M4 — Path
Where to intervene first.
Ranked by RAG, buffer days, stale controls and unowned dependencies. Named dependencies. Named owners. No status-report abstraction.
Off track
1
At risk
3
Controls stale
41
Unowned controls
0
| Status | Regulation | Deadline | Buffer | Controls | Stale | Unowned | Score |
|---|---|---|---|---|---|---|---|
| Off track | MiCA — Whitepaper Filing Regime EUESMA · 8 stale · 2d over | 30 Sep 2026 | -2d | 14 | 8 | — | 146 |
| At risk | DORA — ICT Third-Party Register EUESMA · 15 stale | 15 Nov 2026 | 22d | 22 | 15 | — | 85 |
| At risk | T+1 Settlement — Final Rule EUESMA · 10 stale | 11 Oct 2027 | 40d | 14 | 10 | — | 70 |
| At risk | EU AI Act — Financial Services Guidance EUEBA · 4 stale | 2 Feb 2027 | 45d | 5 | 4 | — | 52 |
| On track | CSRD — Sustainability Reporting EUEBA · 4 stale | 31 Dec 2026 | 60d | 8 | 4 | — | 12 |
Score combines RAG (0–100), buffer penalty, stale controls (×3) and unowned dependencies (×5). Higher scores need attention first.