Careers

Where the rules shape the work.

Each sector works to its own rules and deadlines.

Let's talk

Banking

Banks and investment firms, where every change is audited and many deadlines are set by the regulator.

Typical situations

  • A regulatory date that cannot move: DORA remediation, the move to the EU AML Regulation, instant payments.
  • A core banking system, data platform or payment chain to change without interrupting service.
  • A backlog of client files, periodic reviews or transaction alerts to clear, to the standard your regulator expects.

What matters in this sector

  • DORA, Regulation (EU) 2022/2554, has applied to banks since 17 January 2025, with major ICT incident reporting, a register of ICT third-party arrangements and exit strategies for critical or important functions.
  • Since 9 October 2025, the Instant Payments Regulation, (EU) 2024/886, has required euro-area banks to send instant euro transfers and to offer verification of the payee's name against the IBAN.
  • The Anti-Money Laundering Regulation, (EU) 2024/1624, applies from 10 July 2027. AMLA, the EU authority in Frankfurt, begins direct supervision of certain high-risk cross-border banks and financial institutions in 2028.

Expertise we bring to this sector

Insurance

Insurers and brokers, where solvency, conduct and data rules shape every change.

Typical situations

  • A regulatory programme with a fixed date: the Solvency II review, DORA, recovery and resolution planning.
  • Policy administration or claims systems to modernise while contracts keep running.
  • Actuarial, finance and risk teams that need reliable data and reporting, on time.

What matters in this sector

  • DORA has applied to insurers and reinsurers under Solvency II since 17 January 2025. On 18 November 2025 the ESAs designated the first critical ICT third-party providers for direct EU oversight.
  • The Solvency II review, Directive (EU) 2025/2, and the Insurance Recovery and Resolution Directive, (EU) 2025/1, both apply from 30 January 2027.
  • The Anti-Money Laundering Regulation, (EU) 2024/1624, applies from 10 July 2027 to insurers carrying out life or other investment-related insurance activities.

Expertise we bring to this sector

Life Sciences

Pharmaceutical, biotech and medical device companies, where systems are validated and every change is documented.

Typical situations

  • A system to validate or revalidate, with the documentation an inspection expects.
  • A regulatory transition to plan for, such as the medical device and in vitro diagnostic rules.
  • Clinical, quality or manufacturing data to bring together without breaking its audit trail.

What matters in this sector

  • Legacy medical devices may be put on the market until 31 December 2027 or 2028, legacy in vitro diagnostics until 31 December 2027, 2028 or 2029, by class and under conditions (Regulations (EU) 2023/607 and 2024/1860).
  • Since 28 May 2026, the first four EUDAMED modules are mandatory: actor registration, UDI and device registration, notified bodies and certificates, and market surveillance (Commission Decision (EU) 2025/2371).
  • Regulation (EU) 2026/1744 moved the AI Act's high-risk obligations for AI in medical devices and in vitro diagnostics assessed by a notified body from 2 August 2027 to 2 August 2028.

Expertise we bring to this sector

Transport & Logistics

Transport operators, logistics providers and ports, whose schedules and flows the public and supply chains rely on every day.

Typical situations

  • Scheduling, ticketing or asset systems where an outage is visible to the public the same day.
  • Warehouse, fleet or freight systems to integrate while goods keep moving.
  • Electronic freight documents and data exchanges to prepare with partners and authorities.

What matters in this sector

  • NIS2 treats air, rail, water and road transport as a sector of high criticality, from airlines, airports and ports to rail undertakings and traffic authorities. Postal and courier services are also covered.
  • Under Regulation (EU) 2020/1056, from 9 July 2027 authorities in every Member State must accept freight transport information shared through certified eFTI platforms; for operators, using eFTI remains a choice.
  • Under the EU ETS, shipping companies surrender allowances for 70% of their 2025 emissions by 30 September 2026 and for all 2026 emissions in 2027, now including methane and nitrous oxide.

Expertise we bring to this sector

Public Services

Public administrations and institutions, whose services citizens and businesses rely on every day.

Typical situations

  • A programme bought through a framework agreement, with the documentation and reporting the procedure requires.
  • Digital services for citizens or members that must be accessible, secure and available in more than one language.
  • Case management or benefit systems to modernise while the service stays open.

What matters in this sector

  • Public sector websites and mobile apps must meet the Web Accessibility Directive (EU) 2016/2102, with an accessibility statement and a feedback mechanism.
  • Every member state must offer a European Digital Identity Wallet by the end of 2026, under Regulation (EU) 2024/1183.
  • Since 12 January 2025, the Interoperable Europe Act, Regulation (EU) 2024/903, requires public bodies to assess interoperability before setting new binding requirements for trans-European digital public services.

Expertise we bring to this sector

Retail & Consumer Goods

Retailers, distributors and consumer goods companies, whose stores, warehouses and online channels run every day.

