Home • Blog • Cybersecurity After a Data Breach. Why Backup Alone Is Not Enough

Cybersecurity After a Data Breach. Why Backup Alone Is Not Enough

Cybersecurity

8 September 2026

Table of contents

In August 2026, the President of Poland’s Personal Data Protection Office announced an inspection of the technical and organizational measures applied by MyDr following reports of an incident involving patient data. The authority emphasized that the exact scale of the event was not yet fully known and that the company’s risk analysis would also be examined. This qualification matters: while proceedings are ongoing, the cause of the incident and the responsibility of individual parties should not be assumed.

This was not the first serious warning for the Polish market. In November 2023, Poland’s Personal Data Protection Office reported a ransomware attack accompanied by a data breach at ALAB Laboratoria. The incidents differ in method and circumstances, but they point to the same conclusion: data security cannot depend on a single product or procedure.

Many companies still treat backup as their main response to cyber threats. A well-designed backup can save an organization after data has been encrypted, deleted or corrupted. It cannot reverse a breach, take stolen information away from an attacker, or replace access controls, encryption, monitoring and a prepared incident response plan.

1. A data breach and data loss are different risks

A data breach means that an unauthorized person has obtained, or may have obtained, access to information. Data loss concerns information that has become unavailable, deleted, encrypted or corrupted. A single attack can cause both outcomes: criminals may copy data first, then encrypt systems and demand payment for restoring access or withholding publication.

Backup primarily addresses availability and recovery. If backups are current, isolated and usable, the company can rebuild systems without relying on an attacker’s promises. A backup cannot restore the confidentiality of information that has already left the organization. Legal obligations, fraud risk, incident-handling costs and loss of customer trust remain after the breach.

1.1 Double extortion changes the role of backup

In a traditional ransomware scenario, the attacker encrypted data and demanded payment for a decryption key. Increasingly, attackers copy information first and then threaten to publish or sell it. This model, known as double extortion, means that restoring systems does not end the crisis. The company may resume operations, but it still needs to determine the scope of the breach, assess the risk to individuals and business partners, and communicate in line with its legal obligations.

In practice, organizations therefore need two parallel plans. The first covers system recovery and business continuity. The second addresses the confidentiality breach: preserving logs, identifying the data that was taken, preventing further access and deciding which notifications are required. Backup is essential to the first plan, but it does not replace the second.

This distinction also matters under the GDPR. Article 32 of the GDPR refers, among other things, to the ability to restore the availability of personal data promptly and to regularly test the effectiveness of security measures. It also requires organizations to protect confidentiality and integrity, which calls for a broader set of safeguards than backup alone.

A data breach and data loss are different risks

2. Lessons from major data breaches for businesses in Poland

The first lesson concerns the value of data. Medical records, customer data, financial information, employee data and intellectual property can be used for extortion, identity theft, phishing or further attacks. An organization should know where such information is stored, who can access it and how quickly unusual downloads will be detected.

The second lesson concerns dependence on suppliers. Business data is often processed in SaaS systems, cloud environments, data centers and applications maintained by third parties. Outsourcing technical operations does not remove the customer’s risk. Organizations need contractual requirements, periodic security assessments, agreed incident-reporting rules and confidence that data can also be recovered after an outage or the end of the supplier relationship.

The third lesson concerns governance. Security does not begin when an attack occurs. The organization should define recovery priorities, decision-making roles, communication channels and acceptable downtime in advance. For entities covered by national laws implementing NIS2, the Directive’s business continuity measures include backup management, disaster recovery and crisis management.

3. When backup genuinely protects the business

Backup delivers the greatest value when primary data or systems become unavailable. This may result from ransomware, infrastructure failure, administrator error, a faulty update, accidental deletion by an employee or damage to a cloud environment. Backup can then reduce downtime, restore services and limit irreversible information loss.

The entire process must be covered, not merely one folder. Resuming operations may require databases, configurations, keys, application code, documentation, integrations, system images and information about the correct service startup sequence. A copy of the data may be insufficient if the organization does not know how to restore its dependencies.

4. How backup replication archiving and disaster recovery differ

These terms are sometimes used interchangeably even though they address different needs. Backup creates recovery points from which an earlier version of data can be restored. Replication maintains a second, near-current copy of an environment, but it may immediately reproduce a deleted file, an incorrect change or encryption. Archiving supports long-term information retention rather than the rapid restoration of an entire process.

Disaster recovery includes the technology and procedures required to restore services after a serious event. It defines the system startup sequence, dependencies, replacement resources, team responsibilities and the method for confirming that the process works correctly. A company can therefore hold many file copies without having a viable plan for restoring operations.

A mature strategy combines these mechanisms. Replication can reduce downtime after an infrastructure failure, backup enables recovery to a point before an attack, archiving supports retention, and disaster recovery organizes how all these resources are used during a crisis.

4.1 Define RPO and RTO in business terms

The recovery point objective, or RPO, defines the maximum amount of recently recorded data the organization can afford to lose. The recovery time objective, or RTO, specifies how long a process may remain unavailable. These values should not be determined solely by technical capabilities. They must reflect business consequences such as halted production, interrupted customer service, delayed settlements, missed deadlines or risks to human safety.

4.2 Example of a sales system and a monthly archive

If a system accepts orders around the clock, losing the most recent 24 hours of data may require hundreds of transactions to be reconstructed manually. Such a process may need an RPO measured in minutes and an RTO measured in hours. Much higher values may be acceptable for a closed archive of documents from the previous year. Applying one backup policy to both resources leads either to excessive cost or inadequate protection.

How backup replication archiving and disaster recovery differ

5. Why backup alone cannot stop a data breach

Backup is a recovery mechanism, not a complete information-protection system. Even a perfectly restored database remains compromised if the attacker copied its contents beforehand. Backups must therefore form part of an architecture that covers prevention, detection, response and operational recovery.

Access controls and the principle of least privilege limit the number of people and accounts able to download data.
MFA, segmentation and separate administrative accounts make it harder to compromise an entire environment with one set of credentials.
Encryption protects data at rest and in transit when the keys are managed separately and securely.
DLP, information classification and monitoring help detect unusual transfers or bulk file downloads.
EDR, malware protection and vulnerability management reduce the likelihood that an attacker can maintain access.
An incident response plan defines who isolates systems, preserves evidence, assesses risk and initiates crisis communications.

Why backup alone cannot stop a data breach

6. How to build resilient backups with the 3-2-1-1-0 rule

The 3-2-1 rule is a useful starting point: three copies of the data, two different media types or environments, and one copy outside the primary location. For ransomware resilience, it can be extended to the 3-2-1-1-0 model. The additional one represents an offline or immutable copy, while zero means no errors detected during recovery testing.

Identify the data, systems and configurations that are critical to the organization’s operations.
Separate the backup infrastructure from the production environment, domain and primary administrator accounts.
Use offline copies or immutability controls that prevent data from being deleted or overwritten for a defined period.
Encrypt backups and control access to encryption keys, the management console and emergency procedures.
Monitor failed jobs, retention changes, deleted recovery points and unusual sign-in activity.
Test recovery regularly in an isolated environment and document the RPO and RTO achieved.

CISA’s ransomware guidance recommends maintaining encrypted, offline backups and regularly checking their availability and integrity. Ransomware often attempts to find and delete accessible backups, so logical separation and immutability matter as much as backup frequency.

How to build resilient backups with the 3-2-1-1-0 rule

7. An untested backup is only an assumption

A successful backup job does not prove that the organization can resume operations. A backup may be incomplete, corrupted, infected, dependent on an unavailable key or impossible to run on the available infrastructure. The problem may only become apparent during a crisis, when the team has the least time and capacity to respond.

Testing should cover more than the recovery of one file. It should restore a representative process and verify the service startup sequence, integrations, permissions, data integrity and users’ ability to work. The exercise should end with a report stating what was restored, how long it took, what data was lost and which corrective actions are required.

A mature organization also plans for some personnel and primary communication tools to be unavailable. Emergency instructions, contact details, keys and minimum configurations should remain securely accessible outside the environment affected by the incident.

8. The first 24 hours after an incident

Initial actions affect both system recovery and the later investigation. Hastily deleting files, restarting servers or immediately restoring the entire environment can destroy evidence needed for analysis and reactivate the attack mechanism.

Contain the incident. Isolate affected systems and accounts in accordance with the prepared procedure while preserving material required for analysis.
Preserve evidence and determine the scope. Retain logs, identify affected systems and establish whether the event caused only unavailability or also involved data exfiltration.
Protect the recovery environment. Before restoring data, confirm that backups are intact and that the accounts, vulnerabilities or configurations used in the attack have been secured.
Activate decision-making and communication procedures. Involve the people responsible for IT, security, data protection, legal matters, business continuity and customer communications.

Recovery should follow business priorities rather than an arbitrary server order. Restore foundational services and security controls first, followed by the processes with the greatest impact on customers, revenue, legal obligations or operational safety.

9. Supplier security as part of corporate cybersecurity

If a supplier stores or processes data, the backup assessment should reflect the shared-responsibility model. The customer needs to establish who creates the backups, where they are stored, how long recovery takes, whether an export is available and what happens to the data when the contract ends. Saying that a service runs in the cloud does not answer these questions.

The contract should define incident-reporting rules, cooperation during breach analysis, log retention, support for regulatory requests and notifications to affected individuals. Organizations should also verify subcontractors, data locations, privileged access and business continuity test results. A supplier certificate or declaration can support the assessment, but it does not replace an analysis of the specific service and its data flows.

9.1 Why a SaaS provider may not deliver complete backup coverage

In SaaS services, the provider usually maintains platform availability, but the customer may remain responsible for retention, configuration, user accounts and the recovery of accidentally deleted information. Version history or an application’s recycle bin does not necessarily provide the required change history, an isolated copy or an export capable of restoring the process outside the service.

Before purchasing a service, verify the division of responsibilities, the retention period for deleted data, bulk recovery options, protection against administrator account takeover and the method for recovering data during an extended provider outage.

10. Building cyber resilience beyond backup

Cyber resilience is the ability to prevent incidents, detect them, contain their effects and restore operations. Backup addresses only part of this cycle. Its effectiveness depends on accurate inventories, data classification, access management, monitoring and prepared personnel.

A practical starting point for management is a set of questions. Do we know where our most important data is stored? Do we have an immutable copy? When did we last restore a critical process? Who decides whether systems should be isolated? How do we communicate with customers and authorities? Can our suppliers provide evidence that their procedures work? Any unanswered question identifies an area that requires prompt attention.

10.1 A short organizational checklist

The most important data and processes have assigned owners, RPOs, RTOs and a defined recovery order.
At least one copy is isolated, offline or immutable, and protected with credentials that differ from those used in production.
Tests cover the entire business process, not merely the recovery of one file.
Monitoring detects failed jobs, retention changes, backup deletion and unusual administrator activity.
Supplier contracts govern data recovery, cooperation during incidents and service termination.
The incident response plan identifies decision makers, communication channels and the way technical, legal and business functions work together.

11. How TTMS helps organizations prepare for incidents

TTMS helps organizations assess safeguards, develop security policies, protect data, and prepare incident response and business continuity procedures. Support may include cybersecurity audits, encryption, DLP, malware protection, vulnerability management, incident response and disaster recovery planning.

This approach places backup within a broader security strategy. The objective is to confirm that the most important processes can be restored within the required time and that consistent technical and organizational measures reduce the risk of a data breach.

Can your organization do more than create backups and restore its data and critical processes securely? Explore TTMS cybersecurity services and prepare your business before an incident occurs.

FAQ

Does backup protect a company from a data breach?

No. Backup helps recover data after deletion, encryption or corruption, but it does not prevent an unauthorized person from copying it. Preventing data breaches requires access controls, encryption, DLP, monitoring and incident response, among other measures.

How often should a company test data recovery?

The frequency should reflect the risk and importance of the process. Critical systems require more frequent testing than archives with little operational impact. Testing should also be repeated after a material change to the infrastructure, application, supplier or backup policy.

Is cloud backup sufficient?

It can form part of an effective strategy, but storage in the cloud does not by itself guarantee resilience. Organizations should verify account separation, versioning, immutability, encryption, retention, export options and the response to losing access to the primary account or provider.

Is the 3-2-1-1-0 rule a legal requirement?

No. It is not a universal legal requirement for every company. It is a practical model for designing backups that are resilient to failures and ransomware. The specific measures should reflect the risk assessment, type of data, applicable regulations, contractual obligations and required level of business continuity.

Where should an organization begin its resilience assessment?

Begin by inventorying critical data and services, defining RPO and RTO, reviewing access rights and testing the recovery of a selected process. The findings should lead to an action plan covering technology, procedures, suppliers and named responsibilities.

