Welcome back.

In Part 1, we covered four AI-driven gaps. Exciting and full of uncertainty.

This part is the opposite. Less exciting. Much more certain.

Every gap below comes with a date written into law. And just like in Part 1, the pressure lands hardest on companies in the middle: big enough to be covered, too small to have anyone whose job this is.

Here's the thing: a deadline is the best sales argument. Nobody needs convincing that the problem exists.

Let's break it down.

1. E-invoicing for micro and small firms (and what comes after)

Europe is switching B2B invoicing from PDFs to structured data. Large companies have ERP vendors handling it. Tradespeople, freelancers, small manufacturers, and the bookkeepers who serve them mostly don't.

In 2025, we wrote about friendlier process automation for SMEs. Turns out governments are about to force some of it.

Why now? Three countries, three dates, all in 2027:

• Germany: receiving e-invoices has been mandatory since 2025. From 1 January 2027, companies with prior-year turnover above EUR 800,000 must also issue them, and everyone else follows on 1 January 2028.
• France: all firms must be able to receive e-invoices from 1 September 2026. SMEs and micro-firms must issue them from 1 September 2027.
• Poland: the national KSeF system has been live for most VAT payers since February and April 2026. Micro-entrepreneurs with monthly sales of PLN 10,000 or less join on 1 January 2027 

What's the potential? Readiness is low, even in Germany, where the first deadline is closest. A Quadient study found that only 6% of German companies currently meet the requirements that take effect on 1 January 2027. A YouGov survey for Easybill found that one in three German companies has never sent an e-invoice, and only 42% send them regularly.

To be clear: both vendors sell e-invoicing. Still, two separate surveys point the same way.

What's the key to success? Don't sell compliance. Compliance becomes a commodity fast, and incumbents like DATEV, sevDesk, Lexware, and Pennylane already own the accounting relationship.

The real prize comes after the deadline. Once every invoice is structured data, you can predict who'll pay late, forecast VAT and offer financing at the right moment.

What you could build:

• A mobile-first e-invoice issuer for tradespeople and freelancers that supports XRechnung/ZUGFeRD, Factur-X and KSeF, with AI that captures line items from a photo or voice note.
• A bookkeeper co-pilot that onboards an accountant's 200 clients in bulk and flags anomalies in their invoice data.
• A cash-flow intelligence layer that turns structured invoices into predictive dunning, financing offers and VAT forecasts.

Risk check: Pricing will race to zero, so if compliance is your whole product, you don't have a business.

2. Pay transparency for employers with 100 to 250 staff

The EU Pay Transparency Directive changes a lot at once. Salary ranges go into job ads. Employers can't ask candidates about pay history. Employees get the right to ask how their pay compares. And employers have to report their gender pay gap.

Enterprises have reward teams. A 180-person company usually has a spreadsheet and an overloaded HR manager.

Why now? The transposition deadline was 7 June 2026. The first reports are due 7 June 2027 for employers with 150 or more staff, covering 2026 pay data. Employers with 250+ report every year after that. Those with 100 to 149 staff start in 2031.

Transposition is patchy, which makes the job harder, not easier. According to Lockton's tracker Italy, Greece, Lithuania, Malta and Slovakia have transposed the directive, while Germany and France were still drafting. So a company operating in three EU countries may face three versions of the same rule (Morgan Lewis explains what applies in the meantime).

What's the potential? Most employers aren't ready. The Mercer Global Pay Transparency Survey (published February 2026) found that only 9% of Europe-based employers have a pay-transparency strategy fully in place, compared with 14% globally.

The bottleneck is the foundations. In a Ravio survey (a compensation-software vendor), only 22% of employers planned to use a formal job-evaluation system, and 22% said clean HR data was a challenge. You can't report a fair pay gap if you can't say which jobs count as "equal work."

What's the key to success? Start with job architecture, not the report. The report is easy once jobs are levelled and data is clean. Getting there is where mid-sized firms are stuck.

There's a quieter angle too. Managers will get pay questions they've never had to answer, and how they answer shapes the employer brand.

What you could build:

• "Job architecture in a week": AI-assisted job levelling and gender-neutral job evaluation for mid-sized firms.
• A pay-gap report generator that plugs into local payroll systems, with templates for each country's version of the rules.
• A manager enablement kit that trains managers to handle employee pay-information requests honestly and consistently.

Risk check: HR-tech players like Workday, Personio and Ravio are moving down-market fast, so a new entrant needs a sharper niche than "pay transparency software."

3. Cyber Resilience Act readiness for small hardware and software makers

Back in 2023, we flagged cybersecurity as a gap: integrated security, a skills shortage, risky IoT devices. The Cyber Resilience Act has turned that general worry into specific legal duties.

Any manufacturer of a "product with digital elements" sold in the EU, from connected devices to apps and many software products, is in scope. They'll need secure-by-design documentation, a software bill of materials (SBOM, basically an ingredients list for your code) and a commitment to support the product for a defined period.

Why now? The first duty already applies. Since 11 September 2026, manufacturers have had to report actively exploited vulnerabilities through ENISA's Single Reporting Platform: an early warning within 24 hours, a notification within 72 hours, then a final report. The main obligations apply from 11 December 2027.

