Insights — RS Strategy

An RS Strategy publication

EU digital regulation, read before it lands on your desk.

Written for the people who have to act on these texts, not merely cite them.

See what's movingAssess your exposure

On the clock

The dates that reach you first, not the headline ones.

11 Sep 2026CRA vulnerability and incident reporting begins, for products already on the market.2 Aug 2026AI Act obligations for high-risk systems apply.By member stateNIS2 binds you on your country's transposition, not the EU date.

Start from your question

Does this even apply to me?Assess →Where do I start, and by when?Implement →How do I make it hold up under scrutiny?Go deeper →What's coming that I haven't seen yet?Stay Ahead →

Latest

Implement

Le CRA court déjà

L'échéance que visent la plupart des plans n'est pas la bonne. L'obligation qui vous atteint d'abord tombe quinze mois plus tôt.

CRA · 10 Jul 2026

Three ways to go further

ResourcesFree assessments, toolkits and the regulation tracker.La tech est politiqueThe premium brief. Regulation read as a political artefact.Work with RS StrategyAdvisory when orientation is no longer enough.

Who this is for

  • Security leads who have to operationalise these texts, not just log them.
  • General counsel and DPOs tracking obligations that differ across borders.
  • Product and compliance teams inside manufacturers now in CRA scope.
  • Policy and public-affairs people reading Brussels before it becomes law.

If one of these is already on your desk, you know where to start.

Work with RS Strategy