Why regulatory simplification is generating the most demanding compliance year on record
The EU regulatory simplification agenda was not supposed to look like this. In December 2025, the Council of the EU adopted conclusions calling on the European Commission to reduce unnecessary complexity, align definitions across legislation, and eliminate duplicative reporting obligations. The ambition was clear: a lighter, more coherent regulatory framework that would improve competitiveness without compromising financial stability.
What 2026 actually delivered is a simultaneous wave of implementation deadlines unlike anything financial institutions have faced before. DORA, which entered into force in January 2025, has moved from a compliance project into full supervisory scrutiny. New MiFID/MiFIR transparency obligations applied from 2 March. ESG rating providers come under direct ESMA supervision on 2 July. The AI Act reaches broad applicability on 2 August. The simplification agenda is real, but it is a promise about the future. The implementation obligations are happening now.
For compliance officers, CFOs, and heads of operations at European financial institutions, the gap between political rhetoric and operational reality has rarely been wider.
A simplification agenda built on an unfinished rulebook
The EU Council’s December 2025 conclusions were the latest step in a simplification drive that President von der Leyen had placed at the heart of her 2024 agenda. The stated objective was a “simpler and faster Europe,” with all Commissioners asked to contribute to reducing administrative burdens. For financial services, Commissioner Albuquerque’s portfolio priorities included the creation of a Savings and Investments Union alongside the simplification of reporting requirements.
On 11 December 2025, the European Central Bank published recommendations from its own high-level task force on simplification, endorsing the principle of reducing the regulatory and supervisory framework for credit institutions while maintaining resilience. The following day, the Council issued its own conclusions, noting that EU financial services regulation had become “more complex and more extensive than necessary” and calling for a focus on eliminating duplications and outdated provisions.
What these statements did not address was the immediate calendar. Firms were not waiting for future simplification. They were simultaneously managing the activation of frameworks agreed years earlier, each with its own technical standards, supervisory expectations, and implementation costs.
DORA: from project to scrutiny
DORA has applied since 17 January 2025, establishing a harmonised framework for ICT risk management across more than 20 categories of financial entities. During 2025, institutions focused on implementing the core building blocks: governance arrangements, ICT risk controls, incident classification and reporting processes, and third-party risk registers.
In 2026, the focus has shifted. Regulators have made clear that the transition year is over. Supervisors are now testing whether firms are actually applying the rules in their day-to-day operations, not just documenting compliance. Critical ICT third-party providers were formally designated in November 2025, bringing cloud platforms, payment processors, and large technology vendors under direct EU-level oversight for the first time. Joint Examination Teams are beginning their work.
The Register of Information, which documents all contractual arrangements with ICT third-party providers, required its first annual submission in early 2026 with a reference date of 31 December 2025. According to a survey by Deloitte referenced in industry analysis, 96% of institutions had estimated compliance costs for DORA, with most falling between 2 and 5 million euros. Only half expected to achieve full compliance by end of 2025, with 38% targeting 2026.
Threat-Led Penetration Testing has proven particularly difficult. Firms that underestimated the preparation time required have found themselves unable to engage qualified red team providers at short notice. The ECB has been explicit that testing should be a learning experience, not a procedural exercise, and that evidence of actual improvement is expected. For many institutions, this requirement alone has absorbed compliance resource that was already stretched across multiple workstreams.
MiFID, ESG ratings, and the AI Act: three deadlines in five months
Overlapping with DORA’s supervision phase, three separate regulatory frameworks have reached or are approaching implementation deadlines between March and August 2026.
On 2 March 2026, the revised MiFIR transparency regime applied to bonds, structured finance products, exchange-traded commodities and notes. The new framework reshaped pre- and post-trade disclosure obligations, introducing more granular deferral sequences based on instrument type and size. For trading venues, investment firms, and approved publication arrangements, the technical changes required system updates, reporting infrastructure adjustments, and training. The EU bond consolidated tape is expected to become operational by end of 2026, adding another layer of market data governance.
On 2 July 2026, ESMA becomes the direct supervisor of ESG rating providers operating in the EU, under the ESG Ratings Regulation adopted in 2024. The notification deadline for large providers falls on 2 August, with smaller providers following on 2 November. Asset managers who rely on external ESG ratings as inputs for SFDR disclosures will need to verify that their data providers are registered and compliant. Methodology disclosures and conflict-of-interest separation requirements will alter how ratings are produced and marketed.
