Engineering

VASP is a supervisory label that appears nowhere in EU legislation, used by national regulators for firms on the anti-money-laundering registers the Fifth Anti-Money Laundering Directive required. CASP is an authorization under MiCA Title V with a defined service list and an EU passport. This guide sets the entity-level regimes side by side, including the electronic money institution license and the Article 60 notification route that removes the need for a CASP application for seven categories of already-licensed institution.

MiCA custody requirements mapped provision by provision: Article 70's safekeeping baseline for every CASP, Article 75's nine-paragraph custody rulebook, the three-limb segregation test, the liability cap at market value at time of loss and the evidence a CASP should have ready for each obligation.

NDC API integration for a flight-booking platform: the Offer and Order message set message by message, aggregator versus direct connect, servicing after the sale and what IATA's own capability program actually measures.

Article 30 of the EU Data Act splits a switching duty by capability, not by service-model label, and Article 2(37) defines functional equivalence in law while no published standard operationalises it into a threshold. This article works through the exemption gate, the export inventory beyond raw data and the escrow-and-rebuild record that stands in for the missing standard, including the correction most coverage misses: 12 January 2027 zeroes switching charges, not multi-cloud egress.

A tokenized fund runs two books, the ledger the token moves on and the shareholder register a transfer agent maintains, and three published regimes now say which one wins when they disagree, in two opposite directions. None of them says how anyone learns the two diverged, at what cadence or where the investor stands between a bad entry and its reversal.

The AI Act defines a serious incident in four alternative limbs and attaches three different reporting deadlines to them, and since 27 July 2026 the recipient of the report depends on who supervises the provider.

How the EU AI Act and DORA land on the same financial entity without either text citing the other, why Article 74(6) puts the AI file on the financial supervisor's desk, and what Articles 26(5), 26(6), 72(4) and 73(9) actually change.

Article 27 of the AI Act puts the fundamental rights impact assessment on the deployer, names creditworthiness and life and health insurance pricing explicitly, and since July 2026 lets it cross-reference an existing data protection impact assessment.

What Article 72 of the EU AI Act requires of a post-market monitoring system and plan, why the mandatory Commission template was repealed before it ever appeared, and what telemetry, logging and retention an engineering team has to build to make the plan real.

Which conformity assessment procedure applies to a high-risk AI system under Article 43, why Annex III point 5 credit and insurance systems take the Annex VI internal control route with no notified body involved, and what evidence a self-assessment has to produce and keep.

A RAG corpus is a live system with state, not a build artifact. This piece traces one document through arrival, change, duplication, deletion and embedding model migration, and shows where five major vector stores document contradictory answers to the same event.

A dated EU AI Act compliance timeline and applicability map after Regulation (EU) 2026/1744, covering what changed in Article 113, Article 6 and Article 50 and why EUR-Lex, the Commission's AI Act tool and the most-cited third-party tracker still show the pre-amendment rules.

CASP license cost broken down per EU country: national regulator fees from Latvia's EUR 2,500 to Malta's EUR 25,000, MiCA's EU-wide capital floors, market total-setup estimates, the Poland no-license-window trap and passporting under Article 65.

Stablecoin payment API selection for CTOs and engineering leads: orchestration vs issuance API compared, a six-provider landscape table and the custody, licensing and off-ramp criteria that actually decide the pick.

PSD3 and PSR compliance is an offset from an unset anchor, not a calendar date. The 21 and 27 month tiers, sourced from the Council's April 2026 compromise texts, and what a build has to have ready before either clock starts.

NIS2 never names a software company as a regulated type. This piece sorts a software vendor into the route that actually applies, then lists the artifacts each route asks it to keep on a shelf.

The European Accessibility Act never names WCAG or EN 301 549. This piece sorts a software company into the role that actually carries liability, and states plainly why the standard everyone cites carries no legal presumption here.

Person identification data guarantees five fields and marks fourteen more optional, and a mandatory field may carry a substituted value where the real one is unknown. What an onboarding flow can and cannot assume from a wallet presentation.

PoC vs MVP vs prototype explained as three different questions rather than three sizes of the same build, with real cost ranges and a decision framework for which to build first.

The Cyber Resilience Act never defines severe as a standalone term. The threshold sits in Article 14(5), narrowing the general incident definition to sensitive or important data or functions, or to malicious code, while Article 3(42) sets a separate evidentiary bar for actively exploited that a high severity score alone does not meet.

What a general-purpose AI model provider owes regulators under Annex XI versus downstream integrators under Annex XII, where the open-source carve-out stops and why GPAI penalties sit in Article 101, not Article 99.

Verification of Payee is two jobs in one build, and the scheme treats them very differently. The requesting side is a specified round trip with a five second envelope and a discard rule. The responding side is a specified message shape wrapped around a decision the scheme declines to make, in a guidance document that says it is not part of the Rulebook and that the responder is free to ignore. This walks the message lifecycle position by position, states each one twice and closes each one on the contract both sides owe.

RWA compliance controls mapped duty by duty to the specific smart-contract mechanism that enforces it, from ONCHAINID identity registries and jurisdiction gates to Rule 144 lockups, investor caps, sanctions screening and forced transfer, plus the MiFID II vs MiCA boundary that decides which EU rulebook applies.

How to classify an AI system as high-risk under Article 6 and Annex III of the EU AI Act after the Digital Omnibus, with the new 1a to 1c carve-outs, a decision tree and worked examples.

A real LLM observability cost model built from verified vendor pricing retrieved 2026-08-08, showing why Langfuse, LangSmith, Braintrust and Arize cannot be compared on list price alone and how the OpenTelemetry GenAI conventions' Development status quietly breaks naive cost attribution.

The EPC's 15 November 2026 inter-PSP settlement date and Swift's 14 November 2026 SR 2026 go-live are two different events on one cutover weekend. This walks an address population through seven gates, from scope to the inter-PSP double rejection duty, and states at each gate which records die and what the remedy is.

What Article 50 of the EU AI Act actually requires for marking AI-generated content, the two mandatory layers, the transitional date hidden in Article 111(4) and the failure modes the Code of Practice admits marking cannot survive.

A company that is at once a CRA manufacturer, a NIS2 essential or important entity and a DORA financial entity keeps three separate reporting duties on three separate filings, even where two of them reach the same national CSIRT. The CRA's Single Reporting Platform consolidates filings within the CRA itself and does not fold NIS2 or DORA into that filing.

The CRA's Single Reporting Platform is a web form and case management system that ENISA runs, not an API, with no published roadmap for one. Registration runs through named individual Assigned Representatives, and one notification record moves through three stages that lock for good once the final report is submitted.

MiCA describes an accounting outcome for an e-money token and almost never a mechanism. This follows one euro through the licence gate, the mint, placement, circulation, the redemption request, burn and attestation, states which of those steps the Regulation actually specifies and names the two places where it specifies nothing at all.