The European Commission has proposed new legislation aimed at strengthening Europe’s industrial base while accelerating the shift toward low-carbon manufacturing. But beyond its economic ambitions, the proposal could introduce a new set of governance and compliance considerations for companies operating across strategic industrial sectors.
In June 2025, procurement vendor Chain IQ Group AG was hit by a sophisticated cyberattack. Hackers accessed data from Chain IQ and at least 19 of its clients, uploading files to the dark web shortly afterward, exposing over 130,000 employee records from firms including UBS and Pictet. None of those firms had hired the attackers’ actual entry point. They had hired Chain IQ.
The numbers came quickly. On February 20, 2026, Anthropic introduced Claude Code Security. Within hours, JFrog dropped nearly 25%. CrowdStrike and Cloudflare each fell about 8%. Losses extended to GitLab, Palo Alto Networks, and Zscaler. It was the second time in a month that a single AI announcement had rattled the entire cybersecurity industry.
Third-party risk rarely announces itself with alarms. More often, it arrives quietly, disguised as an assumption. The assumption is that responsibility can be shared without consequence. That accountability can be distributed, diluted, and still hold its shape when pressure arrives. That contracts, frameworks, and carefully worded clauses will stand in for human judgment when systems fail and decisions cannot wait.
As banks lean ever more heavily on cloud providers, fintech partners, data vendors, and other external service firms, global regulators are making it clear that third-party risk can no longer be treated as a side issue. Against that backdrop, the Basel Committee on Banking Supervision has published a new set of principles aimed at reshaping how banks manage third-party risk in an increasingly digital financial system.
In my earlier piece, Governing the Extended Enterprise: The TPRM Platform I Would Demand, I laid out what a future-proof third-party governance platform must look like. But if the architecture is the “what,” organizations are now asking about the “how.” How do we take those principles and turn them into capability, authority, and action? Technology alone won’t get us there. Governance needs orchestration.
The European Parliament has backed more breathing room for companies facing the EU Deforestation Regulation (EUDR), voting to push key compliance dates into 2026 and 2027 while simplifying due diligence rules. The goal is to give organizations time to adapt, but the politics around deforestation-free supply chains are now more contentious than ever, and certainty remains elusive.