Posts in category compliance
This block routes category visitors into the commercial pages and supporting content that complete the search intent.
One audit across EAA, NIS2/DORA, and AI Act - report, backlog, and procurement evidence.
NIS2 and DORA scope mapping, supplier register, incident runbook.
Audit, hardening, and incident risk reduction.
WCAG 2.2, BFSG, EAA conformance report and remediation backlog.
Stability, updates, and post-launch support.
Custom WordPress engineering and architecture.
Headless WordPress, Sanity, Strapi, and Contentful with Astro or Next.js.
CRA covers products with digital elements. NIS2 covers entities. DORA covers financial entities. Headless WordPress meets the CRA on the product side and NIS2 or DORA on the client side; for financial entities DORA applies instead of NIS2. I sketch what the joint evidence package looks like in 2026.
The NIS2 Directive (2022/2555) was to be transposed into national law by 2024-10-17. The DORA Regulation (2022/2554) applies directly from 2025-01-17. For a WordPress site operator this means specific obligations if the site relates to a regulated entity. We explain it without panic, with references to the texts of the acts.
Article 21 of Directive 2022/2555 lists ten risk-management measures every in-scope entity must implement. I map each one to a WordPress agency control, with the evidence file each one requires for audit.
NIS2 (Directive 2022/2555) and DORA (Regulation 2022/2554) cover similar ground but with different mechanics. Where they overlap, where they diverge, and how a WordPress agency satisfies both with one evidence trail.
Ireland's Re-turn deposit, the UK scheme due on 1 October 2027 and the EU schemes your parcels may cross into: what the law says an online drinks shop must charge and display, how VAT treats the deposit in each country, and how to build it as a WooCommerce cart fee.
HMRC plans to require e-invoices for all VAT invoices from April 2029, and Irish Revenue starts with large corporates on 1 November 2028, when every Irish business must also be able to receive e-invoices. WooCommerce issues no invoices of its own, so the plugin, invoicing service or ERP behind your shop decides how ready you are. What applies to consumer and business orders, and what to prepare.
From 1 July 2026 to 1 July 2028, a parcel from outside the EU worth up to EUR 150, sold through IOSS or sent by post, pays EUR 3 customs duty for every tariff item. Who it hits, including UK and US shops selling into the EU, how to count items, what the handling fee from November 2026 adds and how to show the duty in a WooCommerce cart.
Regulation 5A of the Irish price indication rules, like Article 6a of Directive 98/6/EC, requires every announced price reduction to show the prior price: the lowest price of at least 30 days before the reduction. WooCommerce keeps no price history, so a plugin or custom code has to. How a correct history works, what breaks in practice and how to test your own shop.
Since 19 June 2026, Article 11a of the Consumer Rights Directive requires a "withdraw from contract here" function on online shops. Not every country has transposed it. What the rule says, how cross-border selling changes it, and how to build it in WooCommerce, Shopify or a headless shop.
BFSG and the EU Accessibility Act require a published accessibility statement with a working complaint mechanism, not just a compliant front end. This is a copy-ready template structure mapped to EN 301 549 clauses and WordPress deliverables.
CRA covers products with digital elements. NIS2 covers entities. DORA covers financial entities. Headless WordPress meets the CRA on the product side and NIS2 or DORA on the client side; for financial entities DORA applies instead of NIS2. I sketch what the joint evidence package looks like in 2026.
Article 28 of Regulation 2022/2554 makes financial entities responsible for the ICT risk of every third-party they touch. I walk through the supplier due-diligence checklist I ship with WordPress engagements for banks and insurers in 2026.
Article 28(3) of Regulation 2022/2554 obliges financial entities to keep a Register of Information on every ICT third-party arrangement. The fields a WordPress agency must populate to be entered.
Article 21 of Directive 2022/2555 lists ten risk-management measures every in-scope entity must implement. I map each one to a WordPress agency control, with the evidence file each one requires for audit.
Article 23 of Directive 2022/2555 sets three reporting deadlines: an early warning at 24 hours, a full notification at 72 hours, a final report at one month. What the WordPress agency must produce inside each window.
NIS2 (Directive 2022/2555) and DORA (Regulation 2022/2554) cover similar ground but with different mechanics. Where they overlap, where they diverge, and how a WordPress agency satisfies both with one evidence trail.
Article 23 of NIS2 gives 24 hours from awareness to file an early warning with the CSIRT. This playbook lists the WordPress-specific signals that trigger the clock and the template I file when the clock starts.
The NIS2 Directive (2022/2555) was to be transposed into national law by 2024-10-17. The DORA Regulation (2022/2554) applies directly from 2025-01-17. For a WordPress site operator this means specific obligations if the site relates to a regulated entity. We explain it without panic, with references to the texts of the acts.
WCAG 2.2 was first published as a W3C Recommendation on 2023-10-05; the current published version on www.w3.org/TR/WCAG22/ is dated 2024-12-12. The EU Accessibility Act (Directive 2019/882) applies from 2025-06-28. Germany's Barrierefreiheitsstärkungsgesetz transposes it into federal law on the same date. This article is the implementation map for a WordPress site in 2026.
Germany's Barrierefreiheitsstärkungsgesetz applied from 28 June 2025. It transposes EAA Directive 2019/882 into national law. I unpack how it affects WooCommerce stores in DE and the four plugin failure patterns I see in audits.