compliance

CRA covers products with digital elements. NIS2 covers entities. DORA covers financial entities. When all three apply at once, headless WordPress sits at the intersection. I sketch what the joint evidence package looks like in 2026.

Article 28 of Regulation 2022/2554 makes financial entities responsible for the ICT risk of every third-party they touch. I walk through the supplier due-diligence checklist I ship with WordPress engagements for banks and insurers in 2026.

Article 28(3) of Regulation 2022/2554 obliges financial entities to keep a Register of Information on every ICT third-party arrangement. The fields a WordPress agency must populate to be entered.

Article 21 of Directive 2022/2555 lists ten risk-management measures every in-scope entity must implement. I map each one to a WordPress agency control, with the evidence file each one requires for audit.

Article 23 of Directive 2022/2555 sets three reporting deadlines: an early warning at 24 hours, a full notification at 72 hours, a final report at one month. What the WordPress agency must produce inside each window.

NIS2 (Directive 2022/2555) and DORA (Regulation 2022/2554) cover similar ground but with different mechanics. Where they overlap, where they diverge, and how a WordPress agency satisfies both with one evidence trail.

Article 23 of NIS2 gives 24 hours from awareness to file an early warning with the CSIRT. This playbook lists the WordPress-specific signals that trigger the clock and the template I file when the clock starts.

The NIS2 Directive (2022/2555) was to be transposed into national law by 2024-10-17. The DORA Regulation (2022/2554) applies directly from 2025-01-17. For a WordPress site operator this means specific obligations if the site relates to a regulated entity. We explain it without panic, with references to the texts of the acts.

WCAG 2.2 was first published as a W3C Recommendation on 2023-10-05; the current published version on www.w3.org/TR/WCAG22/ is dated 2024-12-12. The EU Accessibility Act (Directive 2019/882) applies from 2025-06-28. Germany's Barrierefreiheitsstärkungsgesetz transposes it into federal law on the same date. This article is the implementation map for a WordPress site in 2026.

Germany's Barrierefreiheitsstärkungsgesetz applied from 28 June 2025. It transposes EAA Directive 2019/882 into national law. I unpack how it affects WooCommerce stores in DE and the four plugin failure patterns I see in audits.