What we do
Regulations and frameworks
We align our work with the requirements of each market you operate in.
European Union
- DORA
- Digital Operational Resilience Act for the financial sector, applicable since January 2025: ICT risk management, testing, incidents and third-party providers.
- NIS2
- Directive on cybersecurity for essential and important entities, transposed into each member state's law.
- ISO 22301 · ISO/IEC 27001 · ISO/IEC 42001
- International standards for business continuity, information security and AI management systems.
- AI Act (as amended by the Digital Omnibus)
- Regulation (EU) 2024/1689, amended by Regulation (EU) 2026/1744: obligations for Annex III high-risk systems from 2 December 2027 (instead of 2 August 2026), for Annex I from 2 August 2028, and for systems intended for public authorities by 2 August 2030. Article 50(2) transparency and the new Article 5 prohibitions: 2 December 2026. Details on the AI page.
United Kingdom
- FCA / PRA
- Operational resilience rules: important business services, impact tolerances and scenario testing.
- Cyber Essentials
- Government-backed scheme for baseline security controls, often required in public contracts.
Canada
- BSIF / OSFI B-13
- Guideline on technology and cyber risk management.
- BSIF / OSFI E-21
- Guideline on operational resilience and operational risk management.
- BSIF / OSFI E-23
- Guideline on model risk management, including AI and machine-learning models; effective May 1, 2027.
- Law 25 (Quebec)
- Personal information protection, including handling and reporting of privacy incidents.
United States
- NIST CSF 2.0
- Reference cybersecurity framework: govern, identify, protect, detect, respond, recover.
- NIST SP 800-34
- Contingency planning guide for information systems.
- SR 11-7
- Federal Reserve and OCC guidance on model risk management at financial institutions.
- NIST AI RMF 1.0
- AI risk management framework: govern, map, measure and manage.
- SOC 2
- Assurance report on controls, often requested by customers of SaaS companies.
FZ Consultation provides operational and technical advice, not legal advice. Requirements change: always confirm their exact scope for your organization.