M4 — Path

Where to intervene first.

Ranked by RAG, buffer days, stale controls and unowned dependencies. Named dependencies. Named owners. No status-report abstraction.

Off track

At risk

Controls stale

Unowned controls

Status	Regulation	Deadline	Buffer	Controls	Stale	Unowned	Score
Off track	MiCA — Whitepaper Filing Regime EUESMA · 14 stale · 2d over	30 Sep 2026	-2d	14	14	—	164
At risk	DORA — ICT Third-Party Register EUESMA · 22 stale	15 Nov 2026	22d	22	22	—	106
At risk	T+1 Settlement — Final Rule EUESMA · 14 stale	11 Oct 2027	40d	14	14	—	82
At risk	EU AI Act — Financial Services Guidance EUEBA · 5 stale	2 Feb 2027	45d	5	5	—	55
On track	CSRD — Sustainability Reporting EUEBA · 8 stale	31 Dec 2026	60d	8	8	—	24

Score combines RAG (0–100), buffer penalty, stale controls (×3) and unowned dependencies (×5). Higher scores need attention first.