Software quality evidence is not the same thing as a testing programme, and the difference is what the first serious supervisory review tends to expose. Most regulated financial institutions have QA engineers, test suites, CI/CD pipelines and dashboards that show green. Far fewer have evidence.
Choosing a nearshore Portugal partner used to be a conversation about rates, time zones and English proficiency. In 2026 a fifth criterion appears in RFPs from regulated sectors with growing regularity: whether the development partner operates under the same regulatory framework as the client.
Becoming a EUDI Wallet relying party is the part of eIDAS 2.0 that lands on engineering teams, and it is the part that has had the least attention. By 24 December 2026, every member state must make a compliant European Digital Identity Wallet available to its citizens and residents.
The EU AI Act’s enforcement date was August 2, 2026. Most of the coverage this week focused on what was delayed: the postponement of the high-risk obligations for employment decisions, credit scoring, and access to public services to December 2027.
From 11 September 2026, every software manufacturer selling into the EU has to report an actively exploited vulnerability within 24 hours of becoming aware of it. Not 24 business hours. Twenty-four hours.
When a QA team at a bank evaluates AI testing tools, the conversation tends to start with the same set of questions that any engineering team would ask: how many test cases does it generate, how accurate is the generation, how well does it handle test maintenance, what frameworks does it support. These are legitimate questions. They’re also the wrong starting point, because they treat the problem of AI-assisted QA at a regulated financial institution as though it were the same problem as AI-assisted QA at a SaaS startup. It isn’t.
Every EU member state must make a compliant European Digital Identity Wallet available by 24 December 2026, and regulated companies must accept it twelve months later. This guide covers what organisations have to decide, build and register before those dates, written from the perspective of a team that has maintained national eID middleware since 2011.
DORA requires financial institutions to demonstrate operational resilience to supervisors, not simply to run tests. This article covers what QA teams at banks actually have to produce as evidence, which DORA articles govern it, and where most testing programmes fall short when a supervisory review arrives.
Two days. Dozens of conversations. One consistent theme: the distance between policy ambition and operational reality is still significant and the organisations closing that gap are the ones worth watching.
In 2026, the Cyber Resilience Act (CRA) is no longer a future deadline, it is the operational reality for every organization in the European market. With mandatory security requirements for products with digital elements, compliance has shifted from a “nice-to-have” to a fundamental license to operate.