TTMS blog – the world through the eyes of IT experts

Cybersecurity After a Data Breach. Why Backup Alone Is Not Enough

High-profile incidents involving medical data show that even information processed by specialized systems can become a target for cybercriminals. When a breach occurs, management must determine not only what data may have been exposed, but also whether the organization can maintain its most important processes and restore its IT environment safely. In August 2026, the President of Poland’s Personal Data Protection Office announced an inspection of the technical and organizational measures applied by MyDr following reports of an incident involving patient data. The authority emphasized that the exact scale of the event was not yet fully known and that the company’s risk analysis would also be examined. This qualification matters: while proceedings are ongoing, the cause of the incident and the responsibility of individual parties should not be assumed. This was not the first serious warning for the Polish market. In November 2023, Poland’s Personal Data Protection Office reported a ransomware attack accompanied by a data breach at ALAB Laboratoria. The incidents differ in method and circumstances, but they point to the same conclusion: data security cannot depend on a single product or procedure. Many companies still treat backup as their main response to cyber threats. A well-designed backup can save an organization after data has been encrypted, deleted or corrupted. It cannot reverse a breach, take stolen information away from an attacker, or replace access controls, encryption, monitoring and a prepared incident response plan. 1. A data breach and data loss are different risks A data breach means that an unauthorized person has obtained, or may have obtained, access to information. Data loss concerns information that has become unavailable, deleted, encrypted or corrupted. A single attack can cause both outcomes: criminals may copy data first, then encrypt systems and demand payment for restoring access or withholding publication. Backup primarily addresses availability and recovery. If backups are current, isolated and usable, the company can rebuild systems without relying on an attacker’s promises. A backup cannot restore the confidentiality of information that has already left the organization. Legal obligations, fraud risk, incident-handling costs and loss of customer trust remain after the breach. 1.1 Double extortion changes the role of backup In a traditional ransomware scenario, the attacker encrypted data and demanded payment for a decryption key. Increasingly, attackers copy information first and then threaten to publish or sell it. This model, known as double extortion, means that restoring systems does not end the crisis. The company may resume operations, but it still needs to determine the scope of the breach, assess the risk to individuals and business partners, and communicate in line with its legal obligations. In practice, organizations therefore need two parallel plans. The first covers system recovery and business continuity. The second addresses the confidentiality breach: preserving logs, identifying the data that was taken, preventing further access and deciding which notifications are required. Backup is essential to the first plan, but it does not replace the second. This distinction also matters under the GDPR. Article 32 of the GDPR refers, among other things, to the ability to restore the availability of personal data promptly and to regularly test the effectiveness of security measures. It also requires organizations to protect confidentiality and integrity, which calls for a broader set of safeguards than backup alone. 2. Lessons from major data breaches for businesses in Poland The first lesson concerns the value of data. Medical records, customer data, financial information, employee data and intellectual property can be used for extortion, identity theft, phishing or further attacks. An organization should know where such information is stored, who can access it and how quickly unusual downloads will be detected. The second lesson concerns dependence on suppliers. Business data is often processed in SaaS systems, cloud environments, data centers and applications maintained by third parties. Outsourcing technical operations does not remove the customer’s risk. Organizations need contractual requirements, periodic security assessments, agreed incident-reporting rules and confidence that data can also be recovered after an outage or the end of the supplier relationship. The third lesson concerns governance. Security does not begin when an attack occurs. The organization should define recovery priorities, decision-making roles, communication channels and acceptable downtime in advance. For entities covered by national laws implementing NIS2, the Directive’s business continuity measures include backup management, disaster recovery and crisis management. 3. When backup genuinely protects the business Backup delivers the greatest value when primary data or systems become unavailable. This may result from ransomware, infrastructure failure, administrator error, a faulty update, accidental deletion by an employee or damage to a cloud environment. Backup can then reduce downtime, restore services and limit irreversible information loss. The entire process must be covered, not merely one folder. Resuming operations may require databases, configurations, keys, application code, documentation, integrations, system images and information about the correct service startup sequence. A copy of the data may be insufficient if the organization does not know how to restore its dependencies. 4. How backup replication archiving and disaster recovery differ These terms are sometimes used interchangeably even though they address different needs. Backup creates recovery points from which an earlier version of data can be restored. Replication maintains a second, near-current copy of an environment, but it may immediately reproduce a deleted file, an incorrect change or encryption. Archiving supports long-term information retention rather than the rapid restoration of an entire process. Disaster recovery includes the technology and procedures required to restore services after a serious event. It defines the system startup sequence, dependencies, replacement resources, team responsibilities and the method for confirming that the process works correctly. A company can therefore hold many file copies without having a viable plan for restoring operations. A mature strategy combines these mechanisms. Replication can reduce downtime after an infrastructure failure, backup enables recovery to a point before an attack, archiving supports retention, and disaster recovery organizes how all these resources are used during a crisis. 4.1 Define RPO and RTO in business terms The recovery point objective, or RPO, defines the maximum amount of recently recorded data the organization can afford to lose. The recovery time objective, or RTO, specifies how long a process may remain unavailable. These values should not be determined solely by technical capabilities. They must reflect business consequences such as halted production, interrupted customer service, delayed settlements, missed deadlines or risks to human safety. 4.2 Example of a sales system and a monthly archive If a system accepts orders around the clock, losing the most recent 24 hours of data may require hundreds of transactions to be reconstructed manually. Such a process may need an RPO measured in minutes and an RTO measured in hours. Much higher values may be acceptable for a closed archive of documents from the previous year. Applying one backup policy to both resources leads either to excessive cost or inadequate protection. 5. Why backup alone cannot stop a data breach Backup is a recovery mechanism, not a complete information-protection system. Even a perfectly restored database remains compromised if the attacker copied its contents beforehand. Backups must therefore form part of an architecture that covers prevention, detection, response and operational recovery. Access controls and the principle of least privilege limit the number of people and accounts able to download data. MFA, segmentation and separate administrative accounts make it harder to compromise an entire environment with one set of credentials. Encryption protects data at rest and in transit when the keys are managed separately and securely. DLP, information classification and monitoring help detect unusual transfers or bulk file downloads. EDR, malware protection and vulnerability management reduce the likelihood that an attacker can maintain access. An incident response plan defines who isolates systems, preserves evidence, assesses risk and initiates crisis communications. 6. How to build resilient backups with the 3-2-1-1-0 rule The 3-2-1 rule is a useful starting point: three copies of the data, two different media types or environments, and one copy outside the primary location. For ransomware resilience, it can be extended to the 3-2-1-1-0 model. The additional one represents an offline or immutable copy, while zero means no errors detected during recovery testing. Identify the data, systems and configurations that are critical to the organization’s operations. Separate the backup infrastructure from the production environment, domain and primary administrator accounts. Use offline copies or immutability controls that prevent data from being deleted or overwritten for a defined period. Encrypt backups and control access to encryption keys, the management console and emergency procedures. Monitor failed jobs, retention changes, deleted recovery points and unusual sign-in activity. Test recovery regularly in an isolated environment and document the RPO and RTO achieved. CISA’s ransomware guidance recommends maintaining encrypted, offline backups and regularly checking their availability and integrity. Ransomware often attempts to find and delete accessible backups, so logical separation and immutability matter as much as backup frequency. 7. An untested backup is only an assumption A successful backup job does not prove that the organization can resume operations. A backup may be incomplete, corrupted, infected, dependent on an unavailable key or impossible to run on the available infrastructure. The problem may only become apparent during a crisis, when the team has the least time and capacity to respond. Testing should cover more than the recovery of one file. It should restore a representative process and verify the service startup sequence, integrations, permissions, data integrity and users’ ability to work. The exercise should end with a report stating what was restored, how long it took, what data was lost and which corrective actions are required. A mature organization also plans for some personnel and primary communication tools to be unavailable. Emergency instructions, contact details, keys and minimum configurations should remain securely accessible outside the environment affected by the incident. 8. The first 24 hours after an incident Initial actions affect both system recovery and the later investigation. Hastily deleting files, restarting servers or immediately restoring the entire environment can destroy evidence needed for analysis and reactivate the attack mechanism. Contain the incident. Isolate affected systems and accounts in accordance with the prepared procedure while preserving material required for analysis. Preserve evidence and determine the scope. Retain logs, identify affected systems and establish whether the event caused only unavailability or also involved data exfiltration. Protect the recovery environment. Before restoring data, confirm that backups are intact and that the accounts, vulnerabilities or configurations used in the attack have been secured. Activate decision-making and communication procedures. Involve the people responsible for IT, security, data protection, legal matters, business continuity and customer communications. Recovery should follow business priorities rather than an arbitrary server order. Restore foundational services and security controls first, followed by the processes with the greatest impact on customers, revenue, legal obligations or operational safety. 9. Supplier security as part of corporate cybersecurity If a supplier stores or processes data, the backup assessment should reflect the shared-responsibility model. The customer needs to establish who creates the backups, where they are stored, how long recovery takes, whether an export is available and what happens to the data when the contract ends. Saying that a service runs in the cloud does not answer these questions. The contract should define incident-reporting rules, cooperation during breach analysis, log retention, support for regulatory requests and notifications to affected individuals. Organizations should also verify subcontractors, data locations, privileged access and business continuity test results. A supplier certificate or declaration can support the assessment, but it does not replace an analysis of the specific service and its data flows. 9.1 Why a SaaS provider may not deliver complete backup coverage In SaaS services, the provider usually maintains platform availability, but the customer may remain responsible for retention, configuration, user accounts and the recovery of accidentally deleted information. Version history or an application’s recycle bin does not necessarily provide the required change history, an isolated copy or an export capable of restoring the process outside the service. Before purchasing a service, verify the division of responsibilities, the retention period for deleted data, bulk recovery options, protection against administrator account takeover and the method for recovering data during an extended provider outage. 10. Building cyber resilience beyond backup Cyber resilience is the ability to prevent incidents, detect them, contain their effects and restore operations. Backup addresses only part of this cycle. Its effectiveness depends on accurate inventories, data classification, access management, monitoring and prepared personnel. A practical starting point for management is a set of questions. Do we know where our most important data is stored? Do we have an immutable copy? When did we last restore a critical process? Who decides whether systems should be isolated? How do we communicate with customers and authorities? Can our suppliers provide evidence that their procedures work? Any unanswered question identifies an area that requires prompt attention. 10.1 A short organizational checklist The most important data and processes have assigned owners, RPOs, RTOs and a defined recovery order. At least one copy is isolated, offline or immutable, and protected with credentials that differ from those used in production. Tests cover the entire business process, not merely the recovery of one file. Monitoring detects failed jobs, retention changes, backup deletion and unusual administrator activity. Supplier contracts govern data recovery, cooperation during incidents and service termination. The incident response plan identifies decision makers, communication channels and the way technical, legal and business functions work together. 11. How TTMS helps organizations prepare for incidents TTMS helps organizations assess safeguards, develop security policies, protect data, and prepare incident response and business continuity procedures. Support may include cybersecurity audits, encryption, DLP, malware protection, vulnerability management, incident response and disaster recovery planning. This approach places backup within a broader security strategy. The objective is to confirm that the most important processes can be restored within the required time and that consistent technical and organizational measures reduce the risk of a data breach. Can your organization do more than create backups and restore its data and critical processes securely? Explore TTMS cybersecurity services and prepare your business before an incident occurs. FAQ Does backup protect a company from a data breach? No. Backup helps recover data after deletion, encryption or corruption, but it does not prevent an unauthorized person from copying it. Preventing data breaches requires access controls, encryption, DLP, monitoring and incident response, among other measures. How often should a company test data recovery? The frequency should reflect the risk and importance of the process. Critical systems require more frequent testing than archives with little operational impact. Testing should also be repeated after a material change to the infrastructure, application, supplier or backup policy. Is cloud backup sufficient? It can form part of an effective strategy, but storage in the cloud does not by itself guarantee resilience. Organizations should verify account separation, versioning, immutability, encryption, retention, export options and the response to losing access to the primary account or provider. Is the 3-2-1-1-0 rule a legal requirement? No. It is not a universal legal requirement for every company. It is a practical model for designing backups that are resilient to failures and ransomware. The specific measures should reflect the risk assessment, type of data, applicable regulations, contractual obligations and required level of business continuity. Where should an organization begin its resilience assessment? Begin by inventorying critical data and services, defining RPO and RTO, reviewing access rights and testing the recovery of a selected process. The findings should lead to an action plan covering technology, procedures, suppliers and named responsibilities.

