This case study explains, in practical terms, how to turn a regulatory requirement into a real compliance project. Regulations and directives (GDPR, NIS2, AI Act, DORA, Cyber Resilience Act and national implementing measures) often require technical, organizational and contractual work that must be managed as a project.

Context and objective

The organization in this example is a mid-size technology company providing cloud services to professional clients. The compliance drive came from a mix of obligations: strengthening cybersecurity, updating contracts with customers and suppliers, and demonstrating control over personal data processing and systems using AI models.

Project objective: achieve a sustainable compliance baseline within 10 months, reducing legal and operational risk and creating repeatable processes for ongoing compliance.

Project phases

  1. Initial assessment (2–4 weeks)

    • Preliminary mapping: critical assets, data flows, main suppliers.
    • Stakeholder interviews: IT, legal, sales, operations, DPO (if present).
    • Deliverable: scope report with identified gaps and critical risks.

  2. Gap analysis and prioritization (3–6 weeks)

    • Technical and organizational assessment against applicable requirements.
    • Classify gaps by impact and likelihood.
    • Create a roadmap with priorities (quick wins, medium-term fixes, strategic projects).

  3. Operational plan and resourcing (2 weeks)

    • Break down into work packages: access controls, encryption, logging, DPIA, supplier contracts, training.
    • Estimate effort and minimum budget for a compliance MVP.
    • Assign owners: project lead, IT contacts, legal, DPO, executive sponsor.

  4. Implementation (4–24 weeks, iterative)

    • Execute priority interventions in sprints: perimeter security, system hardening, log retention, vendor contract updates.
    • Produce compliance deliverables: records of processing, DPIAs for high‑risk processing, incident handling procedures.
    • Targeted training for ops teams and management.

  5. Verification and testing (2–4 weeks)

    • Functional and security testing: verify implemented controls.
    • Internal audit of processes and documentation.
    • Remediate non‑conformities.

  6. Production rollout and maintenance

    • Operationalize processes: change control, periodic metrics, audit plan and continuous improvement loop.

Common mistakes found (and fixes)

  • Scope too broad initially: the project aimed to fix everything. Fix: define a compliance MVP focused on critical risks and contractual obligations.
  • Lack of executive sponsorship: activities stalled due to competing priorities. Fix: brief the board on residual risk and secure an executive sponsor to authorize resources and timelines.
  • Missing or outdated documentation: impossible to prove controls. Fix: create standard templates (records of processing, security policies, vendor SLA) and require documentation within work packages.
  • Poor communication between legal and IT: requirements not translated into technical measures. Fix: run workshops with a shared vocabulary and attach technical checklists to each legal requirement.
  • Weak vendor management: critical suppliers without proper clauses. Fix: prioritize contractual review and insert security and audit clauses in new or renegotiated contracts.

Practical deliverables and checklists

  • Up‑to‑date record of processing with data flows, legal bases and retention times.
  • DPIA for cloud services and use of AI models affecting sensitive data.
  • Risk register with priorities and associated action plan.
  • Contract clause templates: security obligations, subprocessors, incident notification.
  • Incident response plan and playbooks for common scenarios.
  • Control verification reports: privileged access, at‑rest/in‑transit encryption, logging and retention.

Recommended KPIs and metrics

  • Percentage of critical gaps closed per quarter.
  • Mean time to patch for critical vulnerabilities.
  • Percentage of suppliers assessed with updated clauses.
  • Number of DPIAs completed for high‑risk processes.
  • Mean detection and response times for incidents (MTTD/MTTR).

Role organisation

  • Sponsor (Board): approves budget and priorities.
  • Project owner: operational coordination.
  • CISO/Security lead: technical decisions and control oversight.
  • DPO/Privacy lead: validate DPIAs and records of processing.
  • Procurement/legal lead: contracts and clauses.
  • IT/DevOps/Operations teams: technical implementation and change control.

Lessons learned and final recommendations

  • Start from concrete risks and obligations: don’t chase immediate normative perfection. Prioritize what reduces operational and legal risk.
  • Document everything: compliance is demonstrated with repeatable evidence.
  • Integrate compliance into the service lifecycle: from design to decommissioning.
  • Treat suppliers and third parties as an extension of your risk perimeter.
  • Plan internal capability and, where necessary, complement with external specialists for niche gaps.

This case study is deliberately hypothetical, intended to provide a practical, repeatable path. Each organisation should adapt timelines, resources and deliverables to its size and specific risks.