Plain-language writing on the concepts behind compliance and regulatory change and how this works in practice. No jargon, no assumed background.
Usually not. If a separate BNPL company grants the credit, that company needs an AFM licence and your shop is at most an intermediary on the side. Your own interest-free 'pay later' stays outside the rules only if the customer pays within 50 days of delivery, or within 14 days if you are a large online seller.
Not directly, but it reaches you through the contract. DORA keeps the bank fully responsible and prescribes what every ICT contract must say, from audit rights to exit plans. Separately, a medium-sized or larger managed service, cloud or data centre provider falls under the Dutch Cyberbeveiligingswet in its own right.
Not from December: the labelling duties in Article 50 of the EU AI Act have applied since 2 August 2026. If you publish a deepfake, or AI-written text on a matter of public interest without editorial review, you must disclose it now. 2 December 2026 is a grace period for AI vendors, not for you.