The Draft Proposed Article sets out objectives, scope and key definitions for the proposed regulatory instrument, identifying covered entities, activities and territorial reach. It establishes core obligations including governance, risk assessment, record‑keeping, transparency and data protection measures, and prescribes risk‑based technical and organisational safeguards.

The text specifies supervisory powers, reporting and notification duties, compliance timelines, enforcement mechanisms and proportionate sanctions, and provides for cooperation between competent authorities, periodic review and stakeholder consultation. Transitional arrangements, delegated acts and provisions for exemptions or derogations are also included.