Pillar 13 · Evolve
A single landscape view of the EU digital rulebook now in force or phasing in – DORA, the AI Act, NIS2, the CRA, the Data Act and MiCA – showing where obligations overlap and where one control set covers several regimes.
By late December 2026 every EU member state must make the EU Digital Identity Wallet available. Whether you accept it as a relying party is a decision — make it before your competitors turn it into a feature.
The amended CSDR settlement discipline rules bite on 7 December 2026, ten months before EU T+1 go-live. Allocation and confirmation by 23:00 CET on trade date becomes a hard obligation. Here is the one thing to fix first.
PSD3 collapses the e-money and payment-institution regimes into one. The merger reaches into safeguarding architecture, capital treatment and the systems of record that still assume the two are different.
The Central Bank of Ireland collects the DORA Register of Information on a defined annual cadence. Here is a validate-and-submit pipeline that catches the format and business-rule errors internally, before the supervisor’s portal does.
PSD3 and the PSR will reshape authorisation, fraud liability, SCA and open-banking APIs. The final text isn’t out, but the direction is settled enough to start the no-regret build now.
VARA’s activity-specific rulebooks set granular technology, custody and market-conduct control expectations. A Dubai VASP has to map each one to system evidence a supervisor can inspect, not a policy statement.
The RBNZ’s Deposit Takers Act standards phase in to December 2028. This reads the regime as a technology and data problem: resilience evidence, reporting cadence, and the depositor data every institution now has to be able to produce.
GDPR DPIAs, AI Act FRIAs and CRA product risk assessments share most of their structure. One risk-assessment engine can capture the common inputs once and emit the specific artefact each regime expects.
Every member state must run an AI regulatory sandbox by 2 August 2026. Here is what an AI Act sandbox actually gives a novel high-risk system, and when it is worth applying.