Insights
Article 7 of 14 – State of the Market 2026
Your 2027 compliance deadlines are a software delivery problem
Read Time: 5 min
The Cyber Resilience Act's reporting duties started on 11 September. The AI Act's high-risk obligations and NIS2 in Ireland follow inside a 24-month window. All of them ask for the same thing – evidence – and the cheapest time to plan for it and start producing it is while the software is being built.
On 11 September 2026, manufacturers of products with digital elements sold in the EU became obliged to notify of actively exploited vulnerabilities and severe incidents within 24 hours. That is the first hard date of the Cyber Resilience Act. The rest of it – secure-by-design, software bills of materials, vulnerability handling, CE marking – arrives on 11 December 2027. If you are designing or building software today, that will go live inside that window, it will be measured against those obligations and requirements.
The calendar that needs to be on one page
Most organisations track each regime separately, which is why it can be difficult to see the cumulative effect and cost, not to mention potential missed synergies. DORA has applied to applicable financial entities since 17 January 2025; the European supervisory authorities published their first full-year incident report in June and, in July, a statement on ICT risks from frontier AI models. The AI Act's prohibitions took effect in February 2025 and its general-purpose AI provisions in August 2025; the AI Omnibus, in force since 27 July 2026, re-timed the high-risk obligations to 2 December 2027 for Annex III systems – employment, education, credit, insurance, critical infrastructure, public services – and 2 August 2028 for AI embedded in regulated products, while transparency duties apply from August last.
In Ireland, NIS2 is the gap. The transposition deadline of 17 October 2024 was missed; the European Commission referred Ireland to the Court of Justice on 8 July 2026, alongside Spain, France, and the Netherlands, and the Government has said it expects to notify transposition by the end of 2026. NIS1 remains in force for designated operators of essential services in the meantime. This means a compressed compliance window for essential and important entities once the Act commences. The Central Bank's revised Consumer Protection Code, with its digitalisation duties, took effect on 24 March 2026. The European Accessibility Act has applied to consumer-facing digital services since June 2025, with WCAG 2.1 AA as the presumption of conformity. And GDPR has not gone quiet: €1.2 billion in fines in 2025, and breach notifications up 22% to an average of 443 a day.
The UK has a similar agenda but a different route. It has no AI statute, but its Software Security Code of Practice could be seen as a de facto element of procurement checklists, and the Cyber Security and Resilience Bill (the Bill completed Lords report stage on 26 October, passed third reading on 2 November, and is now back in the Commons for consideration of Lords amendments), brings managed service providers and data centres into scope, with the detailed duties to follow in secondary legislation and codes of practice.
Figure 1: The timeline outlines eleven regulatory milestones between January 2025 and August 2028, highlighting obligations relevant to organisations buying or developing custom and AI-enabled software.
Decipher the texts and every regime asks the same five questions
The AI Act wants technical documentation, logging, human oversight, and evidence of accuracy and robustness testing. The CRA wants a software bill of materials, a vulnerability-handling process, security updates, and a record of what was scanned and fixed. DORA wants an ICT risk framework, a register of third parties, resilience testing, a change audit trail, and exit and portability terms. NIS2 and the UK Bill want supply-chain controls and incident runbooks. GDPR, the accessibility act, and the Central Bank's code want privacy by design, consent done properly, and interfaces a person with a disability can use.
Put them side by side and the pattern is obvious. Every one of them is basically asking the same 5 questions: what did you build, what did you test, what did you find, what did you fix, and who can see the record. None of them requires that AI write your software. All of them reward a delivery process that produces documentation, executed tests, scans, and audit trails as a by-product rather than as a project of their own.
Figure 2: The table compares seven regulatory regimes and translates their requirements into practical software development evidence.
For each regime, it identifies the organisations or sectors in scope, the main software-related requirements, and examples of evidence that should be generated during development.
The expensive way and the cost-effective way
The expensive way is the one most organisations are still on: build first, evidence later. Somebody is asked, eighteen months after go-live, for the test evidence behind a system whose delivery team have moved on. A consultant writes an SBOM for a codebase nobody fully understands. A documentation project is commissioned to reconstruct design decisions from commit messages. Evidence assembled after the fact might even cost roughly what building the thing cost, at the risk of not even addressing the need.
