Compliance to resilience: lessons from high-reliability industries on managing digital risk

December 2026 | SPOTLIGHT | RISK MANAGEMENT

Financier Worldwide Magazine

December 2026 Issue

In everyday corporate practice, cyber security often becomes a matter of immediate concern only after something has already happened.

A technology supplier reports a security incident. Its initial notice says that a service has been disrupted; a later update leaves open the possibility that customer data was accessed. The IT team needs technical facts. The legal team needs to know whether a personal data breach has occurred. Operations want the service restored, while customer-facing staff are already asking what they may tell clients.

Nobody is necessarily doing the wrong thing. Yet, for several critical hours, the business may struggle to establish who has the full picture and who can authorise the next steps.

This is where the distance between formal compliance and operational readiness becomes apparent. An organisation may have a detailed General Data Protection Regulation (GDPR) framework, a tested cyber security policy, signed processing agreements and a supplier register. And while those are necessary safeguards, they do not, by themselves, ensure that information will move quickly between teams, that conflicting priorities will be resolved or that an assumption made during procurement will still be valid 18 months later.

The issue is not a shortage of obligations. It is the ability to make them work together when circumstances change.

The latest European Union Agency for Cybersecurity Threat Landscape report, published in September 2026, describes a European threat environment shaped in part by increasingly interconnected digital ecosystems. Dependencies extend well beyond the supplier named in a contract. A business may rely on a cloud platform, a specialist processor, an identity service, software libraries and subcontractors it has never met. These arrangements can make a service more efficient while creating multiple points at which an incident elsewhere becomes a problem at home. Responsibility, however, does not simply travel down the chain with the data.

Data protection makes this particularly clear. Under the GDPR, accountability is not satisfied merely by being able to produce a policy or a record of processing. Controllers must implement and be able to demonstrate appropriate measures, assess risk to individuals and revisit safeguards where necessary. Confidentiality matters, but so do availability, accuracy, fair treatment and the ability of people to exercise their rights. A cyber incident may interrupt a service without involving personal data. A personal data breach may arise from an entirely mundane mistake rather than an attack. The two disciplines overlap, but neither is a substitute for the other.

European regulation has increased the pressure to address the organisational dimension. The Directive (EU) 2022/2555 (NIS 2 Directive) Network, for entities within its scope, places cyber security risk management measures under management-body oversight and expressly addresses supply chain security. The Digital Operational Resilience Act establishes a more detailed digital operational resilience regime for relevant financial entities, including information and communication technology third-party risk. The Artificial Intelligence (AI) Act adds a further set of obligations according to the role played by an organisation and the system concerned. These instruments are not interchangeable, and their respective scopes matter. What they expose is the difficulty of treating digital risk as a succession of independent files owned by different departments.

Take the introduction of an AI-supported document analysis tool. The privacy review addresses the lawful basis, data minimisation and retention. Security reviews access and infrastructure. Procurement negotiates assurances. The business checks whether the results are useful. But who revisits those conclusions after a material model update, a change in subcontractor or the discovery that staff have started using the output for a purpose that was never assessed? While the example is hypothetical, the governance gap is not. A sign-off captures a decision at a particular moment. It cannot be expected to govern every subsequent change without a mechanism for bringing the right people back to the table.

This points to a question that deserves more attention in board reporting: what new information would cause the company to change course? It could be evidence that a supplier’s recovery time is longer than promised, an unexplained increase in access requests, a failed restoration test or a pattern of AI outputs that staff repeatedly have to correct. None needs to be a headline incident before it warrants attention. Compliance has limited value if its indicators tell management only what has already been completed, rather than where control is becoming less dependable.

The contractual response is important, although contracts cannot resolve everything. Organisations should know what information they can obtain from a provider during an incident, how quickly they will receive it and whether relevant subcontractor changes must be disclosed. They also need to test their own decisions: when to isolate a system, suspend processing, notify affected parties where required or invoke a contingency arrangement. An indemnity may allocate financial consequences later. It will not restore the missing logs on the afternoon when a notification assessment must be made.