On 2 August 2026, the AI Act reaches broad applicability for high-risk AI systems. Financial institutions using AI for credit scoring, insurance underwriting, automated trading, or HR management will need to demonstrate structured risk management, technical documentation, data governance, and human oversight provisions. Penalties for non-compliance can reach 35 million euros or 7% of worldwide turnover. The European Commission’s Digital Omnibus package, proposed in November 2025, may delay enforcement of some high-risk obligations by up to 16 months if technical standards are not yet available, but the proposal remains under negotiation and no delay can be assumed.
Taken individually, each of these deadlines represents a meaningful operational project. Landing them simultaneously, within a five-month window, while also managing DORA supervision, is a sequencing problem that compliance budgets were not designed to absorb.
The consulting paradox: simplification creates demand
There is an irony in the current situation that has not been lost on compliance teams. The EU’s simplification agenda, intended to reduce regulatory burden, has in the short term generated more consulting and implementation work than almost any previous legislative cycle. Each simplification package requires gap analysis, project scoping, and legal interpretation. Each new or revised technical standard requires system changes. Each supervisory shift, from implementation to scrutiny, requires evidence gathering and process documentation.
Bloomberg’s EU Regulatory Outlook for 2026 noted that the year would be “dominated less by new rulemaking and more by the operational consequences of reforms already agreed.” That observation is accurate, but it understates the intensity. The operational consequences of five years of overlapping legislation, all reaching activation simultaneously, are being felt across compliance teams, technology departments, and risk functions at the same time.
For asset managers, fund administrators, and banks operating in Luxembourg and across the EU, the resource constraint is structural. Experienced professionals who can work across DORA ICT risk, AI Act governance, and SFDR data quality are not available in sufficient numbers from permanent hiring alone. The Luxembourg talent market, where compliance and regulatory profiles are already described by recruiters as “limited in quantity” and under persistent salary pressure, cannot supply the depth of specialist knowledge required across all active workstreams simultaneously.
Institutions that have navigated this period most effectively have typically done so by combining internal teams with targeted external expertise: deploying specialists for defined periods on specific workstreams rather than attempting to build all capabilities in-house. The economics are straightforward: a senior compliance specialist engaged for a defined period on a single workstream costs less than a permanent hire and delivers faster than internal training. Firms like We Put You in Touch exist precisely for this gap.
What genuine simplification would require
The EU Council’s December 2025 conclusions were explicit that simplification should not mean deregulation. The core pillars, capital requirements, consumer protection, financial crime controls, and supervisory oversight, are not negotiable. But the Council also acknowledged that coordination, timing, and sequencing of legislation matter. A regulatory environment that introduces five major implementation deadlines in a single calendar year is not simple, regardless of what individual frameworks may say about reducing compliance costs.
The Digital Omnibus package addresses part of this by proposing a single incident reporting point for DORA, NIS2, and GDPR obligations, which would reduce the current duplication across frameworks. Aligning definitions and removing genuinely redundant provisions would help at the margins. But the more fundamental issue, that legislation agreed across multiple years activates simultaneously, cannot be resolved retroactively. The 2026 calendar is fixed.
What institutions can control is how they resource the period. The regulatory simplification agenda will, over time, reduce certain compliance burdens. Until then, the firms that manage this year most effectively will be those that are honest about their capacity constraints, selective about how they deploy internal resource, and willing to bring in external expertise where the gap is real.
The promise of a simpler regulatory environment is not wrong. It is just not 2026 yet.
References
- Council of the EU – Conclusions on simplifying EU financial services regulation (12 December 2025)
- European Central Bank – Recommendations of the High-Level Task Force on Simplification (11 December 2025)
- Bloomberg Professional Services – EU Regulatory Outlook 2026 (February 2026)
- Taylor Wessing – What’s in store for EU financial regulation 2026 (January 2026)
- A&O Shearman FinReg – Council of EU adopts conclusions on simplifying EU financial services regulation (December 2025)
- K&L Gates – EU and Luxembourg Update on AI Act: Recent Developments (January 2026)
- European Commission – AI Act implementation timeline (digital-strategy.ec.europa.eu)
- Tradeweb – From implementation to insight: early lessons from the UK transparency regime and what comes next in the EU (February 2026)
- InnReg – DORA Regulation Explained (2026)
- Panorays / Deloitte Wave 3 Survey – Is Your DORA Strategy Ready for 2026? (referenced compliance cost and FTE data)
- Eviden / International Banker – Conquer DORA Compliance: Real Challenges from the Frontlines (2025)
- Thomas Murray Compliance Digest – The DORA Register of Information: 2026 Outlook and Guidance Investment Officer – Demand for compliance talent a 2026 priority for Luxembourg recruiters (2026)