Multiple regulatory layers
EU regulation, implementing act, technical standard and local sector requirements.
← Home
CROSS-CUTTING SERVICE · COMPLIANCE SUPPORT
From regulatory expectation to implementable system requirement.
Contum decomposes eIDAS 2.0, AMLR, DÁP, electronic-signature and preservation requirements into business processes, controls, technology decisions and evidence.
Legal, compliance, security, business and IT stakeholders gain one implementation language.
RequirementsTranslate regulatory and business expectations into specific system and process requirements.
ResponsibilitiesDefine who performs the checks, who makes decisions and which records must be retained.
ReadinessCheck that the solution is tested, documented and ready for production deployment.
Starting point
Compliance is not a product feature.
Technology supports compliance only when organisational responsibility, decision points, data handling and evidence retention are explicit.
Changing details
Evolving standards, RTS texts, provider terms and audit requirements.
Responsibility boundaries
Different roles for client, integrator, technology provider, QTSP and business data owner.
Provable operations
The design is not enough; decisions, configuration, tests and operations also need documentation.
Capabilities
Requirements, controls, architecture and implementation in one chain.
Regulatory gap assessment
Compare applicable obligations with current process, technology and documentation.
Use case and requirements
Translate legal expectations into journeys, system requirements and acceptance criteria.
Responsibility model
Define who carries out each task, who is accountable for decisions, and who must be consulted or informed (RACI). Separate the client’s and providers’ retention and incident-management responsibilities.
Control and evidence matrix
What each control proves, where it is produced, who evaluates it and how long it is retained.
Technology map
Relationships between eID, wallet, onboarding, signing, QTSP, DMS and archive.
UAT and readiness
Positive, negative and exception scenarios, audit package and go-live gates.
Integration
A shared map between business process and regulatory evidence.
Every requirement receives an owner, system function, control and retained result.
Regulation
eIDAS 2.0, AMLR, DÁP, local and sector requirements.
→Business use case
Onboarding, contracting, identity, signing, data sharing or long-term preservation.
→Control and decision
Automated check, operator review, business or compliance decision.
→Technology
API, workflow, provider, data source, DMS and monitoring.
→Evidence
Logs, validation, audit trail, configuration, test result and retention rule.
Journey
The compliance-readiness workflow.
The output is not a theoretical report, but an implementable backlog and verifiable target state.
Scope
Affected organisation, product, customer segment, channel and obligation.
Gap assessment
Evaluate current processes, systems, controls and documentation.
Target model
Process, responsibility, architecture, controls and evidence matrix.
Implementation
Priorities, roadmap, development, provider connections and documentation.
Test and handover
UAT, compliance testing, audit readiness, operations and renewal model.
Use cases
Focus areas
eIDAS 2.0 readiness
Relying-party role, wallet acceptance, attestations and electronic signing.
AMLR onboarding
Primary eID / wallet route, alternative remote methods and CDD controls.
DÁP connection
eIdentification and eSignature roles, audit, system controls and operations.
Signing and preservation
Legal effect, validation, LTA, timestamping and document lifecycle.
Delivery
Specialist, implementation-oriented advice.
Our advisory work relates to signing, identity, wallet and preservation solutions. Alongside technical and business support, we can arrange legal support through collaborating law firms.
Joint planning workshop
Agree implementation requirements with business, legal, compliance, information-security, development and operations teams.
Decision documentation
Assumptions, alternatives, risks, selected design and dependencies.
Implementation backlog
Requirement, user story, interface, control, test case and acceptance criterion.
Change monitoring
Reassessment of standards, implementation details and provider conditions.
Frameworks in scope
eIDAS 2.0AMLRAMLA CDD RTSDÁPlocal AML rulesETSI · ENISAEUDI Wallet ARFEU DSS
READINESS
Which regulatory change reaches the business process first?
A short assessment identifies affected use cases, current gaps and decisions that need to be made.
Readiness workshop↗