Engineering

NIS2 puts two different filings behind one word. Member States build the list and require entities to submit identifying information for it, on a two-week update clock, while a narrower set of digital entity types files a longer record with its national authority, corrects it on a three-month clock and has it forwarded to ENISA without its IP ranges. This guide separates the two, marks who is bound by each, and shows what national portals add on top.

NIS2 contains no prohibition on outsourcing any security measure, so the real question is which parts of Article 21 the market can supply and which acts sit with management bodies under Article 20 and the implementing regulation rather than with a provider. A decision guide for an entity whose scope is already settled, covering the supply chain duty that buying anything creates and the evidence a supervisory authority asks the entity, not the vendor, to produce.

Hotel channel manager integration as a catalog of failure modes: ARI drift, overbooking from inventory races, rate and room mapping errors, reservation desync and the certification gates standing between a connector and a live OTA channel.

A wallet user taps erase and what reaches you is a GDPR Article 17 request. This is the boundary between the wallet's machinery and the controller's own obligations, the one-month clock the recital's word immediate does not shorten, and the refusal path most build estimates miss.

A wallet-presented SCA Attestation is an OpenID4VP presentation carrying transactional data, and TS12 states that its verified jti claim serves as the Authentication Code PSD2 requires for electronic payments. This guide walks a payment service through the processing order: reading type metadata, signing and encrypting the request, surviving the locale check, verifying the Key Binding JWT and gating on the amr array. Written throughout as a second acceptance path alongside an existing implementation, never as a replacement for one.

AI travel agent development for an OTA, TMC or booking platform: what a tool-calling agent can and cannot book today, how it stays grounded on live inventory, the guardrails a mis-booking risk requires and an evaluation protocol before launch.

The crypto-asset white paper under MiCA Title II is a disclosure document nobody approves and whose content the offeror is solely responsible for. This guide sets out who must draw one up and who is exempt from precisely which obligations, what Annex I forces into the document, the Inline XBRL format rule and its application date, and the notification, publication, modification and withdrawal clocks that run around it.

An item-by-item walkthrough of the MiCA CASP authorization file: the nineteen points of Article 62(2), what Delegated Regulation (EU) 2025/305 adds on top of them, the annex form and contact point set by the implementing regulation, and the completeness and assessment periods stated as rules rather than as a countdown.

The MiCA transitional period was over everywhere by 1 July 2026, earlier in Member States that shortened it. A third-country crypto firm serving EU clients without a CASP authorization now has exactly one legal basis left, Article 61 reverse solicitation, and two years of ESMA guidance have narrowed it to a keyhole. We work through the statute, the 26 February 2025 guidelines, the broker-model opinion on routing and letter-box entities and ESMA's freshest compliance table dated 10 July 2026, which shows Poland and Romania still without a designated authority for these guidelines ten days after grandfathering ended. Then we cover what an engineering team actually builds to prove a client showed up on its own.

Tour operator software development as a phased migration off a legacy reservation system: supplier contracting, allotments and release rules, quotes and vouchers, data cutover and what the Package Travel Directive, both the 2015 text and the 2026 amendment, requires the platform to encode.

VASP is a supervisory label that appears nowhere in EU legislation, used by national regulators for firms on the anti-money-laundering registers the Fifth Anti-Money Laundering Directive required. CASP is an authorization under MiCA Title V with a defined service list and an EU passport. This guide sets the entity-level regimes side by side, including the electronic money institution license and the Article 60 notification route that removes the need for a CASP application for seven categories of already-licensed institution.

MiCA custody requirements mapped provision by provision: Article 70's safekeeping baseline for every CASP, Article 75's nine-paragraph custody rulebook, the three-limb segregation test, the liability cap at market value at time of loss and the evidence a CASP should have ready for each obligation.

NDC API integration for a flight-booking platform: the Offer and Order message set message by message, aggregator versus direct connect, servicing after the sale and what IATA's own capability program actually measures.

Article 30 of the EU Data Act splits a switching duty by capability, not by service-model label, and Article 2(37) defines functional equivalence in law while no published standard operationalises it into a threshold. This article works through the exemption gate, the export inventory beyond raw data and the escrow-and-rebuild record that stands in for the missing standard, including the correction most coverage misses: 12 January 2027 zeroes switching charges, not multi-cloud egress.

A tokenized fund runs two books, the ledger the token moves on and the shareholder register a transfer agent maintains, and three published regimes now say which one wins when they disagree, in two opposite directions. None of them says how anyone learns the two diverged, at what cadence or where the investor stands between a bad entry and its reversal.

The AI Act defines a serious incident in four alternative limbs and attaches three different reporting deadlines to them, and since 27 July 2026 the recipient of the report depends on who supervises the provider.

How the EU AI Act and DORA land on the same financial entity without either text citing the other, why Article 74(6) puts the AI file on the financial supervisor's desk, and what Articles 26(5), 26(6), 72(4) and 73(9) actually change.

Article 27 of the AI Act puts the fundamental rights impact assessment on the deployer, names creditworthiness and life and health insurance pricing explicitly, and since July 2026 lets it cross-reference an existing data protection impact assessment.

What Article 72 of the EU AI Act requires of a post-market monitoring system and plan, why the mandatory Commission template was repealed before it ever appeared, and what telemetry, logging and retention an engineering team has to build to make the plan real.

Which conformity assessment procedure applies to a high-risk AI system under Article 43, why Annex III point 5 credit and insurance systems take the Annex VI internal control route with no notified body involved, and what evidence a self-assessment has to produce and keep.

A RAG corpus is a live system with state, not a build artifact. This piece traces one document through arrival, change, duplication, deletion and embedding model migration, and shows where five major vector stores document contradictory answers to the same event.

A dated EU AI Act compliance timeline and applicability map after Regulation (EU) 2026/1744, covering what changed in Article 113, Article 6 and Article 50 and why EUR-Lex, the Commission's AI Act tool and the most-cited third-party tracker still show the pre-amendment rules.

CASP license cost broken down per EU country: national regulator fees from Latvia's EUR 2,500 to Malta's EUR 25,000, MiCA's EU-wide capital floors, market total-setup estimates, the Poland no-license-window trap and passporting under Article 65.

Stablecoin payment API selection for CTOs and engineering leads: orchestration vs issuance API compared, a six-provider landscape table and the custody, licensing and off-ramp criteria that actually decide the pick.

PSD3 and PSR compliance is an offset from an unset anchor, not a calendar date. The 21 and 27 month tiers, sourced from the Council's April 2026 compromise texts, and what a build has to have ready before either clock starts.

NIS2 never names a software company as a regulated type. This piece sorts a software vendor into the route that actually applies, then lists the artifacts each route asks it to keep on a shelf.

The European Accessibility Act never names WCAG or EN 301 549. This piece sorts a software company into the role that actually carries liability, and states plainly why the standard everyone cites carries no legal presumption here.

Person identification data guarantees five fields and marks fourteen more optional, and a mandatory field may carry a substituted value where the real one is unknown. What an onboarding flow can and cannot assume from a wallet presentation.

PoC vs MVP vs prototype explained as three different questions rather than three sizes of the same build, with real cost ranges and a decision framework for which to build first.

The Cyber Resilience Act never defines severe as a standalone term. The threshold sits in Article 14(5), narrowing the general incident definition to sensitive or important data or functions, or to malicious code, while Article 3(42) sets a separate evidentiary bar for actively exploited that a high severity score alone does not meet.