DAC8 crypto-asset reporting applies from 1 January 2026 with first exchange by 30 September 2027. A practitioner’s guide to building and validating the CARF-aligned XML report in code.
IDD’s product oversight and governance duties are usually discharged as committee minutes. Encoded as tracked product-lifecycle data, they become demonstrable to a supervisor rather than anecdotal.
NIS2 registration is a self-identification duty, not an invitation. Work out scope by sector and size, register across the member states you serve, and understand what the filing discloses and commits you to before an authority names you first.
The DORA subcontracting RTS forces you to model the full chain supporting critical functions. That is a graph-data and monitoring problem, not a contract-review one.
The EAA is not just a website obligation. It reaches ATMs, ticketing machines, payment terminals, e-readers and mobile apps. Here is how to inventory the in-scope estate and what each device type actually demands.
The European Accessibility Act has applied since June 2025. How to wire WCAG 2.1 AA checks into CI so builds fail on violations, and how to define the manual-test residual automation cannot see.
DORA’s classification RTS gives quantitative thresholds for major incidents. Encode them as a decision engine so triage is deterministic, auditable and not a judgement call at 2am.
Recognised data altruism status under the EU Data Governance Act rests on engineering controls. Here is the consent ledger, access logging and security you must build to register defensibly.
First official IReF reporting is Q2 2031 with a 2030 pilot, and that distance breeds complacency. The semantic-model work that makes IReF cheap must start years earlier.
EHDS secondary use will require health-data holders to hand structured, described, quality-labelled datasets to the access bodies. The engineering for that is a multi-year programme, and it starts well before the 2029 obligations bite.