six rulebooks.
nine jobs.
one set of proof.
NIS2, DORA, GDPR and the AI Act overlap more than they look. This site shows what to decide, who owns it and what to build, for EU companies doing this for the first time.
nine pieces of work, six rulebooks
NIS2DORAGDPRAI ActISO 27001SOC 2
- the text asks for this directly
- a reasonable link, an interpretation
- no direct duty found
basis articles listed on the map page. ISO 27001 and SOC 2 numbers were not re-read at source.
one event, three clocks
4 hours24 hours72 hours1 month
NIS2
early warning, from becoming aware of a significant incident
incident notification with a first assessment
final report, one month after the notification
DORA
initial notification, 4 hours after classifying as major
that same notification, 24 hours after awareness at the latest
intermediate report, 72 hours after the initial one
final report, one month after the last intermediate
GDPR
tell the authority, where feasible, unless a risk to people is unlikely
basis NIS2 Art. 23(4); RTS 2025/301 Art. 5(1); GDPR Art. 33(1), 34(1); KSC Art. 11
from a control to an answer
- 1the control runsan access review, a restore test, a board decision
- 2it leaves a recorda dated export, a signed sheet, a minute
- 3an owner checks ita named person, on a set rhythm
- 4it gets filedone place, named by date and control
the same file answers
- your boardwhat did we decide, and is it running?
- an auditorshow me the last one
- a regulatorwere your measures appropriate?
- a customerthe security questionnaire
basis GDPR Art. 5(2), 24(1); NIS2 Art. 21(2)(f)
what people believe
- “we report it once we know what happened”Dutch Data Protection Authority, announced 31 March 2021
- “the supplier ran it, so the breach is theirs”Polish Personal Data Protection Office (UODO), announced 21 July 2025
- “if we get hacked, we automatically lose”Court of Justice of the EU, Third Chamber, 14 December 2023, C-340/21
- “we fixed the breach, so we are done”Irish Data Protection Commission, announced 17 December 2024
the dates
what has passed, what is next
2025202620272028
NIS2
14
NIS2 in Poland
681012
DORA
2
AI Act
35791113
today, at the last build. Hollow dates have passed.
- 117 October 2024 deadline for member states to write NIS2 into national law
- 217 January 2025 DORA applies
- 32 February 2025 bans on prohibited practices and the AI literacy duty apply
- 417 April 2025 member states due to have their first list of essential and important entities
- 52 August 2025 general-purpose model rules and the penalties chapter apply
- 63 April 2026 amended national cybersecurity act in force
- 72 August 2026 general application, including the transparency duties
- 83 October 2026 last day to apply for the entity register, for those in scope on 3 April 2026
- 92 December 2026 two added prohibitions apply; machine-readable marking duty for generators placed on the market before 2 August 2026
- 103 April 2027 chapter 3 duties due, for those in scope on 3 April 2026
- 112 December 2027 high-risk rules apply to Annex III systems, such as recruitment tools
- 123 April 2028 first audit due for essential entities; most fines can be imposed after this date
- 132 August 2028 high-risk rules apply to AI inside regulated products
basis listed row by row in the table on the dates and fines page
start with the one you were told about
- NIS2The EU cybersecurity directive for 18 sectors. It reaches you through your national law and comes with a board signature, 24-hour warnings and ten kinds of security work.
- DORAICT resilience for finance, applying directly since 17 January 2025. If you sell software to a bank, it arrives on your desk as contract terms.
- AI ActIf your staff use AI at work, you are probably a deployer. The high-risk dates moved in July 2026. The literacy duty and the bans did not.
- GDPRIt almost certainly applies to you already. This page covers the security side: appropriate measures, processors, the 72-hour clock and being able to show your work.
- ISO 27001A voluntary standard for running security as a management system. No law requires it. Customers often do, and it gives the laws a structure to hang on.
- SOC 2A report from a licensed auditor on your controls, built on US audit standards and asked for in sales questionnaires. No law requires it, and new criteria were proposed in October 2026.