The cost-effective way treats evidence as hygiene from the build. Acceptance tests are executed and stored per feature, so the test evidence exists the moment the feature does. Security, dependency, and licence scans run in the pipeline, and their findings and remediation history are kept, so the vulnerability-handling record writes itself. The SBOM is generated per release. The accessibility audit runs against the interface and its findings are tracked to closure. Documentation and infrastructure definitions are exported with every build, so the environment is reproducible and the exit terms DORA expects are real rather than contractual.
This is not a hypothetical. It is precisely why Gartner made traceability and auditability mandatory criteria in its first quadrant for agentic coding tools this year: the tooling to produce evidence continuously exists. What is missing in most organisations is a delivery process that mandates it.
Ireland has its own reasons to move early. Fifteen sectoral authorities have been designated for the AI Act – the Central Bank, the Data Protection Commission, ComReg, CRU, the HSE, and the HPRA among them – and a national AI Office has been established with a regulatory sandbox to follow. The National Digital and AI Strategy published in February sets ninety deliverables. And with the EU Presidency in the second half of the year and the International AI Summit took place in Dublin on 14 October, AI governance will stay politically visible here for the rest of 2026 at least.
How we build for it
When we deliver software into regulated Irish organisations, the compliance gates run inside the build, not after it. Assessments for the AI Act, GDPR, cookie consent, accessibility, and open-source licences – and, where a client needs them, PCI DSS, HIPAA, and SOC 2 – produce their reports as the software takes shape. Critical security findings become work items that re-enter the build rather than lines in a closing report. Everything runs in the EU. The client owns the code, the infrastructure definitions, the tests, and the documentation from the first day, which is what exit and portability actually mean when a supervisor asks.
Our approach is such because our clients' auditors ask for it, and because it is cheaper than the alternative. Both are good reasons; the second is the one that seals the decision.
So the question for anyone with a system going live in 2027: if your regulator asked tomorrow for the SBOM, the executed test evidence, and the change history behind the last system you shipped, would you be exporting it or writing it?
This is the seventh of fourteen articles drawing on SevTech's State of the market 2026 research into autonomous software delivery. Next: “Eight ways to get software built in 2026 – and what each quietly leaves for you to do.
Sources:
1. InfoQ, reporting DORA’s report on the ROI of AI-assisted software development, May 2026. https://www.infoq.com/news/2026/05/dora-roi-ai-assisted-dev-report/
2. UK Government, State of digital government review, January 2025. https://www.gov.uk/government/publications/state-of-digital-government-review/state-of-digital-government-review
3. Veracode, 2026 GenAI Code Security Report (spring update), March 2026. https://www.veracode.com/blog/spring-2026-genai-code-security/
4. The Register, reporting Apiiro, 5 September 2025. https://www.theregister.com/2025/09/05/ai_code_assistants_security_problems/
5. Cloud Security Alliance, Research note: AI-generated code vulnerability surge 2026, April 2026. https://labs.cloudsecurityalliance.org/research/csa-research-note-ai-generated-code-vulnerability-surge-2026/
6. Deloitte, State of AI in the enterprise 2026, January 2026. https://www.deloitte.com/us/en/about/press-room/state-of-ai-report-2026.html
7. IAPP, AI governance profession report 2025, April 2025. https://iapp.org/resources/article/ai-governance-profession-report/
8. Capgemini, World Quality Report 2025–26, November 2025. https://www.capgemini.com/insights/research-library/world-quality-report-2025-26/
9. Harness, AI coding accelerates development, DevOps maturity in 2026 isn’t keeping pace, March 2026. https://www.prnewswire.com/news-releases/harness-report-reveals-ai-coding-accelerates-development-devops-maturity-in-2026-isnt-keeping-pace-302710937.html
10. McKinsey, Tech debt: reclaiming tech equity, October 2020. https://www.mckinsey.com/capabilities/tech-and-ai/our-insights/tech-debt-reclaiming-tech-equity
