When an IT team discovers on a Monday morning that its cloud provider has changed its data processing terms to comply with new European regulations, technological vigilance ceases to be a luxury. This year’s IT news is characterized by a regulatory acceleration that directly impacts architectural choices, supplier contracts, and the security of digital products.
Cyber Resilience Act and product security obligations in 2026
Competitors talk a lot about cybersecurity in general. We will discuss a specific text that changes the game for software publishers and connected hardware manufacturers: the Cyber Resilience Act (CRA).
Since September 11, 2026, the incident notification obligations of the CRA have come into effect. Specifically, any publisher or manufacturer marketing a digital product in the European Union must report actively exploited vulnerabilities within constrained timelines.
The CRA does not stop there. It sets a trajectory towards “default” security requirements, with mandatory CE marking and comprehensive obligations starting in December 2027. Following IT news on Bargento helps keep an eye on these regulatory deadlines that impact development cycles.
For a product team, this means integrating security from the design phase, documenting software components (SBOM), and planning a reporting process. Feedback varies on the actual burden this represents depending on the size of the company, but the timeline remains fixed.
Cloud Sovereignty: From Strategic Discourse to Regulatory Constraint
We have been hearing “digital sovereignty” for years without direct operational consequences. That is no longer the case.
The European Commission published a proposal for the Cloud and AI Development Act on June 3, 2026. This text introduces a unified framework to assess the “sovereignty” of cloud services, with a direct impact on public procurement and the hosting choices of companies working with the public sector.
In practice, if responding to a public tender or processing sensitive data for a European entity, the choice of cloud provider must meet formalized sovereignty criteria. It is no longer a preference; it is a regulatory evaluation grid.
What it changes for IT architects
Teams that have built their infrastructure on an American hyperscaler are not doomed, but they must map their data flows and identify the affected workloads. Multicloud becomes a regulatory necessity, not a technical choice.
Several European providers are positioning “geopatriation” offers, a term that refers to the repatriation of data and processing to legally European infrastructures. The movement has begun, and migration timelines remain the critical point.
DORA and third-party ICT risk: supplier contracts under control
The DORA regulation (Digital Operational Resilience Act), applicable since January 17, 2025, is producing its first concrete effects in 2026. Supervisory authorities are intensifying their controls on third-party ICT risk and the associated contractual clauses.
For companies in the financial sector (and their technology providers), this translates into specific requirements:
- Contracts with critical ICT suppliers must include operational resilience clauses, audit rights, and documented exit strategies
- Resilience testing (including advanced penetration testing) must cover third-party dependencies, not just internal systems
- A centralized register of third-party ICT providers must be maintained and provided to regulators upon request
Outside the financial sector, DORA sets a precedent. The best practices it imposes on IT supplier management are spreading as a market standard. A cloud contract without a documented exit clause becomes a red flag.
European AI Act: the real timeline after the Digital Omnibus
The AI Act has generated a lot of ink, but its timeline has evolved. The entry into force of the Digital Omnibus on AI on July 27, 2026, has postponed some obligations related to high-risk AI systems.
However, several key requirements have been applicable since August 2, 2026. For teams deploying artificial intelligence in production, operational priority focuses on three points:
- The classification of the risk level of each deployed AI system, according to the grid updated by the Digital Omnibus
- Technical documentation and traceability of algorithmic decisions for systems classified as high risk
- The establishment of effective human oversight, not symbolic, over automated decision-making processes
This partial delay should not create a false sense of comfort. Companies waiting for final deadlines to comply are accumulating a compliance debt that will be costly to resolve.
Link with data and cloud strategy
The AI Act, the Cloud and AI Development Act, and DORA are not isolated texts. They form a regulatory ecosystem where hosting, outsourcing, and data governance choices intertwine. A cloud architecture decision made without considering the three texts exposes to cascading reclassifications.
For CIOs and compliance officers, keeping up with IT news is no longer an exercise in technological curiosity. It is a risk management tool. The European texts published this year redefine operational constraints on cloud, product security, supplier contracts, and AI deployment. Each quarter brings its share of concrete deadlines, and teams that anticipate them stay ahead of those who merely react.
