Engineering

What a general-purpose AI model provider owes regulators under Annex XI versus downstream integrators under Annex XII, where the open-source carve-out stops and why GPAI penalties sit in Article 101, not Article 99.

Verification of Payee is two jobs in one build, and the scheme treats them very differently. The requesting side is a specified round trip with a five second envelope and a discard rule. The responding side is a specified message shape wrapped around a decision the scheme declines to make, in a guidance document that says it is not part of the Rulebook and that the responder is free to ignore. This walks the message lifecycle position by position, states each one twice and closes each one on the contract both sides owe.

RWA compliance controls mapped duty by duty to the specific smart-contract mechanism that enforces it, from ONCHAINID identity registries and jurisdiction gates to Rule 144 lockups, investor caps, sanctions screening and forced transfer, plus the MiFID II vs MiCA boundary that decides which EU rulebook applies.

How to classify an AI system as high-risk under Article 6 and Annex III of the EU AI Act after the Digital Omnibus, with the new 1a to 1c carve-outs, a decision tree and worked examples.

A real LLM observability cost model built from verified vendor pricing retrieved 2026-08-08, showing why Langfuse, LangSmith, Braintrust and Arize cannot be compared on list price alone and how the OpenTelemetry GenAI conventions' Development status quietly breaks naive cost attribution.

The EPC's 15 November 2026 inter-PSP settlement date and Swift's 14 November 2026 SR 2026 go-live are two different events on one cutover weekend. This walks an address population through seven gates, from scope to the inter-PSP double rejection duty, and states at each gate which records die and what the remedy is.

What Article 50 of the EU AI Act actually requires for marking AI-generated content, the two mandatory layers, the transitional date hidden in Article 111(4) and the failure modes the Code of Practice admits marking cannot survive.

A company that is at once a CRA manufacturer, a NIS2 essential or important entity and a DORA financial entity keeps three separate reporting duties on three separate filings, even where two of them reach the same national CSIRT. The CRA's Single Reporting Platform consolidates filings within the CRA itself and does not fold NIS2 or DORA into that filing.

The CRA's Single Reporting Platform is a web form and case management system that ENISA runs, not an API, with no published roadmap for one. Registration runs through named individual Assigned Representatives, and one notification record moves through three stages that lock for good once the final report is submitted.

MiCA describes an accounting outcome for an e-money token and almost never a mechanism. This follows one euro through the licence gate, the mint, placement, circulation, the redemption request, burn and attestation, states which of those steps the Regulation actually specifies and names the two places where it specifies nothing at all.

Architecture decision records governance covering the advice process versus central review boards, fitness functions that enforce decisions in CI and how to run ADR reviews and lifecycle without turning into paperwork.

A spec-current guide to MCP server development after the 2026-07-28 revision, covering the stateless protocol change, the modern-vs-legacy split, server primitives, transports, authorization and the named security failure modes, plus what a server actually costs to build and maintain.

The European Commission's MiCA review consultation, launched 20 May 2026 under Articles 140 and 142, with responses due 30 September 2026. What the questionnaire actually asks across stablecoins, CASP prudential and reporting rules, DeFi, staking, lending and perpetual futures, what it stays silent on and what each area would change in the systems we build.

Annex IV of the EU AI Act translated point by point into engineering deliverables, plus the logging and retention duties in Article 12, Article 19 and Article 26 and the unconfirmed SME simplified-documentation route.

Crypto AML rule tuning covering the ATL/BTL threshold-testing lifecycle, a hedged sub-1 percent SAR-conversion retirement signal, the back-test gate before a threshold ships and what MiCA vs the incoming AMLR actually require of CASP transaction monitoring.

A CASP wind down plan is required by MiCA Article 74 and defined by almost nothing else in the act: no paragraph numbering, no recital, no technical standard, no filing duty and no deadline. What MiCA does supply is two conflicting destinations for client assets, a transfer to a successor provider under Article 64(8) and a return to the client under Article 75(6), and it never says which one runs. This article walks the wind-down in execution order, from the duties that have to be standing before any exit decision through trigger, freeze, client instruction, execution, sub-custody unwind and register closeout, and it is honest about the three different timing formulas MiCA writes for cessation, none of which is a number.

Crypto transaction monitoring for EU CASPs covering KYT versus KYC, webhook and polling integration patterns, reorg-safe verdict caching, whale-wallet pagination limits, account abstraction edge cases and the EU regulatory requirements that make it mandatory.

Before a single attribute can be requested from an EUDI Wallet, the business behind the
integration has to be a registered relying party in the Member State where it is established.
This is what that registration involves, what it permanently constrains and what happens when
it is refused or withdrawn.

Booking engine development for a flights-first product: what happens at search, price, hold, order and ticket, where each state fails and recovers and when to build against a self-service aggregator versus license or white-label instead.

On 18 February 2026, nearly nine months after the question was submitted, the European Commission answered ESMA Q&A 2552: crypto-assets without an identifiable issuer sit outside MiCA Title II, so no white paper is required and Article 5(2) does not bind the platforms that list them. The answer that underpins Bitcoin and Ether listings across the EU is an administrative Q&A interpreting a recital, and neither is binding law. We trace what the Q&A actually says, what it leaves standing and what an engineering team builds around a determination that can be challenged years later.

The first decision in an EUDI Wallet integration is not which vendor to buy. It is which credential format you accept, because one route keeps the whole build inside specifications the framework itself sets requirements out from and the other puts an ISO standard your team has to obtain separately on the critical path.

The engineering decision underneath MiCA custody: MPC threshold signatures, HSM tamper-response hardware and on-chain multi-sig compared on single-point-of-failure resistance, auditability, recovery, cost and chain-agnosticism, with a cold/warm/hot tiering pattern and key ceremony, rotation and disaster-recovery design notes.

Payment gateway integration cost in 2026: third-party, orchestration and custom gateway pricing, PCI DSS scope, timelines and how to choose the right path.

DORA Threat-Led Penetration Testing (TLPT) for crypto firms mapped provision by provision: the Article 26(8) designation gate that decides which CASPs owe TLPT at all, how it differs from ordinary Article 25 testing, the ECB TIBER-EU phases behind it, tester requirements under Article 27 and the evidence a regulator expects afterward.

A data study of the ESMA CASP register built from our own raw-CSV parse: 295 active authorization records as of 20 July 2026, 70% custody-authorized, the parsing error that undercounted custody by 17 records, the June 2026 authorization spike and what happened to firms that missed the deadline.

ESMA's 8 July 2026 Common Supervisory Action on custody, the six focus areas ESMA itself named, the DORA read-across, attributed commentary from Latham & Watkins and the MiCA Crypto Alliance and the engineering evidence a custody-authorized CASP should have ready, mapped to MiCA Article 75 and DORA obligations.

Smart contract risk in crypto custody is the one ESMA Common Supervisory Action scope item with no settled evidence practice behind it. This article treats each claim a CASP makes about its contracts as a claim under test, and names the artefact that proves or falsifies it: how upgrade privilege is proven on chain and revoked, what a proxy admin key does to an Article 75(7) segregation argument, what a staking contract does to the register of positions and what 130 audits say about where the critical findings actually cluster.

Multi-tenant SaaS architecture covering the silo, pool and bridge tenancy models, the shared control plane, cost per active user, cell-based blast radius and shuffle sharding for noisy neighbors.

Fitness app development in 2026: workout tracking, wearables, gym management and AI coaching types, build vs buy, costs and timelines by scope.

Tokenized real estate regulations across the US, EU, Dubai and Australia, covering which regulator, which legal wrapper and which exemption or regime applies in each jurisdiction and what that means for a platform build.