Limitations of AI in Legal Software: Risks of Incorrect Advice, Defective Court Filings and Missed Deadlines

An authentic case number supporting a fabricated proposition is one of the most dangerous forms of legal hallucination. In June 2026, Poland’s Supreme Administrative Court described a submission in which counsel cited three judgments that genuinely existed. The problem was that they concerned different legal issues and did not contain the propositions attributed to them. The submission appeared credible until someone checked the original sources. This example illustrates the practical limitations of AI in legal software. An error may affect legal arguments, the assessment of evidence, deadline calculations, advice given to a client or the content of a court filing. The lawyer who approves the advice, opinion or filing remains responsible for its final content. Any potential liability for damages is assessed by reference to the applicable professional standard of care, the scope of the engagement and the circumstances of the individual case. In this article, you will learn about: the most common AI errors in legal work, hallucinations involving legislation, judgments and case numbers, the procedural consequences of using incorrect AI-generated content in a court filing, a lawyer’s liability for advice prepared with the assistance of AI, principles for the safe implementation of AI software in a law firm. For a broader discussion of compliance, confidentiality, providers and risk classification, see AI for lawyers in Europe and the UK: key risks and limitations. Here, we focus on what may go wrong in a specific case governed by Polish law and how to design a process that helps identify errors before legal advice or a court filing is sent. An authentic case number and a fabricated proposition: lessons from the Supreme Administrative Court’s order in case I FZ 104/26 In its order of 23 June 2026 in case I FZ 104/26, the Supreme Administrative Court considered an appeal against an order refusing to stay the enforcement of a tax decision. The appellant was required to substantiate the conditions set out in Article 61 § 3 of the Law on Proceedings before Administrative Courts, particularly the risk of substantial damage or consequences that would be difficult to reverse. Counsel cited three judgments together with propositions purportedly drawn from them. The Court found that the judgments concerned different issues and that their written reasons did not contain the propositions attributed to them. The dates given for those judgments were also incorrect. The Supreme Administrative Court identified another issue: the submission was general in nature and did not contain specific data or documents that would have allowed the Court to assess the party’s financial position. The appeal was dismissed. The Court criticised counsel’s uncritical use of AI and emphasised that a client is entitled to expect professional service. The decision illustrates three practical consequences of a defective workflow: a legal argument may lose the support of the source on which it purports to rely, a submission may omit facts and evidence that are material to the outcome, the court may question the reliability of counsel’s work. A proper verification of a judgment includes checking the court, date, case number and type of decision, followed by reading the full written reasons. The lawyer should assess the factual context, legal basis, significance of the cited passage, available information about the decision’s finality and subsequent case law concerning the same issue. Seven AI limitations that may affect the outcome of a case 1. A genuine source may be cited in support of a fabricated proposition A model may provide a genuine case number, a provision of legislation or the title of a publication and then attribute content to that source which it does not contain. This type of error is more dangerous than an entirely fabricated case number because it may remain undetected during a cursory review. The system should take the user directly to the relevant passage in the source. Verification by a lawyer remains necessary. A Stanford RegLab study of US legal research tools combining database searches with generated answers found hallucinations in 17-33% of responses. The study covered products and questions from the US market, so it does not measure the quality of Polish systems. Connecting a model to a legal database reduces the risk. Further safeguards are required to verify the accuracy of its output. 2. The model may apply an outdated or inapplicable provision An answer may sound plausible while relying on a provision that has been amended, has not yet entered into force or applies in another jurisdiction. In a cross-border matter, the model may confuse the applicable law, jurisdiction and procedural rules. An AI system for lawyers should identify the applicable legal system and the date as of which the law has been verified for each conclusion. The user should be able to see the version of the legislation, the date on which an amendment entered into force and the relevant official source. A label stating that the information is “up to date” has limited value unless the interface also indicates when and on what basis its currency was verified. 3. The model analyses only the case materials made available to it The case file may be incomplete, an attachment may not have been read correctly, or a material fact may be contained in a table, scan or message that was not included in the analysis. The model formulates its answer on the basis of the materials it has received and has no knowledge of documents that were not submitted for analysis. As a result, a confident answer may be based on an incomplete picture of the case. Before starting the analysis, the system should display a list of the files used, any processing errors and the scope of any omitted material. In matters requiring findings of fact, it is useful to provide a separate summary of assertions, supporting evidence and missing materials. This allows the lawyer to identify conclusions reached without access to a key document. 4. Calculating procedural deadlines requires clearly defined rules The calculation of a deadline depends on factors including the type of proceedings, the method of service, the date of the relevant event, transitional provisions, public holidays and exceptions applicable to the specific procedural step. A language model may overlook one of these conditions or misread a date from a scanned document. Procedural deadlines should be calculated using a controlled, rules-based mechanism with clearly stated input data. A model may extract dates from documents and suggest their legal significance. The final calculation should identify the legal basis, show how the deadline was calculated and be approved by the lawyer handling the case. Deadlines whose expiry may produce procedural consequences require an independent calculation and a second verification. 5. Factual assertions in an AI-assisted court filing require appropriate evidence According to press reports discussing the judgment of the Regional Court in Wrocław of 27 November 2025 in case X GC 455/25, the claimant used ChatGPT when preparing the statement of claim. The claim was dismissed because the formal conditions of the request for proposals had not been satisfied. The Court also addressed the AI-generated content and the evidential value of the materials submitted. Printouts containing generated arguments, legal analysis and an assessment of the prospects of success did not constitute evidence of facts material to the determination of the case. They could be treated as part of the claimant’s legal argument. A legal AI system should clearly distinguish between factual assertions, legal grounds and evidence. A missing contract, item of correspondence, proof of service or financial document remains an evidential gap regardless of the quality of the generated reasoning. 6. The model may reinforce the client’s assessment of the case Clients often describe a dispute from one perspective and expect confirmation of their own assessment. A model may adopt the client’s assumptions and overlook the other party’s arguments. This creates a risk that the client will make a decision without understanding the weaknesses of the case. The analysis should consider the opposing party’s perspective, including missing facts, potential counterarguments, procedural obstacles, alternative legal characterisations and the level of uncertainty. In client-facing communications, users should be able to refer a question to a lawyer, particularly when it concerns a deadline, a legal claim, criminal liability, termination of employment or a significant financial decision. 7. A convincing style may conceal errors and uncertainty A model generates an answer word by word and may maintain the same professional tone when presenting both correct and incorrect conclusions. Assessing reliability on the basis of style is therefore unsafe. A confidence score expressed as a percentage may also create a false impression of precision if it has not been calibrated for the specific use case. A well-designed system identifies its sources, missing information, conditions that could change the answer and situations in which it cannot provide a definitive conclusion. It should also be able to decline to answer and refer the matter to a lawyer. Can a client claim that AI caused them to lose the case? A client may raise such an allegation. The assessment of liability will depend on how the legal service was performed and on the circumstances of the individual case. In a contractual relationship, the primary rules are those set out in the Polish Civil Code. Under Article 355 § 2 of the Civil Code, the professional nature of the debtor’s activity must be taken into account when assessing due care. Article 471 of the Civil Code sets out the rules governing liability for non-performance or improper performance of an obligation. An adverse outcome does not in itself establish that a legal services agreement was performed improperly. The assessment covers compliance with the applicable professional standard of care, the correct determination of the factual and legal position, and the appropriateness of the actions taken. In a contractual liability dispute, the client should demonstrate: the existence and terms of the obligation, non-performance or improper performance of the obligation, the loss suffered, an adequate causal link between the breach and the loss. Article 471 of the Civil Code establishes a presumption that non-performance or improper performance of an obligation results from circumstances for which the debtor is responsible. Whether the debtor can avoid liability must be assessed in light of the circumstances of the individual case. The assessment may be affected by how AI was used, particularly whether the sources were verified, the complete case file was considered, the current law was applied and control over the final content of the advice was retained. A system failure or an error attributable to the provider will be assessed together with the choice of tool, the contractual terms, the scope of testing performed and the lawyer’s method of verifying the output. Examples include: missing a deadline because the date of service was determined incorrectly, advising against pursuing a legal remedy on the basis of an outdated provision, filing a submission containing a quotation that does not appear in the cited judgment, recommending a settlement on the basis of an incomplete case file or an incorrect calculation of the financial consequences, a chatbot giving the client a definitive answer without referring the matter to a lawyer. These examples are illustrative. Any assessment of liability requires an examination of the scope of the engagement, the applicable standard of professional care, the loss suffered and the causal link. The conditions for disciplinary liability may be assessed separately. The Polish Law on the Bar and the Polish Act on Attorneys-at-Law also require advocates and attorneys-at-law to hold professional liability insurance. Compulsory professional liability insurance does not necessarily cover every loss connected with the use of AI. The insurer’s liability depends on the terms of the policy and the circumstances of the individual event. What procedural consequences may result from an incorrect AI-assisted court filing? The consequences depend on the type of defect and the applicable procedural rules. An error resulting from the use of AI is assessed in the same way as any other error in a court filing. Its significance depends on how it affects compliance with formal requirements, proof of the relevant facts, the legal and factual basis of the relief sought, and compliance with applicable deadlines. Depending on the type of defect, the consequences may include: the return of a filing if its formal defects have not been remedied, the rejection of a statement of claim, appeal or other means of challenge where the conditions specified in the applicable procedural rules are met, the court disregarding an application for evidence or the evidence itself, a finding that a material fact has not been proven, the court declining to accept an argument based on a source that does not support the proposition attributed to it, the dismissal of an application, appeal or claim because the required conditions have not been established, an order requiring the party to pay the costs of the proceedings or the imposition of a procedural sanction where provided for by the applicable rules. In case I FZ 104/26, the Supreme Administrative Court dismissed the appeal because the appellant had failed to substantiate the conditions for staying the enforcement of the decision under Article 61 § 3 of the Law on Proceedings before Administrative Courts. The general nature of the arguments and the absence of supporting documents were relevant to this assessment. The incorrect references to case law were an additional factor in the Court’s critical assessment of how the submission had been prepared. Any claim for damages against counsel is considered in separate proceedings. Disciplinary liability is assessed by the competent bodies of the relevant professional organisation. What follows from professional rules and the AI Act in 2026? On 15 June 2026, the Polish Bar Council announced the adoption of a resolution amending the Code of Ethics for Advocates and Dignity of the Profession by adding § 23e. According to the information published by the Polish Bar Council, technological tools should serve an auxiliary function. Their use must respect professional secrecy, the advocate’s independence and the advocate’s personal role in handling the case. The output produced by such a tool must be independently assessed and verified by the advocate. For attorneys-at-law, relevant points of reference include the recommendations on the use of AI published by the Polish National Bar Council of Attorneys-at-Law. These practical guidelines address professional responsibility, confidentiality, output verification and human oversight. At EU level, Article 4 of the AI Act has applied since 2 February 2025. It requires providers and deployers of AI systems to take measures supporting the development of AI literacy among their personnel. The measures selected should take account of the personnel’s technical knowledge, experience, education and training, as well as the context in which the system is used and the people in relation to whom it is intended to be used. The European Commission explains that the appropriate way to fulfil this obligation depends on the organisation’s role and the risks associated with the specific use of AI. Since 2 August 2026, the competent authorities have been responsible for supervising compliance with this obligation. The classification of an AI system depends on its intended purpose. High-risk systems may include solutions intended to be used by, or on behalf of, a judicial authority to assist that authority in researching and interpreting facts and law and in applying the law to a specific set of facts. The assessment covers the system’s actual function, the intended purpose specified by the provider and the way in which the deployer uses it. Law firm tools used to search documents, draft text or prepare summaries require an individual classification assessment. The fact that a system is used by a law firm or legal department does not in itself place it in the high-risk category. Following the amendments adopted in 2026, the obligations concerning systems listed in Annex III are due to apply from 2 December 2027. Depending on the system’s function, the type of data involved and the way in which it is used, the GDPR, rules protecting professional secrecy, the applicable procedural rules, and civil and disciplinary liability rules may also apply. How should an AI system for lawyers be designed to reduce risk? A properly designed implementation should make it easier to identify errors, limit their effect on the matter being handled and document completion of the required review. Risk Control built into the product or process Review record Fabricated proposition or quotation A link to the full source and the specific passage, a contextual preview, and mandatory approval before export Court, date, case number, type of decision, source, document version and approving reviewer Outdated law Jurisdiction and date metadata, version control for legislation, and notifications of amendments Date as of which the law was verified and the version of the provision used Incomplete case file A list of analysed files, OCR error notifications and an inventory of missing data Document inventory and file processing report Incorrect deadline calculation A mechanism based on defined rules, clearly stated input data and a second human review Legal basis, input data, calculation method and approving reviewer Overly definitive advice Questions about missing facts, escalation criteria and the ability to decline to provide an answer Reason for escalation and details of the follow-up action taken Disclosure of information protected by professional secrecy Case-level permissions, controls over access by the provider and its subprocessors, a defined processing location, data retention and deletion rules, and exclusion of client data from model training Access logs, provider configuration, retention period, information about subprocessors and incident records Changes in quality following a system update Testing on representative matters before deployment and after any change of model Test results, model version and the decision approving the new version for use The scope of documentation should be proportionate to the risk. Audit logs, including the history of prompts and outputs, may contain information protected by professional secrecy. The organisation should define which data is recorded, who is authorised to access it, how long it is retained, how it is deleted and how the logs are secured. The full history of interactions with the system need not be retained where a narrower set of information is sufficient to demonstrate that the required review was performed. A safe allocation of tasks between AI and the lawyer Tasks should be assigned according to the potential harm and how easily an error can be detected. Task Role of AI Required review Summarising a long document Preparing a working summary with references to the relevant pages Reviewing the passages material to the decision Comparing versions of a contract Identifying and organising changes Assessment of their legal significance by a lawyer Case law research and analysis Identifying potentially relevant judgments and extracting the relevant passages Reading the full judgment and assessing its factual and legal context Court filing Preparing a draft structure, editing the text and checking consistency Full verification of the facts, evidence, relief sought, legal grounds and attachments Procedural deadline Extracting dates and identifying potentially applicable calculation rules Determining the event that starts the time limit, the legal basis, the calculation method and the consequences of missing the deadline Substantive-law time limit Organising dates and identifying provisions requiring analysis Determining the nature of the time limit, when it begins and ends, and the consequences of its expiry Limitation period Organising events that may affect the running of the limitation period Assessing when the period begins, whether it has been suspended or interrupted, and when it expires Final advice to the client Preparing working materials and alternative analyses The lawyer’s personal assessment, approval and communication of the advice This approach is consistent with the practical direction set out by the CCBE in its guide for lawyers: lawyers remain responsible for their work, advice and representations, and generative AI output must be reviewed before it is used. A safe AI implementation in a law firm begins with process analysis The first step is to identify where AI-generated output may affect advice given to a client, a court filing, the assessment of a document or the calculation of a deadline. This provides the basis for defining the appropriate data sources, access permissions, verification rules and the people responsible for approving the output. If you are planning to use AI to analyse case files, work with documents or prepare contracts, explore the AI4Legal solution. We help law firms and legal departments design tools tailored to their workflows, security requirements and the scope of lawyers’ professional responsibilities. Sources Supreme Administrative Court, order of 23 June 2026, I FZ 104/26. Law on Proceedings before Administrative Courts, consolidated text, Journal of Laws of 2026, item 143. Polish Civil Code, consolidated text. Polish Law on the Bar, consolidated text. Polish Act on Attorneys-at-Law, consolidated text. Polish Bar Council, amendments to the professional ethics rules concerning AI, 15 June 2026. Polish National Bar Council of Attorneys-at-Law, recommendations on the use of AI. CCBE, Guide on the Use of Generative AI for Lawyers, 2 October 2025. European Commission, AI Act regulatory framework and guidance on AI literacy. Regulation (EU) 2026/1744 amending the timeline for the application of certain provisions of the AI Act. Stanford RegLab, Hallucination-Free? Assessing the Reliability of Leading AI Legal Research Tools. Dziennik Gazeta Prawna, discussion of the judgment of the Regional Court in Wrocław in case X GC 455/25, 7 January 2026. Dziennik Gazeta Prawna, interview concerning the grounds for dismissing the claim in case X GC 455/25. Law and sources current as of 1 September 2026. This material is provided for informational purposes and does not constitute legal advice. FAQ: limitations of AI in legal software Can a client claim damages if incorrect legal advice was produced using AI? Such a claim may be possible. Liability will depend on whether the legal service was performed with due professional care, whether the client suffered loss and whether there is a causal link between the breach and the loss. The assessment may also cover the lawyer’s professional standard of care, including how the AI-generated output was reviewed and verified. Will a court reject a filing solely because it was prepared using AI? There is no general rule under Polish law requiring a court to reject a filing for this reason. The court assesses compliance with formal requirements, applicable deadlines, legal arguments and evidence under the relevant procedural rules. Incorrect citations, insufficient evidence or a defective claim may, however, lead to the procedural consequences ordinarily associated with those deficiencies. Can AI manage procedural deadlines on its own? For critical deadlines, AI should operate as part of a broader workflow that includes controlled rules and human approval. A safer process uses verified calculation rules, clearly stated input dates, the relevant legal basis, human approval and an independent reminder. How can you verify whether a judgment actually supports a proposition generated by AI? Open the full judgment in an official or reliable legal database, locate the cited passage, read it in context and verify the date, judicial panel, type of ruling and applicable law. A correct case number and court name do not establish that the judgment supports the proposition attributed to it. Must every AI prompt and response be retained in the case file? There is no single general requirement to retain the full history of every interaction with an AI system. The appropriate scope of documentation should reflect the level of risk, the law firm’s internal policies, professional secrecy, data protection requirements and audit needs. In higher-stakes matters, it is advisable to retain the sources used, the system version, the scope of human review and the identity of the person who approved the output.