There is a useful comparison here with aviation rules. Not because a privacy incident is an aircraft accident or because aviation offers a ready-made rulebook for the digital economy. Its relevance lies in how an industry exposed to serious consequences has organised the relationship between procedures, professional judgement, reporting and continuous oversight. While a pre-flight check is essential, it is only one part of a much larger safety system. The organisation must also notice hazards that the original procedure did not anticipate and act on evidence gathered during ordinary operations.

Under the International Civil Aviation Organization’s Annex 19 framework, a safety management system connects management accountability with hazard identification, risk assessment, safety assurance and the promotion of a reporting culture. Of particular interest is the management of change. A previously acceptable arrangement cannot simply be assumed to remain acceptable after the conditions around it have altered. That principle translates readily into digital governance. A new data flow, an outsourced service, software release or an unexpected use of an AI tool should prompt a proportionate reconsideration of the underlying assessment, rather than being treated as an administrative amendment.

Aviation has also begun to connect its own safety and information security disciplines more explicitly. The European Part-IS framework requires organisations within its scope to manage information-security risks that may affect aviation safety. The European Union Aviation Safety Agency recognises that these requirements can be integrated into broader management systems. This is a relevant development: the sector is not merely providing an analogy from outside cyber security. It is confronting the practical problem of interconnected risks within its own regulatory environment.

Another lesson concerns what happens before harm occurs. Aviation has long relied on the reporting and analysis of occurrences, including events that reveal a weakness without resulting in an accident. For a digital business, the equivalent signal might be an employee who spots a misaddressed attachment before it is opened, a failed recovery exercise or a suspicious change in a third-party service. Such information may not meet a statutory notification threshold, but it can still show that an existing control is fragile. It should not disappear because there is no reportable breach to record.

That requires care in the way people are treated. Aviation’s ‘Just Culture’, reflected in EU Regulation 376/2014, seeks to encourage reporting while drawing a line at gross negligence, wilful violations and destructive conduct. In a company where reporting an error is reliably followed by blame, management may see fewer reports and mistakenly conclude that risk is falling. A fair reporting culture is no amnesty: it cannot remove GDPR duties, incident-notification obligations or responsibility for deliberate misconduct. Its purpose is to make weak signals visible early enough for someone to do something about them.

A digital adaptation of these ideas need not begin with a new committee or another sizeable manual. It could begin by connecting existing assessments to named decision makers, identifying the events that require reassessment and asking teams to rehearse one realistic supplier failure together. The data protection officer’s independence and the distinct responsibilities of security and management must be preserved. Integration means ensuring that their findings can reach a common decision, not merging their legal roles. After an incident or exercise, the organisation should check whether the corrective measure worked, rather than closing the matter when an action has been assigned.

The comparison has limits. Cyber attackers adapt intentionally, privacy protects fundamental rights, the consequences of an AI output cannot always be measured like an operational failure. Specialist controls and sector-specific legal analysis remain indispensable. The value of the aviation perspective is more modest, and perhaps more practical, as it helps shift attention from possession of compliance evidence to confidence in the system that produces and uses it. A mature organisation should be able to explain not only why a control was chosen, but how it knows when that control needs to change.

For boards and advisers, this is a different conversation from asking whether the latest policy has been approved. It asks what the organisation has learned from a near miss, who has the authority to challenge a launch decision, and whether the unexpected failure of a critical supplier would expose a question nobody had thought to answer.

The documents still matter. So does the discipline to discover, before the next crisis, where they stop being enough.

There is an old saying, often heard in aviation, that captures this philosophy rather well: “If you think safety is expensive, try an accident.” The same principle applies to privacy and cyber security: investing in effective compliance may come at a cost, but it is a cost any organisation would rather bear than face the consequences of a serious incident.

Matteo Cerretti is a partner and Felice Cuzzilla is counsel at DWF. Mr Cerretti can be contacted on +39 02 3031 7999 or by email: matteo.cerretti@dwf.law. Mr Cuzzilla can be contacted on +39 02 3031 7999 or by email: felice.cuzzilla@dwf.law.

Matteo Cerretti and Felice Cuzzilla

DWF