compliance · 18 min
The third step of Regulation (EU) 2024/1689 enters application on 2 August 2026: Annex III high-risk systems, FRIA, post-market monitoring, CE marking, EU register. The Commission's Digital Omnibus proposes pushing it to 2 December 2027, but the 28 April trilogue closes without agreement. What to have ready on 2 August if Brussels doesn't make it.
· Manuel López Pérez
compliance · 14 min
On 2 February 2026 the Regulation (EU) 2024/1689 prohibitions hit their first anniversary. Twelve months in, no national authority has published an Art. 5 sanction. AESIA closes 2025 with 16 guidelines but no public inspections. CNIL takes jurisdiction over workplace emotion recognition. Contact-centre vendors keep selling emotion. Operational recap of year one, no sermon.
· Manuel López Pérez
compliance · 15 min
On 17 January 2026 DORA marks a year of applicability. The ESAs designate 19 critical ICT providers in November 2025, the first TLPT cycle starts to land for 2026-2028, national authorities close the grace period and open active inspection. Operational table of what worked, what is missing, and what is required during 2026.
· Manuel López Pérez
compliance · 11 min
Second step of Regulation (EU) 2024/1689. Technical documentation, training data summary, copyright policy and, for systemic-risk models, adversarial evaluations and incident reporting. Code of Practice signed by 26 providers; Meta stays out, xAI signs Safety & Security only.
· Manuel López Pérez
compliance · 15 min
First real step of Regulation (EU) 2024/1689. On 2 February, the prohibitions on unacceptable practices and the AI literacy duty enter application. Table of the eight categories with article, real product affected and deadline, plus the Art. 5.2 exceptions and Art. 2 extraterritoriality.
· Manuel López Pérez
compliance · 14 min
On 17 January 2025 DORA enters application. It applies to banks, insurers, funds, fintechs, IORPs, MiCA-regulated CASPs, and to critical ICT third-party providers designated by the ESAs. Five pillars of obligations, TLPT every three years for important entities, ICT provider register, and lex specialis vs NIS2 for finance.
· Manuel López Pérez
compliance · 10 min
On 17 October 2024 the deadline to transpose Directive (EU) 2022/2555 expires. Spain reaches it without an approved law and without a draft bill cleared by the Council of Ministers. What is known about the national calendar, what obligations apply in the meantime via ENS and NIS1, and where the gaps are.
· Manuel López Pérez
compliance · 11 min
On 1 August the AI Act enters into force after OJEU publication on 12 July. Application is staggered: Art. 5 prohibitions at 6 months, GPAI at 12, high-risk Annex III at 24, Annex I products at 36. What a CISO/DPO needs to put in motion now.
· Manuel López Pérez
compliance · 5 min
After 38 hours of trilogue, Council and European Parliament close the political agreement on the AI Act on 9 December. Final technical text and OJEU publication (July 2024) still pending. What a CISO needs to note now.
· Manuel López Pérez