Global Employee Training: 2026 Strategies That Work

A sales rep in Manila may need to learn the same product update as an engineer in Warsaw or a compliance officer in Toronto. Yet they work in different languages, time zones, and regulatory environments. For companies running global employee training programs in 2026, this makes a single standardized training deck increasingly impractical. Global training therefore requires a balance between consistency and local relevance. Core knowledge, processes, and brand standards may stay the same across markets, while other parts of the training need to reflect local regulations, language, culture, or job-specific requirements. The challenge is not simply to translate the same course into multiple languages. It is to decide what should remain standardized, what needs to be adapted, and where full localization is necessary. The right approach can make training easier to scale, more relevant for employees, and more consistent across regions. 1. What Global Employee Training Looks Like in 2026 Global employee training in 2026 is increasingly designed around a shared core with room for local adaptation. Companies may standardize product knowledge, internal processes, brand guidelines, or compliance principles, while adjusting language, examples, legal references, and delivery formats for individual markets. Digital learning platforms make this approach easier to manage across regions. Employees in São Paulo and Seoul can complete the same core course while receiving content adapted to their language, role, or local requirements. This helps organizations maintain consistency without if every audience should receive exactly the same version of the training. Artificial intelligence and data analytics have added another layer of sophistication. Training systems now track how individual employees learn, where they struggle, and what content keeps them engaged, then adjust the experience accordingly. Personalization has become the baseline expectation for global employee training and development, not some nice-to-have extra. 1.1 Key Differences from Traditional, Single-Region Training Traditional training is often designed for one language, regulatory environment, and organizational context. Global employee training has to account for several of these at the same time. A compliance or safety course, for example, may need more than a direct translation. Legal terminology, procedures, examples, and even the way instructions are presented can differ between countries. Live training also requires additional planning when employees are spread across time zones. As a result, global training programs are usually built around a combination of standardized and localized content. The key is deciding which elements need to remain consistent across the organization and which should be adapted for a particular market or audience. 1.2 Why This Matters Now: Distributed Teams, AI, and Skills Gaps Distributed teams are the norm rather than the exception, and that alone forces companies to rethink how they train people. Add rapidly evolving AI tools and widening skills gaps across industries, and the pressure to modernize training becomes hard to ignore. Companies that fail to adapt risk losing talent to competitors offering more relevant, more accessible learning experiences. Those that invest in scalable solutions for global employee training are better positioned to keep pace with both technology shifts and workforce expectations. 2. The Business Case: Benefits of Global Employee Training and Development Global employee training supports much more than compliance. It helps companies build the skills they need across different markets, introduce new processes more consistently, reduce operational risk, and give employees a clearer understanding of what is expected of them. Its value is especially visible in organizations that operate across several countries, where differences in skills, regulations, language, and local working practices can quickly create gaps between teams. 2.1 Closing Skills Gaps Across Markets Skills gaps rarely look the same from one region to the next. A well-designed global training program identifies where those gaps exist and builds targeted content to close them, so every market has the competencies it needs to hit business goals. This matters especially as new technologies and processes roll out faster than ever, leaving less room for regional teams to fall behind. 2.2 Boosting Engagement, Confidence, and Retention Worldwide Employees who feel equipped to do their jobs well tend to stick around longer. Strong training programs give people the confidence to take on new responsibilities, and that confidence translates into higher engagement and better retention across every office, not just headquarters. 2.3 Strengthening Compliance and Reducing Regional Risk Regulations differ from country to country, and getting them wrong can be costly. A structured global training approach makes sure compliance training reflects local laws while still aligning with company-wide standards, which keeps costly missteps in any one market to a minimum. 2.4 Building a Consistent Culture Across Borders Culture can fracture quickly across a distributed workforce if there’s no shared thread connecting offices. Training is one of the most effective tools for reinforcing company values and expectations everywhere the business operates. It gives teams a sense of belonging to the same organization, even when they’ve never met face to face. 3. Common Challenges in Training a Global, Distributed Workforce Running training across several countries introduces challenges that are less visible in a single-market program. Language, time zones, local regulations, infrastructure, and differences in learning culture all affect how training should be designed and delivered. The difficulty is usually not creating one course. It is maintaining a program that works across different environments without making it unnecessarily complex or expensive. 3.1 Language and Cultural Diversity Language barriers can quietly undermine even the best-designed course. Beyond translation, cultural context shapes how people read examples, humor, feedback, all of it, and training that ignores this risks losing its audience before the message ever lands. Automated translation tools help with speed, but they still miss idiom and tone often enough that human review remains necessary before content goes live in a new market. 3.2 Time Zone and Logistical Barriers Coordinating live sessions across a dozen time zones is nearly impossible without leaving someone out. That’s pushing companies toward asynchronous, self-paced formats that let employees engage with material on their own schedule instead of forcing everyone into the same time slot. The trade-off: self-paced courses without any live touchpoint or accountability structure tend to see weaker completion rates than blended formats, which is worth weighing before going fully asynchronous. 3.3 Balancing Global Consistency with Local Relevance Lean too hard on standardization and training feels disconnected from local realities. Lean too hard on localization and the company loses a consistent message, plus the cost and coordination burden can outweigh the benefit for smaller or less regulated markets. Striking that balance is one of the harder judgment calls in designing any global employee training and development strategy. 3.4 Technology and Infrastructure Disparities Not every office has the same bandwidth, devices, or digital literacy. Training platforms need to work reliably across varying levels of technological infrastructure, or entire regions risk being left with a worse learning experience than others. 3.5 Measuring Impact Across Multiple Regions Data collected in one market doesn’t always translate cleanly to another. Comparing outcomes across regions requires consistent metrics and reporting tools, otherwise it becomes difficult to know whether the program is working everywhere it’s deployed. 4. FourCore Strategies for Structuring Global Training Programs Companies generally choose from four broad approaches when structuring global training, each with its own trade-offs between simplicity and personalization. Strategy 1: Fully Standardized Training for All Topics This approach delivers identical content everywhere. It’s the easiest to build and maintain, but it risks missing the cultural and regulatory details that matter in specific markets. Strategy 2: Standardized Approach, Customized by Topic Here, some topics stay uniform across the company while others get adapted per region. This gives more flexibility than a fully standardized model without the resource demands of full localization. Strategy 3: Shared Objectives with Region-Specific Content Under this strategy, every region works toward the same learning objectives but builds content that fits local context. It’s a middle ground that keeps the company aligned while respecting regional differences. Strategy 4: Fully Localized Objectives and Content per Region This is the most tailored approach, with both objectives and content built specifically for each market. It delivers the most relevant experience but demands significant time, budget, and coordination, and it’s often overkilled for smaller regional offices or lightly regulated topics where a shared, lightly adapted version works just as well. Choosing the Right Strategy for Your Organization The right strategy depends on company size, industry regulation, and how much variation exists between regional teams. Organizations with tighter budgets often start with a standardized core and layer in customization as they scale, while larger multinationals with complex regulatory needs may need full localization from day one. 5. Building Blocks of an Effective Global Training and Development Program A global training strategy needs to translate into a program that employees can actually use across different countries, roles, and working environments. That means deciding what people need to learn, which content should be shared globally, where local adaptation is necessary, and how employees will access the training. 5.1 Types of Training to Include: Technical, Compliance, Leadership, and Soft Skills Most global training programs cover several different areas. These may include role-specific technical skills, compliance and safety training, leadership development, product knowledge, and soft skills such as communication or teamwork. They do not all require the same approach. Product or process training can often use a common global core, while compliance content may need significant changes to reflect local regulations. Leadership and communication training may also need different examples or scenarios depending on the cultural and organizational context. 5.2 Localization and Multilingual Content Delivery Localization goes beyond swapping words from one language to another. It means adjusting examples, tone, and even visual design so the material feels natural to the audience. Multilingual delivery has become a baseline expectation for any employee training platform for global companies serving a diverse workforce. 5.3 Blended and Self-Paced Learning Models for Different Time Zones Combining live sessions with self-paced modules gives employees flexibility to learn when it suits them, without losing the benefits of interactive discussion when schedules do align. This blended model has become one of the most practical answers to the time zone problem. 5.4 Peer Learning and Regional Mentorship Networks Some knowledge is easier to develop through interaction with colleagues than through a course alone. Regional mentors, subject-matter experts, and peer groups can help employees apply what they have learned to their actual work. They can also answer questions that are specific to a particular market, customer group, or local process. This is especially useful after formal training has finished, when employees start applying new knowledge in day-to-day situations. 6. Using AI and Technology to Scale Training for Skills Development Technology makes it possible to deliver and manage training across large, distributed teams. AI can support this process by helping organizations personalize learning, adapt content, translate materials, and analyze training data. Human review is still important, especially when content involves compliance, safety, culture, or sensitive terminology. 6.1 AI-Driven Personalization and Adaptive Learning Paths AI can adjust a learning path in real time based on how an individual employee is progressing. It gives someone more practice where they’re struggling and pushes them faster through material they’ve already nailed down. This kind of personalization would be nearly impossible to manage manually across a large, distributed workforce. 6.2 Automated Translation and Localization Tools Automated translation tools speed up the process of adapting content for multiple markets, cutting both cost and turnaround time. Paired with human review for cultural accuracy, these tools make multilingual delivery far more manageable than it used to be, though relying on machine translation alone still creates a real risk of tone-deaf or awkward phrasing in markets with limited review. 6.3 Learning Analytics for Real-Time Performance Insights Learning analytics help L&D teams understand how employees are progressing across courses and regions. They can show completion rates, assessment results, engagement with individual modules, or areas where learners repeatedly encounter difficulties. This data can be used to improve existing courses, identify skills gaps, and decide where additional training or support is needed. It also gives global training teams a more consistent way to compare results across markets. TTMS supports organizations in building and maintaining this type of learning environment through its AI Solutions and E-Learning administration services. Depending on the scale and complexity of the program, this may include AI-assisted content creation and adaptation, multilingual course management, hosting, reporting, and ongoing updates. The level of technology should match the actual training needs. A large international program may benefit from automation and advanced analytics, while a smaller rollout can often be managed effectively with a simpler platform and a well-defined review process. 7. How to Implement a Global Training Strategy Rolling out a global training strategy starts with a clear assessment of organizational needs and a definition of what success should look like. From there, companies select the training methods and delivery formats that fit their workforce, whether that means blended learning, mobile-first content, or live regional workshops. Engaging local stakeholders early is essential, since they’re the ones who know which cultural or regulatory details need attention before content goes live. Technology plays a central role in execution. An employee training platform for global companies needs to handle content hosting, multilingual delivery, and progress tracking, ideally within a single system rather than a patchwork of tools. Continuous evaluation and feedback loops then let teams refine the program over time, rather than treating the initial rollout as a finished product. TTMS can also support the operational side of a global training rollout by automating processes around course assignment, approvals, reminders, and completion tracking. With Process Automation and Low-Code Power Apps, these workflows can be connected across departments and regional offices, reducing the need to manage them through separate spreadsheets or manual email exchanges. For organizations already using Microsoft 365 and Azure, training processes can also be integrated with the tools employees and administrators use every day. 8. Measuring ROI and Impact of Corporate Training Programs Globally Proving the value of a global training investment requires looking at more than completion rates. Organizations should track performance indicators tied to productivity, retention, and skill application on the job, alongside qualitative feedback that reveals how employees perceive the training’s usefulness. Comparing outcomes between trained and untrained groups offers one of the clearest ways to demonstrate tangible impact and gives leadership the evidence it needs to justify continued investment or adjust course where results fall short. Business Intelligence tools, such as Snowflake DWH and Power BI, can play a useful role here by consolidating training data from multiple regions into a single view. That makes it far easier to spot trends and report results across the organization instead of reviewing each market’s numbers in isolation. 9. Real-World Examples of Global Employee Training Done Right Successful global employee training starts with matching the learning format to the content, audience, and business context. Some topics can be delivered through standardized materials across regions, while others require a more tailored approach because of local regulations, safety requirements, language, or cultural differences. A good example comes from a global production and technology company that needed to standardize Health & Safety training for production and office employees across five locations worldwide. Previously, individual sites used different materials, which made it difficult to ensure that employees received the same information and that training completion was properly tracked. TTMS developed a single interactive e-learning course built around workplace scenarios and storytelling. Employees worked through situations that could lead to accidents and selected the appropriate response, receiving immediate feedback on their decisions. The course helped the company deliver the same core safety principles across a multicultural workforce while replacing part of its previously time-consuming classroom training. The platform also gave managers visibility into who had started or completed the training and automatically reminded employees about approaching deadlines. According to the case study, the organization subsequently recorded fewer accidents across its locations. This example shows an important principle of global employee training: not every subject should be handled in the same way. Compliance and safety content often needs more careful adaptation and stronger learner engagement, while other training can remain more standardized. Technology makes it easier to distribute and update learning across locations, but the format and level of localization should still reflect the needs of each audience. If you are planning to scale employee training across countries, languages, or business units, TTMS can help you choose the right mix of standardization, localization, technology, and content formats. Talk to our e-learning experts about your training needs and the best way to structure a global program. Frequently Asked Questions What is global employee training? Global employee training refers to the systematic development of skills and knowledge among employees across different regions and cultures, ensuring that training is relevant, accessible, and effective for a diverse workforce. How to manage global employee training? Managing global employee training involves understanding cultural differences, using technology to improve accessibility, and making sure training content is both standardized and localized to meet regional needs. How do companies handle language barriers in global training? Companies address language barriers by localizing training content, using multilingual support, and employing translation tools to ensure that all employees can understand and engage with the training material. What’s the difference between standardized and localized training? Standardized training provides a uniform approach across all regions, while localized training adapts content to fit the specific cultural and linguistic needs of different employee groups. How do you measure the success of a global training program? Success can be measured through various metrics, including employee performance improvements, retention rates, engagement levels, and feedback from participants regarding the training’s relevance and effectiveness. Building an effective global employee training program takes more than good intentions. It needs the right mix of strategy, localization, and technology, plus a partner who knows how to bring those pieces together. Companies exploring global employee training management software or looking to modernize their approach to workforce learning can turn to TTMS for guidance grounded in real IT implementation experience across AI, automation, and e-learning administration.

