Five agents. One per regulation.

Maintains the Article 30 records of processing, drafts Article 28 DPAs and Article 35 DPIAs, and prepares the Article 33 breach notice within the 72-hour window.

• Art. 5 - lawfulness, purpose limitation, minimisation
• Art. 28 - processor contracts (DPAs)
• Art. 30 - records of processing activities
• Art. 33–34 - 72h breach notification & individual notice
• Art. 35 - Data Protection Impact Assessment
• Chapter V - international transfers (SCCs, TIAs)

Owns the ICT risk framework, maintains the register of information on third-party arrangements, and drives the 4h / 72h / 1-month incident reports under RTS 2024/1772.

• Art. 5–16 - ICT risk-management framework
• Art. 17–23 - incident management & reporting
• Art. 24–27 - digital operational resilience testing
• Art. 28–30 - ICT third-party risk & register
• Art. 40–49 - TLPT (threat-led penetration testing)

Drafts crypto-asset white papers, prepares CASP authorisation files and tracks ESMA / EBA Q&As - across asset-referenced tokens, e-money tokens and other crypto-assets.

• Title II - white papers for non-ART/EMT crypto-assets
• Title III - asset-referenced token issuers (incl. reserves)
• Title IV - e-money token issuers
• Title V - CASP authorisation & operating conditions
• Title VI - market abuse rules for crypto-assets

Classifies systems by risk tier, maintains the Article 11 technical file and the Article 12 logs, and tracks the staged obligations entering into application on 2 Feb 2025, 2 Aug 2025 and 2 Aug 2026.

• Art. 5 - prohibited practices (in force 2 Feb 2025)
• Annex III - high-risk system classification
• Art. 9 - risk management system
• Art. 11 - technical documentation
• Art. 12 - automatic logs for high-risk systems
• Chapter V - general-purpose AI model obligations

Determines essential vs important entity status across the 18 sectors in Annexes I & II, and operates the 24-hour early-warning / 72-hour notification / 1-month report pipeline under Article 23.

• Art. 3 - essential vs important entity criteria
• Art. 20 - governance & management body responsibility
• Art. 21 - cybersecurity risk-management measures
• Art. 23 - 24h / 72h / 1-month incident reporting
• Annexes I & II - 18 sectors in scope