The Digital Operational Resilience Act (DORA) is vital for maintaining continuous financial services amidst technological failures. Effective implementation requires a comprehensive approach to ICT risk management, incident handling, testing, supplier oversight, and information sharing. Organisations must prioritise resilience as an ongoing cycle rather than a one-off compliance exercise to adapt to evolving risks.
The Netherlands will implement the Cyberbeveiligingswet (Cbw) on 15 August 2026, enforcing the NIS2 Directive to enhance cybersecurity for over 8,000 organisations across various sectors. Key responsibilities include registration, risk analysis, incident reporting, and management accountability, aimed at strengthening overall cyber resilience and integrating security measures into governance.
Italy’s Law 90/2024 combines operational cybersecurity duties with stronger cybercrime provisions. For covered public organisations, the message is immediate: detect quickly, report in stages and put accountable security leadership in place. Law No. 90 of 28 June 2024 was published…
France’s SREN law treats cloud exit as a market rule: switching fees, portability, interoperability and contract transparency are no longer matters that customers can safely postpone until migration day. Law 2024-449 on securing and regulating the digital space was published…
The European Digital Identity Framework is not simply a government login application. It creates a cross-border trust architecture for wallets, credentials and the organisations that request them. Regulation (EU) 2024/1183—the updated eIDAS framework—applied from 20 May 2024. It requires Member…
From 29 April 2024, consumer connectable products placed on the UK market became subject to three deceptively simple security requirements. The difficult part is proving that the whole supply chain meets them. The United Kingdom’s Product Security and Telecommunications Infrastructure…
The Digital Services Act, applicable from 17 February 2024, regulates intermediary services within the EU, imposing varying obligations based on service type and size. It mandates effective notice, classification, and moderation workflows while ensuring transparency in automated decision-making. Large platforms are held to higher standards, requiring systemic risk assessments and accountability measures.
Hungary’s 2023 whistleblower act combines employer channels with public-interest reporting and puts clocks around receipt, investigation and feedback. A mailbox without case orchestration is not enough. Act XXV of 2023 on complaints, public-interest disclosures and rules concerning whistleblowing took effect…
The Dutch Wegiz is a framework for turning selected exchanges of health information from optional digitisation projects into mandatory, standardised and potentially certified processes. The Wet elektronische gegevensuitwisseling in de zorg, known as the Wegiz, entered into force on 1…
The Netherlands’ Digital Government Act treats access to public services as a trust decision. The sensitivity of the service should determine the strength of the login—not the convenience of the existing portal. The Wet digitale overheid, or Wdo, began phased…