What Can GPT DO in 2026 That It Couldn’t Do in 2025?

In 2025, ChatGPT could search the web, analyse documents, create great-looking visuals and help write code. Even then, the pace of development was staggering: over the course of a single year, OpenAI released five major GPT versions, from GPT-4.5 to GPT-5.2. Some of us, users of one of the world’s most popular language models, were already struggling to identify what else could be significantly improved. This article is for everyone else, especially those who still wanted: to delegate an entire task to ChatGPT to let it work freely across applications and on a computer to have it deliver a finished result without being guided through every stage of the process. These are precisely the missing elements that began to appear in 2026. Below, I have collected more than a dozen new ChatGPT capabilities, some of which I had not even heard of until recently, that best illustrate how much the way we work with this tool has changed. Not all the capabilities described below belong to the GPT-5.6 model itself. Some are part of ChatGPT Work, Codex, the desktop app or the Responses API, which provide the environments and tools through which the model completes its work. Readers interested in GPT’s evolution over previous years can also read The Evolution of AI: From GPT-1 to GPT-4o. Users could already choose models designed for more demanding reasoning tasks in 2025. GPT-5.6 provides greater control over this process: the Max level allocates more resources to analysis, while Pro mode allows the model to do additional work before presenting a single final answer. The two settings can be combined for tasks in which the importance of the decision justifies a longer wait and higher token usage, such as selecting a technology, assessing risk or comparing several business scenarios. I have written more about how to manage this “slider” and match GPT modes to specific tasks in the article GPT-5.6 from OpenAI: What Has Changed? Pricing, Capabilities and Business Applications. 1. ChatGPT Can Operate Your Computer for You Behind this slightly clickbait-style heading is a practical situation in which you want to check something that a website does not describe explicitly, meaning that a language model cannot simply read the answer from the page. Normally, you would need to open the website and navigate its interface yourself. With the Computer Use skill, ChatGPT can do this for you: launch a browser or application, click the appropriate controls, enter data and observe the results of each action. You define the scope of the task, approve access to the website or application and retain control over actions that require confirmation. The first capabilities of this kind appeared in 2025 with Operator and later ChatGPT agent. In 2026, they were extended to applications running on macOS and Windows computers, local browser sessions and broader use with ChatGPT Work and Codex. I recently tested this with a very simple example. I wanted to find out whether the free version of a particular VOD service interrupted a specific film with advertisements, something that would have taken me at least several minutes to check manually. I delegated the task to GPT, which, after receiving my permission, opened the website, started the film, scrubbed through the entire video and reassured me that it contained no advertising breaks. The whole process took a minute and a half and ran entirely in the background. Since August 2026, ChatGPT Work has also been able to continue a task on a supported website that requires the user to sign in. When it encounters a login screen, it hands control to the user through a secure form for entering a username, password and 2FA code. According to OpenAI, the model neither sees nor stores these details. Once the user has signed in, ChatGPT returns to the task, and the session can remain active for subsequent instructions. You can therefore ask ChatGPT to find an invoice in a customer portal, check a bill or compare plans that become visible only after signing in. More information is available in the official ChatGPT browser documentation. 2. ChatGPT Can Combine Information from Several Business Applications A client meeting begins in an hour, and you need to review the latest email arrangements, important Slack messages, the current proposal stored on the company drive and the status of the sales opportunity in your CRM. Gathering this information manually means opening one tab after another, reconstructing the project history and dealing with unnecessary stress before the meeting. ChatGPT can search approved sources, select the information related to the client and prepare a one-page brief covering the current situation, open issues, risks and suggested next steps. With the appropriate permissions, it can also save a note in the CRM or prepare tasks for approval. In 2025, ChatGPT could already search and combine information from connected applications. In 2026, ChatGPT Work can gather information from several sources, turn it into a finished deliverable and then perform actions for which it has received permission. Access to each application and the ability to save changes depend on the installed integrations, granted permissions and workspace settings. 3. You Can Create an Agent for a Specific Business Process Imagine an agent assigned to support your most important clients. A new request can automatically trigger its work. The agent collects previous correspondence, checks similar cases and finds the appropriate procedure in the company’s documentation. It then prepares a response and, if it has the necessary permissions, creates a task for the appropriate team. The message to the client remains pending until an employee approves it. In 2025, a similar assistant could be built as a custom GPT equipped with instructions, knowledge and integrations. Workspace Agents, introduced in 2026, expand this concept into a saved process that includes data sources, actions in applications, required approvals and the format of the finished deliverable. An agent can be shared with a team and started manually, according to a schedule or through a signal sent by a company system. During configuration, you define which applications and sources the agent can use, which actions it is allowed to perform and when it should stop and ask a person to make a decision. This allows the same process to follow a consistent set of rules every time a new request arrives. 4. ChatGPT Can Learn a Process by Observing Your Work Some procedures are difficult to describe. You may know exactly where to click and what to change, yet writing down every step would take longer than completing the task again. A good example is a monthly report prepared in a legacy system: you select the appropriate filters, export the data, organise the spreadsheet and save the file in the correct folder. Record & Replay, introduced in 2026, allows you to complete the process once with recording enabled. ChatGPT or Codex observes the required actions and uses them to create a skill describing the workflow, its variable data and the method for checking the result. You can review it, make corrections, add your own rules and then use it when preparing the next report. This is particularly useful when process knowledge exists mainly in employees’ heads and a proper set of instructions has never been created. I personally cannot wait to try this feature while editing a video in DaVinci Resolve. I will show ChatGPT how I remove unsuccessful takes, organise the audio track and conceal visible cuts with a short zoom-in. I am curious to see how much of this repetitive work can be turned into a reusable skill for future recordings. 5. ChatGPT Can Help You Resume Interrupted Work Human memory is unreliable. It was probably Tuesday, after a conversation with your manager, when you made changes to an important spreadsheet. You cannot remember its name or location, or even whether it was open in the desktop version of Excel or in a browser. A standard file search is not much help. This is where Computer History can help. You can ask ChatGPT, for example: “Find the spreadsheet I edited after my conversation with Krzysztof.” Your activity history can connect the sequence of applications you opened, the actions you performed and the available context, and then identify the material you probably have in mind. If ChatGPT has access to the appropriate source, it can also open the file directly. You can ask what you were working on before a break, request a summary of the previous day’s work or identify activities that occur regularly and could be turned into a skill or automation. You choose which applications and websites are included in the history, and you can pause data collection at any time. Computer History records information including clicks, typed text, keyboard shortcuts, application changes and context provided by macOS. Temporary event data is deleted after no more than 48 hours, while local memories created from that data remain until the user deletes them. The feature is currently available in the ChatGPT app for macOS, requires Memories to be enabled and is turned off by default. In Business and Enterprise workspaces, an administrator must first grant access, after which each employee can decide whether to enable it. 6. ChatGPT Can Design, Test and Publish a Web Application How many good ideas have become stuck in the IT department’s backlog because something more urgent always came up? Suppose the administration team needs a simple tool for reporting faults, with a form, a list of cases, their statuses and a separate view for the person responsible for repairs. With Sites, you can describe the tool in your own words and provide sample data, company materials or a screenshot of a similar system. GPT-5.6 will prepare a working prototype, and you can ask it to simplify the form, add filters or adapt the design to your brand identity. ChatGPT or Codex can then test the application in a browser, fix any identified issues and publish the finished version at a specified address. Websites and simple applications were being created with GPT long before 2026. This year’s change concerns the entire process: GPT-5.6 is better at designing usable interfaces, while Sites provides a single place to launch a prototype, make changes, save subsequent versions and publish the finished application. The same process can be used to create calculators, dashboards and small internal tools. Before they are deployed in a real business environment, their security, permissions, data storage and regulatory compliance still need to be reviewed. 7. ChatGPT Can Work Directly in Excel and Google Sheets Consider a simple example. You open a spreadsheet containing campaign results and notice that some formulas are outdated, several cells are empty and the cost per lead has suddenly increased in two campaigns. Instead of checking everything one item at a time, you ask ChatGPT to analyse the data, complete the calculations, identify unusual results and prepare a chart for the monthly summary. ChatGPT performs this work directly in Excel or Google Sheets. You can see the changes it makes, review the formulas and immediately request another adjustment, such as changing the chart range, adding a comparison with the previous month or highlighting campaigns that exceed the target cost. In 2025, a similar analysis usually required uploading a spreadsheet to ChatGPT and then downloading the modified file. ChatGPT for Excel and Google Sheets, introduced in May 2026, allows you to work on the spreadsheet where the data is stored and where you will later use it. This makes the conversation with the model part of the document workflow instead of a separate stage outside it. 8. ChatGPT Can Create and Refine Content in Its Final Format The board meeting is one day away, and the information needed for the presentation is scattered across meeting minutes, a spreadsheet of results and several project documents. There is also a company template that must be followed. ChatGPT Work can collect these materials, organise them into a coherent story, prepare the slides, add charts and identify figures or conclusions that are not supported by the source data. You receive an editable PowerPoint or Google Slides presentation that can retain the structure, visual style and brand elements of the provided template. In 2025, GPT could already generate editable PowerPoint, Word and Excel files. In 2026, ChatGPT Work combined document creation with previews, targeted revisions, saved templates and final material checks. The entire process can therefore take place within one conversation, from gathering the sources to preparing subsequent versions of the document. 9. Codex Can Manage Long-Running Work as a Persistent Goal You have a large audit of a company website ahead of you. There are hundreds of pages to review, along with outdated information, broken links and differences between language versions. Finally, all the issues must be grouped and converted into a list of specific changes. Codex could already perform tasks in the background in 2025. Goal Mode, introduced in 2026, allows you to delegate much longer assignments and manage them across successive stages. You can monitor progress, change the direction of the work when necessary and access the active project from your phone. Several such assignments can run in parallel while you return to them whenever your input or decision is required. 10. You Can Talk to ChatGPT While It Works on Your Screen Voice messages have become part of everyday communication, while assistants such as Siri and Google Assistant have accustomed us to controlling technology by voice (“Hey Siri”, “OK Google”). We increasingly expect the same from the tools we use at work, especially when a dashboard, document or application is already open and pointing something out is easier than describing it in detail. Needless to say, OpenAI has kept pace with this trend. Imagine that, hypothetically, your screen displays a sales dashboard showing a clear drop in performance in one region. You only need to say: “Find out what happened.” ChatGPT can see the report, compare the relevant periods and, if it has access to the source data, investigate the cause and prepare a comment for the results presentation. Voice conversations and screen sharing were already available in 2025. In 2026, voice also became a way to direct work performed by ChatGPT Work. Instructions such as “compare these two periods”, “check the data in the application” or “improve this section” refer directly to the material visible on the screen. Part of the task can then continue in the background. 