Writing
Essays and short notes on keeping your product moving while you stay on the big lines.
Checklists and calendars to use on your own product: guides and tools
Accessibility
Selling to the public sector: the Web Accessibility Directive and accessibility statementsWhat the Web Accessibility Directive asks of public-sector websites and apps, and so of the products sold to them, in plain terms, with every legal fact linked to EUR-Lex. Not legal advice, and no compliance promise.
WCAG 2.2, for product leadersWhat WCAG 2.2 adds to 2.1, in plain terms, with the W3C source linked for every fact about the guidelines. Not legal advice, and no conformance promise.
The European Accessibility Act, for product leadersWhat the European Accessibility Act asks of digital products and services, in plain terms, with the source linked for every legal fact. Not legal advice, and no compliance promise.
Security
DORA, for product leaders who sell to banks and insurersWhat the Digital Operational Resilience Act asks banks and insurers to put in their contracts with software suppliers, in plain terms, with every legal fact linked to its article. Not legal advice.
A security contact your customers can findWhy a product should say where vulnerabilities are reported, and what security.txt and a coordinated disclosure policy are, with every source linked. Not legal advice, and no compliance promise.
The Cyber Resilience Act, for product leadersWhat the Cyber Resilience Act asks of products with digital elements, in plain terms, with the source linked for every legal fact. Not legal advice, and no compliance promise.
The OWASP Top 10, for product leadersThe current OWASP Top 10, the 2025 edition, in plain terms. What each of the ten categories means for a product, and the question a leader can ask their team about it.
Passwords and sign-in, by the NIST guidelines, for product leadersWhat NIST SP 800-63B-4 says about passwords and sign-in, in plain terms, each point linked to the section that says it. Length, periodic changes, breached passwords, a second factor.
When a customer asks for a software bill of materialsWhat a software bill of materials is, why buyers and the Cyber Resilience Act ask for one, and what a product leader should be able to answer, with every source linked. Not legal advice, and no compliance promise.
Privacy and data
The data processing agreement, for product leadersWhat Article 28 of the GDPR says a data processing agreement must contain, point by point, with every legal fact linked to EUR-Lex. Sub-processors and the standard clauses. Not legal advice.
When personal data leaks: GDPR Articles 33 and 34, for product leadersWhat Articles 33 and 34 of the GDPR ask after a personal data breach, in plain terms, with every legal fact linked to EUR-Lex. Who is told, how soon, and what the notice says. Not legal advice, and no compliance promise.
The right to erasure, for product leadersWhat Article 17 of the GDPR asks of a product, in plain terms, with every legal fact linked to EUR-Lex. When a person may ask, the exceptions, and the reply. Not legal advice, and no compliance promise.
The Data Act's cloud switching rules, for product leadersWhat the Data Act says about leaving a cloud service, in plain terms, with every legal fact linked to its article. The contract terms, the end of switching charges, the dates. Not legal advice.
Data protection by design, for product leadersWhat Article 25 of the GDPR asks of a product, in plain terms, with the source linked for every legal fact. What to collect, what to keep, who can see it. Not legal advice, and no compliance promise.
Cookie consent under the ePrivacy rules, for product leadersWhat Article 5(3) of the ePrivacy Directive asks before anything is stored on or read from a device, and what valid consent means under the GDPR, linked to EUR-Lex. Not legal advice.
Rebuilding and modernising
Retiring an API version: the Deprecation and Sunset headersWhat the two standard HTTP headers for an ending API say, in plain terms, with each fact linked to its RFC. The date you announce, the link to your notes, what partners see.
A framework end-of-life calendar for product leadersSupport end dates for five widely used web frameworks and runtimes, as of 18 October 2026, each linked to the project's own release page, and what end of life means for security fixes and hiring.
Is it time to rebuild? A checklist for product leadersFive questions that show whether a product has started to hold the business back, to answer about your own product. No score decides for you.
Rebuild or refactor? A decision guideFour questions that decide whether an ageing product should be changed in place or rebuilt, with one example of each from our own record.
Questions to ask before anyone touches your codebaseBefore an outside partner changes your product, four sets of questions settle most of what can go wrong later. Who owns the work, what they can reach, who says yes, and how you leave.
The cost of waiting: how to talk about technical debt with your boardA board does not fund a list of code problems. It weighs what each month of waiting costs the roadmap. How to describe debt in those terms, and what to ask in the room.
Leading the work
Hold the course when the loudest customer asks for a detourYour biggest customer asks for something nobody else needs, and a quiet yes can turn the product. How to listen, keep what is true in the request and still hold the course.
Judge the quarter by what shippedCounting what was started shows motion. Counting what reached customers shows progress. Three questions for the end of a quarter, and why the harvest is the honest measure.
The one-page brief: handing on a direction, not the detailsWhat a good one-page brief for a product direction holds, what it leaves out, and why a single page is enough for someone else to carry the direction well.
Saying no to the details: keeping the big lines in viewWhich decisions a product leader should keep, which details they can hand on, and why a short list of directions serves a product better than a long backlog.- What "done" means when you set directionA task closed is not a result delivered. How a leader can define done in terms of what changes for the customer, and why it makes every handoff easier.
- Lift your eyes: what a product leader should stop doingThe details a CTO or VP keeps carrying are rarely the ones only they can carry. A short argument for putting some of them down.
Lift your eyes and let us carry the rest.
Talk to us and see what carrying your product forward looks like.
Book a conversation
Prefer to write directly? contact@zefana.com