Introduction

This practical overview helps organizations navigate GDPR, NIS2, the AI Act, DORA and the Cyber Resilience Act by comparing objectives, scopes and concrete obligations. Each section offers actionable guidance and an initial checklist to assess relevance.

How to approach the rules in a first assessment

  • Identify your main activity (digital service provider, essential service operator, critical supplier, AI developer, financial institution, hardware/software producer).
  • Map data and systems: what data you process (personal or non-personal), where it lives, and which services depend on it.
  • Verify roles and responsibilities (controller, processor, third-party provider, cloud provider).
  • Evaluate impacts: risks to individuals' rights, operational continuity and digital resilience.

Concise overview of each regulation

  • GDPR (data protection)

    • Goal: protect individuals' rights and freedoms regarding personal data processing.
    • Who is affected: any organization processing personal data of people in the EU or offering services to them.
    • Practical obligations: lawful bases for processing, data subject rights, records of processing where required, DPIAs for high-risk processing, technical and organizational measures.

  • NIS2 (network and information security)

    • Goal: raise the cybersecurity baseline for essential and digital services across the Union.
    • Who is affected: operators of essential services and digital service providers in sectors like energy, transport, health and digital infrastructure.
    • Practical obligations: risk management, incident reporting, security governance and resilience requirements.

  • AI Act (artificial intelligence regulation)

    • Goal: create a risk-based regulatory framework for AI systems with proportionate obligations.
    • Who is affected: providers, users, developers and integrators of AI systems.
    • Practical obligations: classify systems by risk level, maintain technical documentation, perform conformity assessments and manage risks; transparency and mitigation measures for high-risk systems.

  • DORA (digital operational resilience for financial sector)

    • Goal: ensure financial entities maintain digital resilience and manage ICT risks, including critical third-party providers.
    • Who is affected: financial institutions and critical ICT providers serving them.
    • Practical obligations: ICT risk management, resilience testing, third-party risk management and incident reporting.

  • Cyber Resilience Act (security of products with digital elements)

    • Goal: improve the security of products with digital components placed on the market.
    • Who is affected: manufacturers, importers and distributors of hardware and software with digital elements.
    • Practical obligations: security by design, vulnerability management, technical documentation and conformity requirements.

How the regulations interact

  • Complementarity: they often share core principles (risk management, accountability, transparency). GDPR focuses on individual rights, NIS2 and DORA on resilience and continuity, AI Act on AI-specific risks, Cyber Resilience Act on product security.
  • Operational priorities: start with inventorying data and services, risk assessments and mapping involved actors. Document decisions and controls to demonstrate coordinated compliance.
  • Supplier management: well-drafted contracts and supplier due diligence are essential because obligations can extend to or depend on third-party providers.

Initial operational checklist (for IT, compliance and governance teams)

  1. Initial mapping

    • List digital services and critical processes.
    • Identify types of data processed (personal, sensitive, operational).
    • Catalogue ICT suppliers and third parties.

  2. Role assessment

    • Determine who is controller or processor; identify critical service providers.
    • Check for presence and function of AI systems.

  3. Risk analysis

    • Assess risks to individuals' rights (perform DPIAs when needed).
    • Assess operational and continuity risks (resilience tests, incident response plans).

  4. Governance and responsibilities

    • Assign roles: security owner, DPO if required, incident response team.
    • Define internal policies for incident handling, vulnerability disclosure and supplier management.

  5. Technical and organizational controls

    • Access controls, encryption for sensitive data, logging and monitoring.
    • Patch management and update procedures for digital products and AI models.

  6. Documentation and evidence

    • Maintain processing records, impact assessments, test reports and supplier contracts.

Short practical examples

  • A small SaaS company: check GDPR for user data, evaluate whether NIS2 applies if the service is critical to a sector, comply with Cyber Resilience Act for software components and AI Act if automated decision-making is in use.

  • A bank: consider DORA for operational resilience, NIS2 for critical systems, GDPR for customer data and AI Act for scoring models.

Recommendations

  • Start with mapping: without an inventory of data and services you cannot assess obligations.
  • Use a risk-based approach and document decisions.
  • Involve legal, compliance and IT early and update supplier contracts.
  • Provide ongoing training on security and privacy for staff.

This guide is introductory. For complex situations or to define precise compliance measures, consult qualified legal and technical specialists.