11. A Recurring Report Can Be Generated Without Repeating the Prompt Imagine that every Monday in your company begins with the preparation of a sales report. Each time, someone has to retrieve the latest results, compare them with the plan, identify the largest variances and turn them into a short summary for management. ChatGPT could already run simple tasks at a specified time in 2025. In 2026, an entire repeatable process can be placed on a schedule. Once configured, the task accesses the specified available sources, performs the analysis and leaves the completed report for your review. The same approach can be used to prepare a morning briefing, review new requests, summarise changes in documents or monitor competitors regularly. Each run has its own status and history, allowing you to review the result, refine the instructions and improve the process based on subsequent reports. 12. You Can Combine Company Skills and Tools in a Single Plugin Imagine that several teams regularly prepare materials for clients. They should always use current service descriptions, approved case studies, company templates and the same communication guidelines. They also need access to the content management system, the asset library and the tool in which documents are submitted for approval. An Agent Plugin allows these elements to be combined into a single package available in the company workspace. Once installed, ChatGPT can use the appropriate instructions, sources and permitted actions when preparing a presentation, proposal, service description or website content. When the company template or approval process changes, the plugin can be updated once instead of modifying the configuration of every agent separately. In 2025, a similar solution required custom GPTs, instructions and integrations to be connected and configured separately. Agent Plugins, introduced in 2026, allow them to be distributed as a single installable package. A plugin is not a separate agent and does not start work by itself. It extends ChatGPT, Codex or a Workspace Agent with the company knowledge, rules and tools needed to complete a task. 13. GPT-5.6 Can Divide a Task Among Several Agents You are considering entering a foreign market, which requires an analysis from several perspectives. You need to research the competition, compare prices, estimate costs, assess demand for the services offered and prepare an initial list of potential partners. GPT-5.6 can divide these areas among several subagents. Each subagent handles its own part of the analysis, and the work can proceed in parallel. The main agent collects the results, compares the findings and combines them into a single recommendation with sources and a list of issues requiring further verification. Multi-agent solutions were already being developed in 2025, but they required the system to be designed independently. In GPT-5.6, the mechanism for dividing work has been built into the Responses API and is currently available as a beta feature. It works best when a task can be divided into independent parts assessed according to shared criteria. Parallel work by several agents can reduce the time required for the analysis, although it usually increases token usage. 14. GPT-5.6 Can Combine Multiple Operations into a Single Program Consider a hypothetical scenario: a CRM migration is only a few weeks away, and before it begins, 800 records must be checked, missing information located and data requiring correction identified. GPT-5.6 can write a JavaScript program that retrieves successive records through an available tool, checks the required fields, compares the data against defined criteria and creates a list of missing information. Loops, conditions and result processing are handled within the runtime environment, so the model does not need to analyse each of the 800 records separately. Tool calling was already possible in 2025, but successive operations usually required the results to be sent back to the model or the necessary logic to be written within the application. Programmatic Tool Calling allows GPT-5.6 to prepare code that combines multiple predictable operations. This can reduce processing time and token usage. The company decides which tools and data the program can access and which actions require approval. The feature operates through the API, so it must be implemented within a company application or process. It is not an option available directly in the ChatGPT window. 15. ChatGPT Can Turn Data into an Interactive Visualisation Before a meeting, you receive a table containing the results of an employee survey. A standard chart shows the average scores, but it does not allow you to explore how responses differ between departments, locations and seniority groups. ChatGPT can prepare an interactive visualisation in which you select the criteria you are interested in, change the data range and observe how these choices affect the results. In 2025, GPT could already create charts and analyse data. Visualize, introduced in August 2026, makes it possible to build interactive diagrams, maps, timelines, simulations and information exploration tools directly within a conversation. The finished visualisation can be filtered, adjusted and used to investigate additional questions that arise during the analysis. GPT and ChatGPT Features in 2026: Availability by Plan and Device The table below summarises the availability of the features described in this article. Information accurate as of 31 August 2026. Feature Free / Go Plus / Pro Business / Enterprise / Edu Where is it available? Key limitations GPT-5.6 Yes, GPT-5.6 Luna is the default model Yes, with access to the Sol, Terra and Luna family Yes, depending on workspace settings Web, desktop app, Codex and iOS; also through the API Usage limits and the choice of model variant depend on the plan and environment. ChatGPT Work Yes, with lower usage limits Yes Yes, with additional administrator controls Web and desktop app; some capabilities are also available on mobile It shares usage limits with Codex. Tool availability depends on the plan, region and workspace settings. Computer Use Full availability has not been clearly confirmed Yes, in supported regions Yes, if permitted by workspace settings Desktop app on macOS and Windows Work running on a computer can be monitored remotely from iOS. Linux does not yet support this feature. Browser and website interaction Limited availability Yes Yes, although some capabilities may be disabled by an administrator Web, desktop app and partially on mobile Signing in to websites through the cloud browser is available on Plus and Pro, but is not currently available on Enterprise and Edu. Plugins, skills and application integrations Depends on the individual plugin Yes Yes, after administrator approval Web, desktop, iOS and Android; also Codex CLI Plugins do not work in the Codex IDE extension. The availability of a specific integration may depend on the plan and region. Workspace Agents No No Yes, on Business, Enterprise and Edu plans Company ChatGPT workspace An administrator must enable agents and grant permissions to create, publish and connect them to applications. Computer History No Pro only Yes, on Business and Enterprise ChatGPT desktop app on macOS only The feature is disabled by default, requires Memories and needs administrator approval in a company workspace. It is available in the EEA, Switzerland and the United Kingdom. Creating documents, spreadsheets and presentations Yes, with lower usage limits Yes Yes ChatGPT Work on the web and in the desktop app The scope of editing depends on the format, available plugins and permissions for the source files. ChatGPT for Excel and Google Sheets Availability has not been confirmed Yes Yes Directly within a supported spreadsheet The feature uses ChatGPT Work limits. It is not provided through API-key authentication alone. Sites No Yes Yes ChatGPT on the web and in the desktop app The feature remains in public beta. Limits depend on the plan, and full Sites management is not described as a mobile app capability. Long-running tasks and Goal Mode The available scope depends on plan limits Yes Yes ChatGPT Work on the web, the desktop app, Codex CLI and the IDE extension Tasks that work with local files require the application to remain running and the computer to be available. Voice control for tasks Not in the ChatGPT Work form described here Yes Yes Desktop app; on iOS through Remote after pairing with a computer Voice conversation limits depend on the plan. Tasks started by voice also use the Codex allowance. Scheduled tasks and automations Availability depends on the account Yes Yes, if enabled by an administrator Web and desktop app; event triggers are also available on iOS and Android Triggers can respond to supported events in Gmail, Slack and GitHub. Subagents and Ultra mode Full access has not been confirmed Yes, depending on the available model and reasoning level Yes ChatGPT Work, the desktop app and Codex CLI In most modes, the user must explicitly request delegation. Ultra can launch subagents automatically and consumes more of the usage allowance. Interactive visualisations Depends on whether the feature has reached the account Yes, on supported accounts Yes, if the workspace allows the plugin to be used Web; currently rolling out on desktop and mobile Visualisations are not rendered in Codex CLI or the IDE extension. Programmatic Tool Calling Not available as a ChatGPT interface feature Available through paid API usage Available through the API Responses API This feature is intended for developers building their own applications. It allows GPT-5.6 to coordinate tools through executed JavaScript code. Persisted Reasoning and Pro and Max modes Not available as separate settings for Free users Partially available in the interface; full configuration through the API Depends on workspace settings; full configuration through the API Responses API and selected ChatGPT and Codex surfaces GPT-5.6 can retain compatible reasoning elements between successive calls. Pro mode can improve quality at the cost of additional time and token usage. The availability of OpenAI features changes with subsequent updates. It may depend on the plan, region, operating system, application version, selected model and permissions granted by the administrator of a company workspace. How Do You Turn GPT’s Capabilities into a Solution That Works for Your Business? These fifteen examples are enough to illustrate the scale of the change. Companies still need to make the most important decisions: which processes should be delegated to GPT, which data it may access, which actions it is allowed to perform and when human approval is required. At TTMS, we begin with these questions. We analyse the process, its objective, the systems involved and the acceptable level of risk. We then select the appropriate solution, whether ChatGPT Work, Codex or an integration through the OpenAI API, design the permissions and connect GPT to the company’s applications. We test the finished solution using real cases and measure its quality and costs. Following the launch, we provide monitoring, maintenance and further development. We have delivered projects of this kind. For Stäubli, we integrated ChatGPT with Adobe Experience Manager, while for Takeda, we created an AI solution supporting document analysis in Salesforce. This experience is backed by more than 800 TTMS specialists and an approach to AI management and security confirmed by ISO/IEC 42001 and ISO/IEC 27001 certifications. Would you like to find out which process could deliver real value to your company with GPT? Discuss it with the TTMS experts. Are all new GPT features available to every user? Access to individual features may depend on the subscription plan, region, operating system, and workspace settings. Some capabilities are initially released to selected users or require administrator approval. In a business environment, availability also depends on user permissions and access to specific applications. Before planning a process, it is worth checking which features are supported in your organisation’s current setup. How can you identify a process that is suitable for GPT? A good candidate is a process that is performed regularly, uses digital data, and follows rules that can be clearly described. A practical starting point is a time-consuming task such as gathering information from several sources, preparing reports, comparing documents, or completing missing data. The process should also have a clearly defined outcome, making it possible to evaluate the quality of GPT’s work, the time saved, and the number of errors. Can GPT-5.6 work securely with company data? Yes, provided that access to the data is properly designed and controlled. The organisation should define which sources the model can use, which actions it is allowed to perform, and when human approval is required. Data storage policies, permission management, monitoring, and regulatory compliance also need to be considered. For processes involving confidential information or personal data, security should be built into the implementation from the beginning. How can a company measure the benefits of implementing GPT? The most reliable approach is to compare the process before and after implementation. Useful metrics include task completion time, operating costs, the number of errors, the percentage of cases requiring manual correction, and the quality of the final output. It is also worth checking whether employees actually use the solution and whether it makes their everyday tasks easier to complete. A pilot involving a limited number of cases can help measure these results before the implementation is expanded.

