessment prompts to generate qualified conversations with compliance and risk teams.
The posts document one commercial relationship: Harpocrates.
Read more
Martin Foerster promotes the company's regulatory-compliance support, links to its site, and cites Harpocrates COMPLY internal benchmarks. One post says 'At Harpocrates we help...' The posts describe the relationship as a partnership but do not state the exact role; ask whether it is employment, ownership, or another affiliation.
Harpocrates
Disclosed partnership
Martin Foerster's posts promote Harpocrates's regulatory-compliance services, link to www.harpocrates-corp.com, and cite 'Harpocrates COMPLY internal benchmarks.' One post says 'At Harpocrates we help regulated companies turn DORA, NIS2, the EU AI Act and GDPR into audit-ready workflows.' The exact role is unstated; ask whether the association is employment, ownership, or another affiliation.
Martin Foerster is worth exploring if you follow the gap between an EU rule on paper and what changes inside a company.
Read more
Their posts return to a few operating questions: does a contract clause require a supplier to report an incident, who formally accepts AI risk when a pilot goes into production, and does an AI inventory track decisions rather than tools?
Start with the NIS2 post on supply-chain contracts, then the Data Act post on cloud exit, followed by the AI-governance and responsible-AI posts.
The pattern is consistent: a blunt reframe, a concrete legal or report hook, a short checklist and a closing question that asks readers to test their own setup.
Similar creators to consider are Giulio Coraggio for cyber-incident legal exposure, Michael Taylor for contract compliance and audit operations, and Eduard Meelhuysen for NIS2 scoping and readiness.
Writes about NIS2, cybersecurity incidents and the legal questions that follow an attack.
Read more
Coraggio also connects technical findings to regulatory timelines and reporting duties, overlapping with their habit of turning EU rules into practical tests.
Coraggio's posts centre on ransomware investigations, cloud exposure and incident-response timelines after a breach. They focus more often on prevention and governance design: contract clauses, AI decision inventories and named owners before things go wrong.
Posts about contract compliance as an operating discipline: central repositories, obligation tracking, audit trails, named ownership and AI-assisted review.
Read more
The subject matter aligns with the argument that a rule only becomes real when a contract or process carries it.
Taylor's work centres on contract-management technology and recovery audits, with examples from procurement, finance and healthcare. Their work focuses on EU regulation and the governance gap between legal text and daily controls.
Focuses on NIS2 scope, awareness, penalties and readiness.
Read more
Like them, Meelhuysen tries to move readers past the assumption that a rule does not apply to them and toward a concrete check of their own position.
Meelhuysen's posts emphasise scoping, fines and self-assessment prompts as a first step. They go deeper into how a requirement changes contracts, ownership, evidence and production operating models once the rule clearly applies.
The audience picture points to a focused LinkedIn placement, not a reach-led campaign.
Read more
Martin Foerster's profile showed 3,811 followers as of 8 October 2026 — a workable base for expert-positioning content aimed at compliance, risk and governance readers, not a mass audience.
The five posts, published 11–23 September 2026, focus on regulated enterprises: NIS2 supply-chain obligations written into contracts, cloud switching and exit rights under the EU Data Act, AI decision inventories, and who formally accepts AI operating risk.
They address people who must make or defend compliance decisions — legal, procurement, security and risk roles — rather than a general business readership.
The follower count is platform-reported, and the posts show topic focus; neither establishes who follows the account.
The profile includes no breakdown by geography, age, gender, job seniority, employer or sector.
Before committing budget, ask for audience survey results or another documented source covering employer, occupation, seniority and sector.
Without that evidence, claims that the following is composed mainly of EU financial-sector compliance officers would be unsupported.
Request recent post-level results for the three closest comparable pieces — the Data Act cloud-exit post, the NIS2 supply-chain post and the AI inventory post — including dates, impressions, reactions and comments, plus follower growth over the same window.
Project delivery from comparable topic, depth and format rather than follower totals, and include the quality of the response in your evaluation.
If the campaign needs video or multi-channel reach, ask for video performance, subscriber and viewing data; none appears in the posts here, so the published information cannot support a format or channel comparison.
LinkedIn followers
3,811
LinkedIn profile (@foerstermartin), public follower count · 2026-10-08
Martin Foerster's five LinkedIn posts offer educational regulatory commentary on NIS2 supply-chain security, cloud switching under the EU Data Act, AI governance, and AI accountability.
Read more
Each includes the same contact line pointing to Harpocrates and the email mf@harpocrates-corp.com.
One post describes Harpocrates as helping regulated companies turn DORA, NIS2, the EU AI Act, and GDPR into audit-ready workflows.
The posts show a services business, not a published creator sponsorship offer.
Ask directly whether sponsorships are available and, if so, for rates, deliverables, disclosure terms, audience guarantees, and approval timelines.
Strong subject-matter fit for a proposed educational collaboration, subject to confirming that Martin Foerster accepts this kind of work. Their posts turn regulatory issues into concrete operating questions: whether cloud contracts define exit support, whether critical suppliers must report incidents and when, and which business decisions AI systems influence. That is a closer match for compliance, legal, procurement, security, and risk readers than a broad brand-awareness campaign. The examples support an expert-positioning angle, but their posts do not specify sponsorship formats, rates, or campaign terms. Confirm those directly before planning a paid placement.
