For each regulation: what it demands, from when, who it impacts, and which combination of P3 products lets you meet it without rewriting your supplier portfolio.
None is optional. Three are already in force. The fourth is the heaviest and comes due in 2026.
Risk management, incident reporting within 24h+72h, supply-chain security, board accountability. Penalties up to 2% of global turnover or €10M.
Classification of AI systems by risk (prohibited → minimal). Technical documentation, governance, human oversight, public registry. Fines up to €35M or 7%.
ICT resilience for the financial sector. Third-party risk, advanced testing (TLPT), incident reporting, oversight of critical providers. Direct on banks, asset managers, IT service providers.
Non-EU transfers, legal bases, DPIA, 72h breach notification. Combined with the Cloud Act, it makes EU hosting a technical choice, not a political one.
This is how an audit really works: the auditor asks you for "control X", you show "product Y configured this way". A table used literally in our proposals.
Even with the best contract, the best DPA, the best SCC, a US provider remains subject to US law. Full stop.
This is not a political stance: it's the text of the Clarifying Lawful Overseas Use of Data Act, signed in 2018. No private clause can override it. No DPA, no SCC, no ISO certification. When the subpoena arrives, the US provider chooses between obeying US or EU law. It always chooses US law: that's the one that sends it to prison.
This is why every byte of every P3 client lives in Europe. It's not marketing, it's architecture. If that ever changed, even for a single client migrated to a US-region service, we'd be forced to rewrite the manifesto. For now, we keep it by design.
Munin is the entry door. Seven days on-prem, an archivable report, a clear deliverable.
[ Book Munin ]