Regulation archetype
EU fintech or software supplier to financial customers
EU fintech software suppliers should expect GDPR, ISO 27001, SOC 2, DORA-driven due diligence, and vendor risk evidence. Direct DORA duties depend on role and customer relationship, but financial-sector buyers often push DORA expectations into supplier reviews.
- Likely now
- 4 planning items
- Possible later
- 4 to watch
- Next steps
- 3 to run
- Last reviewed
- May 2026
Company profile
A software company selling to banks, payment institutions, insurers, investment firms, crypto-asset service providers, or regulated fintechs.
Likely planning items
Framework
Planning weight
- GDPRPlan now
- ISO 27001Plan now
- SOC 2Plan now
- DORA due diligencePlan now
Next steps
- 01Identify financial customers and critical ICT dependencies.
- 02Prepare evidence for incident handling, continuity, access control, and vendor oversight.
- 03Create a financial-sector readiness brief before enterprise procurement asks for it.
This page is a practical planning guide, not legal or audit advice. Use it to scope questions before confirming obligations with legal, audit, or regulatory specialists.
Other company profiles
- EU B2B SaaS company with 15-100 employeesLikely now: GDPR, ISO 27001, SOC 2, NIS2 supply-chain pressure.
- EU SaaS company building or embedding AILikely now: GDPR, EU AI Act readiness, ISO 27001, AI governance controls.
- Finnish public-sector software supplierLikely now: GDPR, ISO 27001, Julkri, NIS2 supply-chain pressure.