Legal AI in EU and the UK: Key Risks and Limitations in 2026

A legal AI tool can summarize hundreds of pages in minutes and still overlook the one sentence that changes the outcome of a matter. It may return a confident, polished answer based on an outdated rule, mix up jurisdictions, or expose confidential information when connected to the wrong data environment. In practice, these are not arguments against using AI in legal work. They are reminders that legal AI needs stronger controls than a general-purpose productivity tool. The real question is not simply whether a model can produce a useful answer, but what data it can access, how its output is verified, and where human review remains mandatory. This is particularly important in regulated and data-sensitive environments. In AI projects, the model itself is often only one part of the risk. Data flows, access permissions, system architecture, retention policies, and review procedures can be just as important as the quality of the generated response. This article looks at the main limitations of generative AI in legal software and the safeguards that should be considered before these tools are used on live client matters. It focuses primarily on the European Union and the United Kingdom, where the regulatory framework is currently more developed. Europe, the Middle East, and Africa should not be treated as a single legal environment. Firms operating in Switzerland, the Gulf states, or African jurisdictions will need to assess local data protection requirements, professional secrecy obligations, and rules governing the provision of legal services. The underlying operational principle, however, remains similar: the more sensitive the legal task and the data involved, the stronger the controls around the AI system need to be. 1. Key Takeaways for 2026 Legal AI risk in Europe is both technical and regulatory; hallucinations are only one part of the picture. EU and UK requirements differ, and the wider EMEA region cannot be covered by a single legal conclusion. Not every legal AI tool is high-risk under the AI Act, but every use case should be classified and documented. Confidentiality, privilege, professional secrecy, and data protection require separate analysis. AI4Legal can support document-based work across jurisdictions, but it does not automatically supply or update the applicable national law. Human review must be qualified, source-based, and built into the workflow rather than added as a disclaimer. A trustworthy implementation combines grounded outputs, controlled data, auditability, testing, and clear responsibility. 2. Why Legal AI Risk Matters More in 2026 The regulatory environment has moved from general principles to operational obligations. In the EU, the AI Act now applies in stages. Prohibited practices and AI literacy obligations have applied since 2025, while additional governance, enforcement, and transparency provisions became applicable in 2026. The precise obligations depend on the system’s intended purpose and on whether an organization acts as a provider, deployer, importer, or distributor. The European Commission maintains the current AI Act enforcement timeline. The UK follows a different model based on existing legislation and sector regulation. In August 2026, the Solicitors Regulation Authority issued a warning focused on inaccurate AI-generated content, client confidentiality, legal professional privilege, data protection, and inadequate supervision. The message is consistent across both regimes: using AI does not transfer responsibility away from the firm or the professional approving the work. See the SRA warning notice. This makes legal AI governance a current management issue rather than a future compliance project. Firms need to know which tools are being used, what information enters them, what sources they rely on, who checks their outputs, and how incidents are reported. 3. Core Limitations of Generative AI in Legal Software 3.1 Hallucinations and Unsupported Legal Authority Large language models generate statistically plausible text. They do not independently determine whether a proposition is legally correct. An answer may contain a nonexistent case, an inaccurate quotation, a real authority applied to the wrong issue, or a source that no longer reflects the law. Fluency can make these errors harder to detect because an incorrect answer may look as polished as a correct one. Retrieval-augmented generation can reduce this risk by grounding answers in selected material, but it does not eliminate it. A peer-reviewed Stanford study of leading legal AI research tools found material rates of hallucinated or unsupported answers even in specialist systems. The practical control is therefore not a promise that a model is hallucination-free, but a workflow that exposes sources and requires proportionate verification. 3.2 Jurisdiction and Context Gaps European legal work is particularly sensitive to jurisdiction. EU law, national legislation, local procedural rules, regulator guidance, and contractual choice-of-law clauses may all affect the answer. The UK is legally distinct from the EU, while privilege and professional secrecy are not defined identically across European jurisdictions. A system that does not reliably identify the relevant country, court, date, and hierarchy of authority can combine individually plausible statements into a legally incorrect conclusion. AI can support research and document analysis, but it should not be treated as a substitute for the professional judgment required to identify the controlling rule, interpret ambiguity, or decide how law applies to disputed facts. 3.3 Confidentiality and Data Protection Legal documents often contain personal data, special-category data, commercially sensitive information, litigation strategy, and information protected by professional secrecy or legal professional privilege. Entering that material into an AI service can create exposure if prompts or files are retained, accessed by unauthorized personnel, transferred internationally, or used to improve a model. Under the GDPR and UK GDPR, firms must identify their role, establish a lawful basis, limit processing to what is necessary, provide appropriate information, control processors and subprocessors, set retention periods, secure international transfers, and implement measures appropriate to the risk. A data protection impact assessment may be required where the proposed processing is likely to result in a high risk to individuals. The UK’s Information Commissioner’s Office also provides detailed guidance on AI and data protection. Confidentiality and privilege should be assessed separately from data protection. Processing may have a GDPR basis and still violate a professional duty, client instruction, engagement term, or court restriction. 3.4 Bias, Incomplete Data, and Uneven Performance AI outputs reflect the data, retrieval process, instructions, and evaluation criteria behind the system. Historical imbalance, missing jurisdictions, language coverage, poor document quality, or inconsistent labeling can produce uneven results. Bias may appear in risk scoring, document prioritization, settlement analysis, or recommendations that seem neutral but systematically underperform for certain matters or groups. Evaluation should therefore use representative legal tasks and documents, including difficult examples, minority languages, scanned files, conflicting authorities, and cases where the correct response is to flag uncertainty rather than provide a confident answer. 3.5 Limited Explainability and Source Traceability A lawyer does not always need a technical explanation of every model parameter, but the legal work product must be reviewable. Users should be able to identify the documents or authorities supporting an answer, distinguish quotations from generated analysis, check the version and date of the source, and understand when the system lacks sufficient evidence. A citation interface is not enough if the cited source does not support the proposition. Trustworthy systems should make source checking easier, not merely attach links to generated text. 3.6 Overreliance and Automation Bias Fast, well-written output creates a risk of automation bias: users may apply less scrutiny to a machine-generated draft than they would to work produced by a colleague. Repeated reliance can also weaken research habits and reduce the likelihood that lawyers will notice jurisdictional or factual anomalies. Human-in-the-loop review is effective only when the reviewer has enough time, authority, subject-matter knowledge, and access to the underlying sources to challenge the system. 4. The EU AI Act and Legal Services The AI Act does not classify every legal AI application as high-risk. Risk classification depends on the intended purpose and context. Internal document summarization, clause extraction, or knowledge search will not automatically become high-risk merely because a law firm uses the tool. By contrast, certain systems used by or on behalf of judicial authorities to research and interpret facts and law and to apply law to concrete facts may fall within the high-risk categories when the relevant provisions apply. The Commission’s AI Act overview explains the risk-based structure and implementation dates. For legal organizations, the first compliance question is often role and use case rather than model brand. A firm that deploys a third-party tool, materially modifies it, places it under its own name, or develops a client-facing system may have different obligations. Procurement and product teams should document this assessment instead of assuming that the vendor alone carries regulatory responsibility. Article 4 also makes AI literacy an operational requirement for providers and deployers. Training should reflect the person’s role, the system’s purpose, and the people or groups affected. Generic awareness training is unlikely to be sufficient for lawyers approving court submissions, administrators configuring access, or developers changing retrieval sources. Article 50 introduces transparency obligations for specified AI systems and content. These rules do not require every internal AI-assisted draft to carry the same label, but they do require a use-case analysis. The Commission published guidelines on the 2026 transparency obligations to clarify when providers and deployers must inform people or mark generated content. 5. UK Professional Duties and Court Expectations UK firms must consider the SRA Principles and Codes of Conduct, duties to the court, confidentiality, legal professional privilege, UK data protection law, and the firm’s supervision arrangements. The SRA’s guidance emphasizes that an authorized individual must retain responsibility for legal services delivered with AI assistance and that AI-generated work requires appropriate human scrutiny. The risk is visible in litigation. In Ayinde v London Borough of Haringey and Al-Haroun v Qatar National Bank, the High Court examined legal materials containing false authorities and stressed the responsibility of legal representatives to verify material placed before the court. The relevant lesson is not that AI is prohibited. It is that the duties of accuracy, supervision, and candour continue to apply regardless of how a document was drafted. Firms operating across the EU and UK should avoid treating one policy as universally sufficient. The same technical platform may require different notices, contractual provisions, approval paths, and professional controls depending on jurisdiction and use. 6. Intellectual Property, Contracts, and Vendor Risk Legal AI procurement should address more than cybersecurity. Contracts need to define permitted data use, model training, subprocessors, retention and deletion, incident notification, audit rights, service continuity, output ownership, confidentiality, liability, and support for regulatory requests. Firms should also confirm that they have the right to upload third-party documents and that generated content is checked for infringement and unauthorized reproduction. Security or AI management certifications can support due diligence, but they are not a legal safe harbour and do not establish the accuracy of legal output. The assessment should connect each control to the actual deployment architecture and use case. 7. What Sets a Trustworthy Legal AI System Apart Defined purpose and jurisdiction: the system is designed for specified tasks, users, countries, languages, and source sets. Grounded and reviewable output: users can open the supporting material, verify quotations, and see when the system lacks evidence. Controlled data environment: client data is segregated, access is restricted, retention is defined, and data is not used for model training unless expressly authorized. Human approval at meaningful decision points: qualified professionals review advice, filings, client communications, and other high-impact outputs. Logging and auditability: the organization can reconstruct the input, sources, model or configuration, output, reviewer, and final decision where appropriate. Representative evaluation: accuracy, retrieval quality, security, bias, and failure modes are tested before launch and monitored after changes. Clear responsibility: the vendor, firm, product owner, information security team, data protection function, and legal reviewer each have defined obligations. 8. European Legal AI in Practice: TTMS and Sawaryn & Partners A practical example comes from TTMS’s work with Sawaryn & Partners, a Polish law firm. The firm needed to process large volumes of case documents, court records, meeting notes, and recordings. TTMS implemented an Azure OpenAI-based application that generates summaries and supports document updates. According to the published case study, the architecture was designed so that input data and generated results were not shared with external organizations or used to train neural networks. AI4Legal is not limited to a single jurisdiction. Its document-based architecture allows it to support legal document analysis in EU Member States, the United Kingdom, the United States, and other markets because it works with materials supplied to the system rather than automatically retrieving a national code or body of case law. This makes the platform adaptable across jurisdictions without implying that it contains a complete, continuously updated database of each country’s law. The case demonstrates an appropriate use of AI to support document-intensive legal work within a controlled environment. Jurisdictional flexibility does not make the output error-free: results depend on the completeness, accuracy, and currency of the uploaded materials. Legal professionals must still verify controlling law, citations, and conclusions under the rules applicable to the matter. The value lies in matching the technology to a defined workflow, protecting the data, and keeping legal review with the firm. Sawaryn & Partners also publishes practical commentary on AI Act roles and obligations, illustrating the need to connect technical implementation with legal governance. 9. How to Safeguard a Legal Organization Create an AI inventory. Record approved and unapproved tools, owners, users, data categories, integrations, jurisdictions, and intended purposes. Classify each use case. Assess AI Act role and risk, data protection impact, professional secrecy, privilege, client terms, court requirements, and local professional rules. Set data-entry rules. Define which information may be used, which environments are approved, and when anonymization or synthetic data is required. Perform vendor and architecture due diligence. Review data flows, training settings, storage locations, subprocessors, access controls, deletion, incident response, contractual protections, and exit arrangements. Design verification by task. Court citations, legal advice, deadlines, calculations, quotations, and client-facing content need explicit checking against authoritative sources. Train for real roles. Lawyers, support staff, developers, procurement teams, and managers need different training and escalation paths. Monitor the live system. Re-test after model, prompt, source, or integration changes and track errors, overrides, complaints, and near misses. Prepare an incident process. Staff should know how to stop use, preserve evidence, correct affected work, inform decision-makers, and assess notification duties. 10. Balancing Risk and Value AI can reduce time spent searching, organizing, comparing, and summarizing information. It can also improve access to large document sets that would otherwise be difficult to review consistently. These benefits are real, but they depend on use-case design and cannot be assumed from the model name or a vendor demonstration. The strongest approach treats AI as part of a controlled legal process. The system handles defined computational or language tasks; professionals remain responsible for legal judgment, source validation, confidentiality, and the final decision. This balance allows firms to gain efficiency without presenting automation as a replacement for professional accountability. FAQ Is legal AI prohibited under the EU AI Act? No. The AI Act uses a risk-based framework. Obligations depend on the intended purpose, risk category, and role of the organization. Many internal productivity tools will not be high-risk, although other AI Act, GDPR, contractual, and professional requirements may still apply. Can a law firm enter client documents into a generative AI tool? Only after confirming that the use is lawful and consistent with confidentiality, privilege, client instructions, professional rules, and the tool’s contractual and technical safeguards. Public consumer tools should not be treated as approved environments for confidential legal material. Do lawyers have to verify every AI-generated citation? Any authority relied on in advice, a filing, or another material legal conclusion should be checked against an authoritative source. The extent of review for lower-risk administrative tasks can be proportionate to the task and the tested reliability of the system. Does a security certification make legal AI compliant? No. Certifications may provide useful assurance about selected controls, but compliance depends on the actual use case, data flow, configuration, contracts, governance, and legal obligations. They do not establish legal accuracy. Should clients be told that AI is being used? Sometimes. The answer depends on applicable transparency rules, professional duties, engagement terms, client expectations, the materiality of the AI-supported task, and how client information is processed. Firms should define disclosure triggers rather than use a universal statement. Can AI replace a lawyer’s legal judgment? No. AI can support research, document analysis, drafting, and knowledge retrieval, but responsibility for legal advice, strategy, filings, and professional obligations remains with qualified people and regulated organizations.