What's the potential? Almost everyone affected is small. The EU's Digital Innovation Hubs note that more than 99% of hardware manufacturers and software developers in the EU market are SMEs.

And the regulator's own data shows they're struggling. ENISA surveyed 194 SMEs across 31 countries in early 2026 (summarised in a Cloud Security Alliance research note). 66% had heard of the CRA, but practical understanding lagged. Microenterprises scored about a full maturity point below medium-sized firms. 142 of the 194 said they need financial support, and more than 70% asked for practical templates.

Wild, right? The regulator's own survey says the regulated are asking for templates.

The gap crosses borders too. Dev shops in North Macedonia and the wider Western Balkans build plenty of products for EU clients, and CRA questions will land on their desks.

What's the key to success? Make it routine. Small makers need SBOMs, vulnerability monitoring and reporting built into the release process, so compliance happens as a by-product of shipping.

What you could build:

• A "CRA in a box" platform with SBOM generation, vulnerability monitoring, a 24h/72h reporting workflow and technical-file templates.
• A fractional product-security officer service for device makers that can't justify a full-time hire.
• Secure update and lifecycle infrastructure for small IoT makers, covering over-the-air updates and support-period management.

Risk check: GitHub, Snyk and open-source tools already cover parts of this, and some product classes need third-party assessment, which brings liability for anyone advising on it.

4. Carbon and product data for small suppliers and exporters

Here's the twist. The EU's 2026 Omnibus cut direct CSRD reporting back to the largest companies. Many small firms read that as "not our problem anymore."

Not quite. The data duties moved down the supply chain, and now arrive product by product: embedded carbon for CBAM goods, questionnaires from big customers, and digital product passports.

We first touched this area in 2023 with green gaps like textile recycling and renewable energy consulting, and again in 2025 with simplified compliance. This time, someone has to produce the numbers.

Why now? Three separate deadlines:

• CBAM, the carbon border tax on imports: after the 2025 simplification regulation (EU) 2025/2083, certificate sales start on 1 February 2027, and the first annual declaration and certificate surrender for 2026 imports is due 30 September 2027. This is the first time CBAM actually costs money.
• CSRD value-chain cap: under the Omnibus directive (Directive (EU) 2026/470), CSRD now covers only firms with more than 1,000 employees and more than EUR 450 million turnover (A&O Shearman summary). Smaller suppliers can decline data requests that go beyond the EU's voluntary SME standard, VSME, from financial years starting in 2027 (CSRD Tools). In practice, that makes VSME the default ESG data format for small suppliers.
• Battery passport: from 18 February 2027, EV batteries, light-transport batteries (think e-bikes and e-scooters) and industrial batteries above 2 kWh need a digital passport under the Batteries Regulation (EU) 2023/1542.

What's the potential? CBAM is the sharpest of the three. Its 50-tonne annual threshold removes about 90% of importers but keeps about 99% of embedded emissions in scope, according to compliance summaries of the Commission's assessment (Karbonet, Regulatory Reporting Desk). Fewer companies, but the ones moving serious volumes of steel, aluminium, cement, fertiliser and hydrogen.

This is where our own region comes in. CBAM is paid by EU importers, but the emissions data has to come from the producers outside the EU. That includes metal and component makers in North Macedonia and the rest of the Western Balkans. An EU buyer that can't get installation-level data has to fall back on default values, which are set conservatively. So a producer that can hand over clean, verified carbon data becomes a cheaper supplier to buy from. Carbon data is turning into a sales argument.

What's the key to success? Collect once, reuse everywhere. A small supplier might get a CBAM request, a VSME questionnaire and a passport requirement from three customers. The winning product holds one profile and reuses it.

Mind the business model, though. Customers want supplier data for free, so the payer may be the buyer or the bank, not the supplier.

What you could build:

• A supplier carbon and VSME data hub: one reusable profile per SME supplier, covering CBAM installation data, VSME answers and customer questionnaires.
• A CBAM service bureau that acts as declarant support for small EU importers, plus an emissions-data service for non-EU producers, which is a natural export-service play for the Western Balkans.
• Battery passport as a service for small battery and e-bike makers: data model, QR code and registry upload.

Risk check: The rules have already been simplified twice and may move again, so build for flexibility and don't bet the company on one regulation's current wording.

Compliance is the wedge. Capability is the product.

Look at all four gaps together and the same pattern shows up.

The deadline creates the demand. But the value comes after it: invoices that become cash-flow forecasts, pay data that shows where talent leaks, security processes that improve the product, carbon data that wins contracts.

Treat 2027 as box-ticking and you pay for compliance and get nothing back. Treat it as the reason to finally structure your data, and you come out more capable.

Solutions without strategy are just temporary fixes. That's true for regulation too.

And the same caveat as in Part 1: a watchlist is a starting point, not proof. Before you commit budget to any of these, put it through a proper validation step. 

Facing one of these deadlines?

If one of these deadlines is heading your way, or you're thinking about building a product around one, we'd be glad to talk it through.

At Solveo, our part is the strategy around the rule: finding where a requirement can become a better process, a stronger offer or a new service, and helping you launch it. That includes companies in our own region, as more EU obligations reach exporters and software houses here.

‍