Five things changed. Keys moved from RSA to ECDSA. Contactless reading arrived over ISO/IEC 14443, protected by the PACE protocol. A six-digit CAN code was introduced for contactless access. The chip contacts moved to the back of the card. And there is no API that tells you which version is in front of you.
Eleven sectors are named in Article 5f(2) of the eIDAS Regulation as amended: transport, energy, banking, financial services, social security, health, drinking water, postal services, digital infrastructure, education and telecommunications. The deadline is 24 December 2027.
Because extraction is the easy part. What separates a demonstration from a production system is disambiguation, meaning knowing that three different spellings are the same entity and that two identical spellings are not, and knowing when the model should refuse to answer rather than risk it.
Every few months, we get the same question: can we authenticate users with the Portuguese Citizen Card directly in our own application? Yes. The official middleware is open source and supports the Cartão de Cidadão, Chave Móvel Digital and professional attribute certification.
Software quality evidence is not the same thing as a testing programme, and the difference is what the first serious supervisory review tends to expose. Most regulated financial institutions have QA engineers, test suites, CI/CD pipelines and dashboards that show green. Far fewer have evidence.
When a QA team at a bank evaluates AI testing tools, the conversation tends to start with the same set of questions that any engineering team would ask: how many test cases does it generate, how accurate is the generation, how well does it handle test maintenance, what frameworks does it support. These are legitimate questions. They’re also the wrong starting point, because they treat the problem of AI-assisted QA at a regulated financial institution as though it were the same problem as AI-assisted QA at a SaaS startup. It isn’t.
DORA requires financial institutions to demonstrate operational resilience to supervisors, not simply to run tests. This article covers what QA teams at banks actually have to produce as evidence, which DORA articles govern it, and where most testing programmes fall short when a supervisory review arrives.
Building Qualigentic forced us to be precise about what actually shifts when AI enters the testing workflow — not what gets automated, but what gets rethought. That’s what we’re sharing here.
There is a version of the software quality conversation that most engineering teams have had many times. It goes roughly like this: testing coverage is too low, the QA process is too slow, the tools aren’t integrated well enough, and something needs to change before the next release. That conversation is useful as far as it goes.
Shift-left testing has been an ambition for a decade and rarely a reality, because writing tests early costs more than teams can absorb. Agentic AI changes that arithmetic. This article covers how Qualigentic generates and maintains test suites from requirements, and what shifts when tests stop being a bottleneck.