The Schellman Blog

Investment Accelerates Schellman's Growth and Strengthens the Independent, Expert-Led Model Clients Count On to Navigate an Increasingly Complex Global Compliance Landscape

Recently on a Sunday night my phone rang, showing an unknown number.

As artificial intelligence continues to rapidly evolve, from generative tools to increasingly autonomous systems, governments around the world are accelerating efforts to formalize AI governance. Regulatory frameworks are becoming enforceable on legal requirements that shape how AI systems are designed, deployed, and monitored.

The Payment Card Industry Security Standards Council has released a major revision of the PCI Secure Software Standard (PCI SSS), moving from v1.2.1 to v2.0. This isn't an incremental update but rather a fundamental restructuring that reflects how software security has evolved in today's interconnected digital landscape.

Managing scripts on payment pages has become a key focus area under PCI DSS, particularly as third-party and dynamically loaded scripts introduce new risk. As attacks targeting client-side scripts continue to increase and PCI DSS v4.x places greater emphasis on ongoing monitoring, organizations are expected to demonstrate not only visibility into payment page scripts, but also effective controls to detect unauthorized changes.

As the EU AI Act moves from legislation to implementation, organizations across Europe and beyond are working to operationalize AI governance in practical, auditable ways. Compliance and governance leaders, AI product teams, and executives are asking the same question: How can we demonstrate EU AI Act compliance in a structured and defensible way?

The Cloud Security Alliance (CSA) created the Security, Trust, Assurance, and Risk (STAR) program in August of 2011 to improve transparency and security within cloud computing. This program was built upon the Cloud Controls Matrix (CCM), a selection of cloud controls designed to secure cloud service providers and customers, and is mapped to major standards like ISO 27001.

Artificial intelligence is reshaping the cyber threat landscape as attackers have already begun weaponizing AI to dramatically accelerate phishing, reconnaissance, payload development, and attack execution.