Compliance expertise by industry: DORA, NIS2, AI Act, CRA

Which regulations does BlackBelt help you comply with?

BlackBelt Technology designs, develops, integrates and operates software that must comply with EU and Hungarian regulations. For financial institutions we work in line with DORA, and for organisations within the scope of NIS2 in line with the NIS2 requirements. Our development processes are built on the security-by-design principle.

Compliance is not an after-the-fact audit. A regulation is decided in the system's architecture, logging, incident management, supplier contracts and documentation. Below we show, industry by industry, which regulations affect your software and where we can help.

Which certifications does BlackBelt hold?

BlackBelt's information security management system is certified to ISO/IEC 27001:2023 and its quality management system to ISO 9001:2015. Both certificates cover the full software lifecycle: from design and development through integration to operation.

This matters because both DORA and NIS2 expect an organisation to control its supply chain as well. A development partner certified to ISO/IEC 27001 makes that control simpler.

Finance, banking and insurance: which regulations affect the software?

In the financial sector, DORA, the expectations of the MNB (the Hungarian central bank), PSD3 and the PSR, eIDAS 2.0, the AI Act and the GDPR together determine how a banking or insurance system may be built. As an ICT service provider, BlackBelt works for its financial-institution clients in line with DORA's supplier requirements.

• DORA (Digital Operational Resilience Act): Applicable since 17 January 2025. It regulates ICT risk management, incident reporting, resilience testing and the oversight of third-party ICT providers. The software supplier must commit by contract to DORA-compliant cooperation, auditability and business continuity.
• PSD3 and PSR: The final texts of the package replacing PSD2 were published on 23 April 2026. They affect strong customer authentication (SCA), fraud prevention and open banking. According to current estimates, most obligations apply from 2028; development preparation starts now.
• eIDAS 2.0 and the EUDI Wallet: By 24 December 2027, banks, insurers and payment service providers must accept the European Digital Identity Wallet for customer identification and strong customer authentication. This means integration work on onboarding and authentication systems.
• AI Act: AI used in credit scoring and insurance risk assessment counts as a high-risk system. After the Digital Omnibus amendment, these obligations apply from 2 December 2027.
• MNB expectations and GDPR: The MNB's recommendations and the GDPR's data protection requirements are baseline conditions for every banking development.

How BlackBelt helps: core banking and legacy modernisation without interrupting operations, secure API and open banking integration, and the development of fraud prevention and credit scoring systems.

NIS2: what does it mean for a software supplier?

In Hungary the NIS2 Directive (EU 2022/2555) was transposed by Act LXIX of 2024 (the Cybersecurity Act), in force since 1 January 2025; in the private sector it is supervised by the SZTFH. BlackBelt develops and operates in line with the NIS2 requirements for its clients within the scope of NIS2.

The range of organisations concerned is wide: energy, transport, healthcare, drinking water, digital infrastructure, public administration, postal and courier services, the food and chemical industries, and several branches of manufacturing, including the automotive, electronics, machinery and medical device sectors. The penalty for an essential entity is the equivalent of EUR 10 million or 2% of annual global turnover, and for an important entity EUR 7 million or 1.4%, whichever is higher.

NIS2 explicitly requires supply-chain security, so the software supplier must be checked as well. In practice this means the following:

• Logging and auditability: every relevant operation in the system is traceable, and log retention and protection are in place.
• Access management: role-based permissions, multi-factor authentication and regular review of permissions.
• Incident management: the software supports early detection and the fast production of the data needed for reporting to the authority.
• Supplier compliance: documented development and security processes that the client's auditor can verify.

How BlackBelt helps: development of new NIS2-compliant systems, preparing existing applications for the cybersecurity audit, and secure integration of OT and IT systems.

Manufacturing and industry: CRA, Data Act, AI Act and GMP

For manufacturers, besides NIS2, three new EU regulations and the sector rules set the requirements for software: the Cyber Resilience Act, the Data Act, the AI Act and, in the pharmaceutical industry, GMP. They affect both the software built into the manufactured product and the systems that control production.

• Cyber Resilience Act (CRA): Since 11 September 2026, manufacturers of products with digital elements must report actively exploited vulnerabilities and severe incidents to ENISA and the national CSIRT within 24 hours. This also applies to products already on the market. The full set of requirements, including CE marking, applies from 11 December 2027. The fine is up to EUR 15 million or 2.5% of global annual turnover.
• Data Act: From 12 September 2026, newly marketed smart products and related services must be designed so that the data they generate is available to the user by default, securely and free of charge (access by design). From 12 January 2027, cloud switching charges are abolished.
• AI Act: After the Digital Omnibus amendment, the obligations for high-risk AI built into regulated products (for example medical devices) apply from 2 August 2028.
• Pharmaceuticals and medical technology: production control and quality management software must also meet the GAMP 5 computerised system validation (CSV) methodology and the audit trail and data integrity requirements of EU GMP Annex 11 and FDA 21 CFR Part 11.

How BlackBelt helps: an architecture that supports the software's security updates and vulnerability management, secure integration of OT and IT systems, PLCs, SCADA and MES systems with the ERP, and Mendix and JUDO low-code production applications with documentation that can be validated.

Retail, e-commerce and consumer services: accessibility and data protection

Since 28 June 2025, companies operating consumer-facing digital interfaces have had to meet accessibility requirements as well as data protection. This affects web shops, mobile apps, online customer service and banking interfaces alike.

• Accessibility (European Accessibility Act, EAA): transposed in Hungary by Act XVII of 2022. Digital interfaces must be usable with a screen reader, have adjustable font size and sufficient contrast. The technical benchmark is the EN 301 549 standard, which builds on the WCAG guidelines.
• GDPR: handling personal data, data minimisation and serving data subjects' rights are baseline requirements for every customer system.
• AI Act transparency rules: under the Digital Omnibus amendment, the deadline for labelling AI-generated content is 2 December 2026. This may also affect customer service chatbots and generated product descriptions.

How BlackBelt helps: accessibility rework of existing web and mobile interfaces, development of new interfaces to EN 301 549, and integration of ERP, CRM and warehouse systems with data flows that are also checked for data protection.

Regulatory deadlines between 2025 and 2028

Seven deadlines fall due by the end of 2027, including the AI Act rules for high-risk systems, the full application of the CRA and the mandatory acceptance of the EUDI Wallet by banks.

Frequently asked questions