Read more
Brief
A RegTech or compliance advisory company wants to reach B2B regulated clients with practical content on the EU Data Act, NIS2, and AI governance.
Recommended approach
Use a practical explainer or workshop resource that links a specific rule to a contract term, accountable owner, or evidence requirement. Keep the audience focused on regulated B2B organizations; ask for audience-role and sector data rather than inferring them from post topics.
When to choose a specialist
Poor fit for a campaign seeking consumer product promotion. The posts are text-led regulatory commentary for professional readers, not consumer product promotion. The LinkedIn follower count is 3,811, with no impression, engagement, video-performance, or demographic data. Sponsorship formats, rates, and audience guarantees are not documented.
Read more
Brief
A consumer technology company wants a mass-reach product launch with guaranteed impressions, lifestyle video, and a documented sponsored-post package.
Next step
If the company still wants to explore a professional-facing angle, first ask whether Martin Foerster offers sponsored or co-created content, what formats are available, and for recent comparable-post results. Do not promise reach or video delivery until those details are confirmed.
A worked campaign example
Angle
From AI tool list to decision register: what changes when an AI system affects a real business decision?
Execution
Create a short educational post or companion checklist for compliance and risk teams. Open with the distinction Martin Foerster makes in their AI-inventory posts: a list of vendors does not show whether a system drafts, ranks, recommends, predicts, or acts. Then walk through one hypothetical use case, such as an AI system that ranks job candidates. Ask the reader to record the affected decision, system role, human review, data involved, accountable owner, risk classification and review date, and reassessment triggers. Close by asking whether the organization's decision inventory differs from its AI tool list. Label the use case as an illustration, not as a finding about any particular company's compliance status.
Fit reason
This angle follows the decision-first method in Martin Foerster's posts and gives a compliance advisory brand a useful educational contribution without claiming that a tool or organization meets legal requirements. Confirm the collaboration format and commercial terms directly before commissioning.
Choose Giulio Coraggio when the campaign should reach legal, incident-response, and forensic audiences with a message about the regulatory clock during a cyber attack.
Read more
Two posts connect live events and threat research to reporting duties: the KillSec ransomware takedown, where misconfigured cloud storage and known vulnerabilities gave attackers access, and Google Threat Intelligence finding that half of AI-discovered vulnerabilities enabled remote code execution.
Both turn that into the same practical question — when did we know, what was accessible in which jurisdictions, and what do we report under GDPR, NIS2, DORA, or CRA.
That suits a crisis-response or notification campaign better than Foerster's program-design angle.
The focus is incident and breach law, not standing compliance operations.
There is little on the EU Data Act and cloud-switching rights, and nothing on designing an AI decision inventory.
A campaign centered on those themes would need a second contributor; otherwise, it would stretch these posts beyond what they show.
Choose Michael Taylor when the campaign targets procurement, finance, or healthcare supply-chain teams and the value proposition is recovering money from contracts already signed.
Read more
The posts lay out a contract-compliance operating model — centralize the repository, extract and track obligations, standardize clauses, monitor performance, keep an audit trail, and name an owner — then show a contract-audit case with numbers: 900+ supplier agreements, 50%+ of suppliers paid earlier than required, terms 30+ days shorter than peer benchmarks, and $22M in working capital unlocked. That is closer to a contract-analytics or compliance-audit offer than Foerster's regulatory commentary.
The posts read more like vendor-led promotion: they name PRGX Contract Insights and close by explaining why to choose that provider over a tool.
Coverage of NIS2, the EU Data Act, and AI governance is thin or absent.
Buyers seeking independent expert positioning rather than product-linked content should weigh the editorial and reputational risk.
Choose Eduard Meelhuysen when the campaign needs to reach companies that have not yet checked whether NIS2 covers them.
Read more
The posts address that awareness gap — the "we're probably not affected" sentence — and give the scope thresholds (50+ employees or €10M+ turnover or balance sheet total, extended to critical suppliers and service providers) plus a free self-assessment. That fits a lead-generation or scope-check offer better than Foerster's posts, which start with organizations already working the rules.
The posts stay on NIS2 scope and fine levels, with a GDPR comparison, and repeat the same awareness message.
They do not reach contract terms, accountable owners, evidence requirements, the EU Data Act, or AI governance.
If a campaign needs depth across those areas, ask for another contributor; this comparator covers one regulation and one stage of awareness.
Martin Foerster's posts cover the EU Data Act and cloud switching, NIS2 supply-chain security, the difference between an AI tool list and a decision inventory, and who owns risk when an AI pilot moves into production.
They cite a June 2026 AI governance report, a March 2026 McKinsey report on AI trust, the Data Act applying since 12 September 2025 with switching charges withdrawn from 12 January 2027, and 2026 internal Harpocrates benchmark material.
Three possible comparators — Giulio Coraggio, Michael Taylor, and Eduard Meelhuysen — provide context for Foerster's work; their posts carry dates from March to October 2026.
Foerster's posts do not state publication dates, or establish signature books, shows, a full career history, audience demographics, or any sponsorship formats, rates, or campaign terms.
Those questions need answers before they appear in public text.