Every member state must run an AI regulatory sandbox by 2 August 2026. Here is what an AI Act sandbox actually gives a novel high-risk system, and when it is worth applying.
The GDPR Procedural Regulation standardises how data protection authorities handle cross-border complaints from April 2027. Here is what the compressed timelines and higher evidence bar mean in practice for a DPO.
Businesses can issue attestations such as membership, licence or employment into users’ EUDI Wallets, but the qualified route means becoming a trust service provider. Here is what the QEAA path actually commits you to.
The Retail Investment Strategy makes value-for-money a data problem: cost, performance and peer positioning you must evidence with reproducible lineage, not assertions.
The Commission’s SFDR review swaps Article 8/9 for named product categories judged on portfolio thresholds and exclusions. Re-classification is a data problem, not a marketing one.
Verification of Payee is a fuzzy-matching, latency-bound service returning match, close-match or no-match inside the payment flow. The matching logic and false-positive rate are the real engineering problem.
CRR3 re-plumbs COREP: the output floor and revised credit, market and operational risk weights are a calculation and data problem, not a template tweak. Fix the RWA engine, not the mapping.
The revised EU GMP Annex 11 modernises expectations around data integrity, audit trails, cloud and AI. Map your validation estate against the 2025 draft before adoption lands the remediation backlog.
Always-on instant settlement removes the overnight buffer treasury relied on. The technology consequence of the IPR is intraday liquidity monitoring and automated funding, not just faster payments.
The PSD3/PSR provisional agreement locks enough scope to begin building. A practitioner’s guide to the 2026-2027 timeline and the engineering workstreams to open before the final text lands.