11. GitClear, The AI code quality and maintainability gap (623M changed lines, 2023–2026), January 2026. https://www.gitclear.com/the_ai_code_quality_maintainability_gap
12. Gartner, 52% of government CIOs expect IT budgets to increase in 2026, 26 November 2025. https://www.gartner.com/en/newsroom/press-releases/2025-11-26-gartner-survey-reveals-52-percent-of-government-cios-expect-it-budgets-to-increase-in-2026
13. Government of Ireland, Digital Ireland – connecting our people, securing our future (National Digital and AI Strategy), 18 February 2026. https://www.gov.ie/en/department-of-the-taoiseach/campaigns/digital-ireland-connecting-our-people-securing-our-future/
14. Gartner, 40% of enterprise apps will feature task-specific AI agents by 2026, up from less than 5% in 2025, 26 August 2025. https://www.gartner.com/en/newsroom/press-releases/2025-08-26-gartner-predicts-40-percent-of-enterprise-apps-will-feature-task-specific-ai-agents-by-2026-up-from-less-than-5-percent-in-2025
15. Yahoo Finance, reporting McKinsey: 32% of companies decided against buying software they could build, September 2026. https://finance.yahoo.com/technology/ai/articles/build-vs-buy-shift-32-113806700.html
16. CNCF, Annual cloud native survey, January 2026. https://www.cncf.io/reports/the-cncf-annual-cloud-native-survey/
17. BCG, How AI is paying off in the tech function, January 2026. https://www.bcg.com/publications/2026/how-ai-is-paying-off-in-the-tech-function
18. GitLab, 2025 global DevSecOps survey: the AI paradox, November 2025. https://ir.gitlab.com/news/news-details/2025/GitLab-Survey-Reveals-the-AI-Paradox-Faster-Coding-Creates-New-Bottlenecks-Requiring-Platform-Solutions/default.aspx
19. TechCrunch, Lovable says it has hit $500M in annualised revenue, 9 June 2026. https://techcrunch.com/2026/06/09/lovable-says-it-has-hit-500m-in-annualized-revenue-with-1-million-new-projects-a-week/
20. TechCrunch, Lovable confirms new $13.3B valuation, raises another $400M, 12 August 2026. https://techcrunch.com/2026/08/12/lovable-confirms-new-13-3b-valuation-raises-another-400m/
21. Bain & Company, From pilots to payoff: generative AI in software development (Technology Report 2025), September 2025. https://www.bain.com/insights/from-pilots-to-payoff-generative-ai-in-software-development-technology-report-2025/
22. Moderne, Moderne named a Leader in the 2026 Gartner Magic Quadrant for AI-Augmented Code Modernization Tools, August 2026. https://moderne.ai/blog/moderne-leader-gartner-magic-quadrant-ai-code-modernization
23. Microsoft, Microsoft named a Leader in the 2026 Gartner Magic Quadrant for AI-Augmented Code Modernization Tools, August 2026. https://azure.microsoft.com/en-us/blog/microsoft-named-a-leader-in-the-2026-gartner-magic-quadrant-for-ai-augmented-code-modernization-tools/
24. Superblocks, Lovable vulnerabilities and CVE-2025-48757, 2025. https://www.superblocks.com/blog/lovable-vulnerabilities
25. AWS, AWS Transform continuous modernisation (AWS named a Leader in the 2026 Gartner Magic Quadrant for AI-Augmented Code Modernization Tools), August 2026. https://aws.amazon.com/transform/continuous-modernization
Made with AI, not by it. Claude researched and drafted; I rewrote and verified it. The charts are Claude’s.
View more Insights from SevTech.
State of the Market Series
Where AI-built software actually pays for itself. So why are the demos all somewhere else?
Paul Mahon
Director & Senior Technology Consultant
State of the Market Series
One in five Irish enterprises now uses AI. So why is the average the least useful number?
Fionnuala Healy
Director of Innovation & AI Strategy
State of the Market Series
The analysts are undercounting it. So what is the forecast measuring?
Rob Curley
Managing Director
State of the Market Series
The €96 billion question. Why is it really a €710 billion one?
Daithí Thornton
Sales Director
State of the Market Series
‘Passing’ is a measurement, not a claim. So who ran the test?
Hugh Nolan
Director & Senior Architect
State of the Market Series
One in three pull requests now involves an agent. So why does nobody trust the code?
Fionnuala Healy
Director of Innovation & AI Strategy
News
SevTech is growing, bringing new expertise and experience to our team.
Jean Gargan-Smith
Marketing & Operations Lead
News
SevTech’s Summer Internship Programme
Rob Curley
Managing Director
News
SevTech launches Forge
Rob Curley
Managing Director
Article
The conversation has changed.
William Waldron
Director, Technology Delivery