Agentic CMS in 2026: How AI Agents Are Changing the Content Supply Chain

Enterprise content teams are under pressure to create, adapt, approve, and deliver more content across more digital touchpoints. Traditional CMS workflows can still support structured publishing, but they often struggle with the speed, coordination, and governance demands of modern content operations. This is where the idea of an agentic CMS enters the conversation. In the AEM ecosystem, it points to a shift toward AI-assisted content workflows, where agents can help teams discover, optimize, adapt, and orchestrate content more efficiently while keeping human oversight in place. 1. What Is an Agentic CMS, and Why It Matters Now An agentic CMS is best understood as a content management concept rather than a fixed product category. It describes a CMS environment where AI agents help teams complete content-related tasks such as discovery, optimization, adaptation, tagging, workflow support, and delivery preparation. In the AEM ecosystem, this idea is most closely connected to Agents in AEM, which Adobe describes as capabilities that can automate tasks, streamline workflows, and help orchestrate changes in AEM as a Cloud Service and Edge Delivery Services. The key shift is not that humans disappear from the process. Instead, agentic workflows are designed to reduce repetitive manual work while keeping people in control of strategy, creative judgment, governance, and final approval. This makes the concept especially relevant for enterprise content teams that need to manage more digital content without weakening brand, compliance, or workflow standards. 1.1 The Evolution: From Headless CMS to Agent-Assisted Content Workflows Headless CMS platforms helped separate content structure from presentation, making it easier to reuse content across websites, applications, and other digital experiences. However, headless architecture still relies on people to decide what content to create, how to adapt it, when to publish it, and how to coordinate work across teams. Agent-assisted content workflows build on that foundation. Instead of only storing and delivering structured content, AI agents can help with tasks such as finding relevant assets, preparing channel-ready content variations, supporting content updates, and assisting with workflow execution. Structured content, metadata, permissions, and governance rules remain essential because they provide the framework within which agents can operate safely and usefully. 1.2 Integrated Agent Workflows vs. Isolated AI Features There is an important difference between isolated AI features and integrated agent workflows. A standalone writing assistant or translation tool can help with a single task, but it may not understand the broader content model, workflow, permissions, brand rules, or delivery context. 2. The Risks of Fragmented AI Tools in Content Operations Adding a standalone AI writing assistant, translation plugin, or LLM wrapper to an existing CMS can help with individual tasks, but it does not automatically create an agentic content workflow. The challenge appears when each tool works in isolation, with separate permissions, context, prompts, review processes, and monitoring. In that setup, teams may still need to manually move content between systems, check whether generated outputs follow brand rules, and make sure the right people review the right materials before publication. Instead of reducing operational complexity, disconnected AI tools can add another layer of coordination for content, marketing, legal, and technical teams. 2.1 Security and Governance Risks of Fragmented AI Tools When AI tools operate without a shared governance framework, organizations can lose visibility into how content is generated, adapted, reviewed, and approved. This can make it harder to maintain consistent permissions, content standards, audit trails, and human review across the content supply chain. This is why governance matters in agentic content operations: AI-assisted work needs shared permissions, review steps, content standards, and auditability across the content supply chain. 2.2 The Integration Trap: Why Disconnected Agents Break Workflows Disconnected agents can create workflow friction when they do not share the same content context. For example, a writing assistant may generate copy, a localization tool may adapt it, and an approval workflow may review it, but if these systems do not exchange context, people still need to coordinate the handoffs manually. 3. How Agents in AEM Support the Content Supply Chain AI agents can support content operations by helping teams reduce repetitive manual work across discovery, optimization, adaptation, and workflow execution. In the AEM ecosystem, this direction is reflected in Agents in AEM, which Adobe describes as capabilities designed to automate tasks, streamline workflows, and help orchestrate changes in AEM as a Cloud Service and Edge Delivery Services. The value is not full autonomy. The value is better coordination between people, content, assets, workflows, and delivery systems. Agents can help with specific tasks, while humans remain responsible for strategy, creative judgment, governance, and final approval. 3.1 Supporting the Content Supply Chain with Agent-Assisted Workflows An agentic content supply chain is not only about generating text. It is about using AI agents to support different stages of content operations, such as finding relevant assets, refining content, creating channel-ready variations, preparing assets for specific digital channels, and helping teams execute repeatable workflow steps. In AEM, the Content Advisor Agent is especially relevant here. Adobe describes it as helping users discover, refine, and adapt assets through natural language instructions. It can support discovery across Assets, Content Fragments, and Adaptive Forms, and it can help prepare channel-ready variations by generating renditions, adjusting visual properties, changing backgrounds, or preparing assets for specific digital channels. 3.2 Content Adaptation and Channel-Ready Variations Instead of describing agentic CMS as fully automated personalization, it is safer to think about content adaptation. AI agents can help teams prepare content or assets for different channels, formats, and use cases, especially when the content foundation is already structured, governed, and supported by clear metadata. This is where agentic workflows can reduce repetitive content work without removing human control. Teams can use AI-assisted capabilities to accelerate preparation and adaptation, while reviewers still validate quality, brand alignment, and business context before content is published or activated. 3.3 Human-in-the-Loop Workflows and Oversight Agent-assisted workflows still need human oversight. Adobe’s agentic content supply chain framing emphasizes human-led, agent-accelerated systems, where agents support execution but people remain responsible for review, approvals, and governance. In practice, this means AI agents can help with repetitive drafting, formatting, asset preparation, or routing tasks, while designated reviewers confirm whether the output is accurate, on brand, and ready for use. This balance helps teams reduce manual coordination while keeping decision-making and accountability clear. 4. Key Capabilities Behind Agentic CMS Workflows in AEM Evaluating agentic CMS concepts requires looking beyond isolated AI features. The most important question is how well AI agents can work with content, assets, governance rules, permissions, and delivery workflows inside the broader content platform. 4.1 AI-Assisted Content Creation and Adaptation Agentic CMS workflows should support more than one-off text generation. They should help users discover, refine, and adapt content or assets for specific needs while keeping people responsible for quality, context, and final decisions. 4.2 Governance, Guardrails, and Human Review Agentic workflows need clear governance. AI agents should operate within defined permissions, metadata standards, brand guidelines, and review processes. This helps teams keep AI-assisted content work connected to the same governance model used for human-created content. Strong guardrails can support consistency in tone, visual identity, asset usage, and workflow routing, but they should not remove human accountability. In enterprise environments, reviewers still need to validate accuracy, brand fit, legal context, and publishing readiness before content is activated. 4.3 Connected Architecture and Fast Delivery Agentic CMS workflows work best when agents can operate within a connected content environment instead of sitting beside the CMS as isolated tools. This means they should be able to work with structured content, digital assets, workflows, permissions, and delivery systems in a coordinated way. In AEM, this direction is reflected in Agents in AEM, AEM as a Cloud Service, and Edge Delivery Services. Together, these capabilities support a model where agents can assist with content operations while the platform continues to provide the structure, governance, and delivery foundation enterprise teams need. 5. How Adobe Experience Manager Supports Agentic Content Workflows In the Adobe ecosystem, Agentic CMS is best understood through the capabilities Adobe is building into AEM, including Agents in AEM, AEM as a Cloud Service, Edge Delivery Services, and AI-assisted workflows for content discovery, optimization, modernization, and delivery. 5.1 Agents in AEM and AI-Assisted Content Operations The most relevant AEM capabilities for agentic content workflows are Agents in AEM. Adobe describes these agents as capabilities available in AEM as a Cloud Service and Edge Delivery Services that can accelerate content creation and help orchestrate changes. Alongside the Content Advisor Agent discussed earlier, Adobe also describes the Brand Experience Agent, which includes specialized agents for modernization, production, and development tasks. Together, these capabilities point toward agent-assisted content operations where AI supports execution while people guide strategy, quality, and approval. 5.2 Edge Delivery Services and Faster Content Delivery Edge Delivery Services play a delivery role in the broader AEM environment where agentic workflows are becoming available. They support modern, high-performance content delivery patterns, while workflow orchestration depends on the specific agents, governance model, content structure, and review processes used in AEM. 6. How TTMS Can Help You Move Toward Agentic CMS Workflows Moving toward agentic CMS workflows does not have to mean replacing your current content setup all at once. In the AEM ecosystem, a safer approach is to start with clear, well-governed use cases where AI agents can support repetitive content tasks while people remain responsible for strategy, quality, and approval. This is where we can help. We support organizations in assessing where Agents in AEM, AEM as a Cloud Service, Edge Delivery Services, structured content, metadata, and governance can work together to improve content operations. Adobe describes Agents in AEM as capabilities that can automate tasks, streamline workflows, and help orchestrate changes in AEM environments. If your team is exploring Agentic CMS in the context of AEM, we can help you define the right starting point, prepare the governance model, and build a practical roadmap for human-led, agent-assisted content workflows. Contact us now. 7. Frequently Asked Questions About Agentic CMS What’s the difference between an agentic CMS and a traditional headless CMS? A headless CMS separates content from presentation, while an agentic CMS concept adds AI agents that can support content tasks such as discovery, optimization, adaptation, and workflow execution. In the AEM ecosystem, this idea is reflected in Agents in AEM, which Adobe describes as capabilities that help automate tasks and streamline workflows in AEM as a Cloud Service and Edge Delivery Services. Is agentic CMS the same as agentic AI? No. Agentic AI is a broader concept referring to AI agents that can help plan and execute tasks. Agentic CMS applies that idea specifically to content operations, where agents support content workflows, assets, governance, and delivery processes. How does an agentic CMS improve content governance? Agentic CMS workflows can support governance by keeping AI-assisted tasks connected to permissions, metadata, review steps, and approval processes. Adobe’s agentic content supply chain framing emphasizes human-led, agent-accelerated workflows, so people remain responsible for oversight and final decisions. Can smaller organizations benefit from agentic CMS, or is it only for large enterprises? Yes, but the value depends on content complexity, governance needs, and workflow maturity. Smaller teams can start with focused use cases, such as asset discovery, content updates, or channel-ready variations, before expanding agent-assisted workflows more broadly. How does AEM support agentic content workflows? AEM supports this direction through Agents in AEM, AEM as a Cloud Service, Edge Delivery Services, and AI-assisted workflows for content discovery, optimization, modernization, and delivery. Adobe describes agents such as the Content Advisor Agent and Brand Experience Agent as capabilities that help users discover, refine, adapt, and update content while keeping human oversight in place.

Wiktor Janicki

We hereby declare that Transition Technologies MS provides IT services on time, with high quality and in accordance with the signed agreement. We recommend TTMS as a trustworthy and reliable provider of Salesforce IT services.

Julien Guillot Schneider Electric

TTMS has really helped us thorough the years in the field of configuration and management of protection relays with the use of various technologies. I do confirm, that the services provided by TTMS are implemented in a timely manner, in accordance with the agreement and duly.

Let’s talk about how TTMS can help.

Monika Radomska

Sales Manager

Cybersecurity After a Data Breach. Why Backup Alone Is Not Enough

1. A data breach and data loss are different risks

1.1 Double extortion changes the role of backup

2. Lessons from major data breaches for businesses in Poland

3. When backup genuinely protects the business

4. How backup replication archiving and disaster recovery differ

4.1 Define RPO and RTO in business terms

4.2 Example of a sales system and a monthly archive

5. Why backup alone cannot stop a data breach

6. How to build resilient backups with the 3-2-1-1-0 rule

7. An untested backup is only an assumption

8. The first 24 hours after an incident

9. Supplier security as part of corporate cybersecurity

9.1 Why a SaaS provider may not deliver complete backup coverage

10. Building cyber resilience beyond backup

10.1 A short organizational checklist

11. How TTMS helps organizations prepare for incidents

FAQ

Does backup protect a company from a data breach?

How often should a company test data recovery?

Is cloud backup sufficient?

Is the 3-2-1-1-0 rule a legal requirement?

Where should an organization begin its resilience assessment?

Recommended articles

TTMS blog – the world through the eyes of IT experts

Cybersecurity After a Data Breach. Why Backup Alone Is Not Enough

Limitations of AI in Legal Software: Risks of Incorrect Advice, Defective Court Filings and Missed Deadlines

Global Employee Training: 2026 Strategies That Work

What Can GPT DO in 2026 That It Couldn’t Do in 2025?

Legal AI in EU and the UK: Key Risks and Limitations in 2026

Agentic CMS in 2026: How AI Agents Are Changing the Content Supply Chain

Ready to take your business to the next level?

Let’s talk about how TTMS can help.

Monika Radomska