Compliance - Digital tools and personal support

Whistleblowing cases vary greatly, and how they should be investigated can be influenced by many factors. External assistance with investigations can become relevant due to various reasons, such as the need for specialist expertise, clearer independence, or to be able to point to an external party when making decisions. In an interview with Joakim Karlén, we discuss how to approach investigative work and engaging external support. Handling an incoming whistleblowing report involves balancing legal protection, good management culture, and personal integrity. The primary purpose of the investigation is to establish the facts: to either confirm or dismiss the allegations made, and to provide the organization with a well-founded basis for decision-making regarding further actions. To ensure high quality in the investigation, methodology, confidentiality, and above all, independence are required. ## The Core of Investigative Work: Independence and Confidentiality Independence is the single most important factor in a whistleblowing investigation. The person conducting the review must be completely neutral in relation to the operations and individuals involved. Furthermore, the process demands strict confidentiality. The investigation must not disclose the whistleblower’s identity, nor should it subject the person under investigation to an unfair or incompetent process. For this reason, most investigations begin with a thorough review of written documentation and factual circumstances before any interviews are conducted. ## When Are Internal Resources Insufficient? Many organizations have competent internal teams that manage cases effectively. However, there are three clear situations where an external party should be involved: **Conflicts of interest and personal ties: **If the report concerns a person in a senior position, or someone close to the internal investigative team, a conflict of interest arises. It is unrealistic to expect complete independence from employees who will continue working together after the investigation is concluded. **Need for specialist expertise: **Some cases are legally complex or require specific expertise in work environment issues and HR. Smaller municipalities or companies lacking in-house legal counsel often need external expertise to ensure the investigation report holds up legally. Need for a confirmed impartial voice: Sometimes the required knowledge exists internally, but the organization needs an entirely independent statement to rely on. This provides management with a secure and objective foundation for difficult decisions. ## Psychological Benefits and Signal Value An external investigator enters the situation without history within the organization. This often reduces the defensiveness that can arise when employees are examined by their own colleagues. The interview setting becomes less tense, which facilitates the collection of facts. Finally, one should be mindful of the signal value in working with external, independent investigators. By establishing clear principles for when external investigators are engaged, the organization demonstrates—to both employees and the outside world—that misconduct is taken with the utmost seriousness and that complex investigations are not avoided.

In an interview with Joakim Karlén, we discuss new requirements for AI-generated material, primarily various types of labeling. The discussion stems from the new regulations that recently came into force as a result of the AI Act. ## New Requirements The EU AI Act and its new transparency requirements place higher demands on how AI-generated material must be handled and labeled. For many organizations, the new rules raise questions regarding what responsibility actually lies with them—whether as a developer, employer, or individual publisher. The transparency rules in the EU AI Act have now entered into force, two years after the legislation's original adoption. This means that all organizations that develop or deploy AI systems need to comply with clear requirements for labeling and traceability. ## Types of Labeling Labeling of AI-generated content can broadly be divided into two categories: Overt labeling: Clearly visible information for the viewer, such as a watermark on an image stating "AI-generated" or plain text in a document's metadata. Technical (invisible) labeling: Mathematical or statistical shifts in the material, such as SynthID. It is not visible to the human eye at first glance, but can be identified by digital detection tools. ## Who Bears the Responsibility? It is important to distinguish where the responsibility lies in the chain. Creators of AI models (such as OpenAI, Anthropic, and Google) are required to build traceability and labeling directly into the technology. For companies that purchase or deploy these tools for their employees, the same general requirements for automatic labeling do not apply—with important exceptions. When publishing deceptive material, such as deepfakes or completely unmoderated texts, an obligation arises to inform the recipient. If, on the other hand, text or images have been reviewed, edited, or processed by a human prior to publication, an explicit warning is generally not required. As AI tools become a natural part of daily work—much like earlier technologies such as spell check—the need for major adjustments diminishes. The key for companies is to establish clear internal principles for communication and transparency. By proactively clarifying how AI is used in the organization, ambiguities are avoided and trust among customers and the public is maintained.

The new Cybersecurity Act (based on EU legislation) has become a hot topic of conversation in the business world. The main purpose of the law is clear: to raise cybersecurity and incident readiness across society, while giving corporate management clearer ownership of security issues. The focus lies on socially critical operations, such as government agencies, municipalities, energy companies, and food supply. So why is a law specifically targeting critical societal functions being discussed so broadly? The answer is the supply chain. ### Requirements Inherited Down the Line The legislation includes a strict requirement for covered organizations to ensure that their entire supply chain is secure. When a government agency or an energy company procures goods and services, they must vet their suppliers. In practice, this means that regardless of whether you run a large or small company, you will face tough security questions in future procurements. The requirements are simply inherited down the line. A vulnerability in a sub-contractor several tiers down ultimately becomes a vulnerability for the socially critical organization. ### Compliance Burden or Real Benefit? It is easy to view new laws as mostly unnecessary administration. However, much of the work provides a tangible benefit, and if approached wisely, it does not have to be overly burdensome. Information security is fundamentally about structure, and once you have those structures in place, it translates into security improvements that protect your business every single day. In an era of frequent cyberattacks and phishing attempts, good "cyber hygiene" is absolutely vital for any company. ### Three Steps to Tackle the Project For smaller organizations lacking a large IT budget or a dedicated compliance department, it is all about being concrete and narrowing the scope. The work can be boiled down to three central steps: 1. Get the technology right: Start with the low-hanging fruit. Implement two-factor authentication on all systems, ensure firewalls are enabled, and perform continuous security updates. Also, train your staff regularly so they recognize threats such as phishing (fraudulent emails) and vishing (phone scams). 2. Document: Conduct a simple inventory of your assets—what software, hardware, and networks do you use? Identify the risks associated with these and establish clear policies. For example, how do you manage "Shadow IT" (when employees use private phones or computers for work)? By documenting your processes, you will have ready-made answers when clients ask questions during a procurement. 3. Follow up: Cybersecurity is a moving target. At regular intervals, you must evaluate whether your routines align with reality, perform new risk assessments when purchasing new technology, and stay updated on emerging threats. ### Do You Need ISO 27001 Certification? Larger organizations often run heavy projects to get certified according to ISO 27001. For a smaller company—perhaps around 50 employees with a less complex operation—a formal certification is rarely necessary, unless explicitly required by your clients. It is far more important that you actually do the right things and have them documented in a well-functioning information security management system that mirrors the structure of ISO 27001, rather than having the actual certificate on the wall. Here at Lantero, we have developed ready-made, easy-to-understand templates and pre-filled examples to help you inventory your resources, conduct risk assessments, and establish the right structure from the start—without making the process heavier than it needs to be.