Typical situations

  • Stores, warehouses or online shops that must keep running while systems change.
  • An ERP programme with a fixed horizon, such as moving off SAP ECC before its mainstream maintenance ends.
  • Supply chain, pricing and product data that has to be integrated, reliable and ready every morning.

What matters in this sector

  • Since 28 June 2025, the European Accessibility Act requires e-commerce services and listed products, such as computers, smartphones and self-service terminals, to meet accessibility requirements; microenterprises providing services are exempt.
  • Since 13 December 2024, the General Product Safety Regulation requires online offers to show the manufacturer, product identification and warnings or safety information, and sets specific duties for online marketplaces.
  • The EU Deforestation Regulation's due diligence rules for products such as cocoa, coffee, palm oil, soya and wood apply from 30 December 2026, and from 30 June 2027 for most micro and small operators.

Expertise we bring to this sector

Aerospace & Defence

Defence organisations and the aerospace and security industry, where security, discretion and long programme horizons shape the work.

Typical situations

  • Programmes where clearances, discretion and continuity over several years matter.
  • Logistics, maintenance and information systems to modernise while operations continue.
  • Cooperation with allied and European partners that requires common standards and teams that work in English.

What matters in this sector

  • Defence and security procurement follows Directive 2009/81/EC.
  • The European Defence Industry Programme, Regulation (EU) 2025/2643, in force since 30 December 2025, provides EUR 1.5 billion for 2025 to 2027.
  • SAFE, Regulation (EU) 2025/1106 of 27 May 2025, offers up to EUR 150 billion in loans for common defence procurement; at least 65% of component costs must come from the EU, EEA EFTA or Ukraine.

Expertise we bring to this sector

Manufacturing & Industry

Manufacturers and industrial companies, where production, maintenance and IT systems have to work as one.

Typical situations

  • Plants and production lines that must keep running while IT and operational systems converge.
  • Products with software inside that must meet new cybersecurity and machinery rules.
  • An ERP or manufacturing systems programme with a fixed horizon, such as moving off SAP ECC.

What matters in this sector

  • Since 11 September 2026, manufacturers of products with digital elements must report actively exploited vulnerabilities and severe incidents; the Cyber Resilience Act's main obligations apply from 11 December 2027.
  • The Machinery Regulation (EU) 2023/1230 applies from 20 January 2027, replacing Directive 2006/42/EC; it covers protection against corruption through connected devices and software, and allows instructions in digital format.
  • NIS2 covers medium-sized and large manufacturers of medical devices, electronics, electrical equipment, machinery, motor vehicles and other transport equipment, and producers and distributors of chemicals.

Expertise we bring to this sector

Energy & Utilities

Energy producers, network operators and water utilities, whose operations run continuously and depend on reliable data.

Typical situations

  • Plants and networks that must keep running while IT and operational systems converge.
  • Metering, market and customer data that has to be reliable and ready on time.
  • Security and resilience obligations to meet as an essential or critical entity.

What matters in this sector

  • Under NIS2, Directive (EU) 2022/2555, energy (electricity, district heating and cooling, oil, gas, hydrogen), drinking water and waste water are sectors of high criticality listed in Annex I.
  • Member states had to identify their critical entities under the CER Directive by 17 July 2026; identified entities then have ten months to take resilience measures and notify incidents.
  • Regulation (EU) 2024/1106 revised REMIT in May 2024; the recast REMIT implementing regulation and a new delegated regulation entered into force on 29 April 2026.

Expertise we bring to this sector

Healthcare

Hospitals, care providers and health insurers, where patient data, security and continuity of care come first.

Typical situations

  • Clinical or administrative systems to change while care continues around the clock.
  • Patient data to exchange securely between providers, with consent and access rules respected.
  • Security obligations to meet across networks, medical devices and suppliers.

What matters in this sector

  • The European Health Data Space Regulation (EU) 2025/327 applies from 26 March 2027. Rules for patient summaries and ePrescriptions follow on 26 March 2029, for images, laboratory results and discharge reports on 26 March 2031.
  • Under the NIS2 Directive (EU) 2022/2555, healthcare providers belong to a sector of high criticality (Annex I). Member States had to apply its rules from 18 October 2024.
  • Under the AI Act as amended by Regulation (EU) 2026/1744, high-risk rules apply from 2 December 2027 to uses such as emergency patient triage, and from 2 August 2028 to AI in medical devices.

Expertise we bring to this sector

The notes on regulation summarise the rules and dates, in force or announced as of September 2026, that shape the work in each sector. They are not legal advice: which obligations apply to your organisation depends on its own situation.

Tell us about your sector.

A dedicated Neurho Single Point of Contact (SPOC) comes back to you with a first reading of your constraints and the expertise to bring together.

Describe your context