the rules
Four EU rules and two voluntary standards: who each one covers, what it comes down to and what has moved.
- NIS2The EU cybersecurity directive for 18 sectors. It reaches you through your national law and comes with a board signature, 24-hour warnings and ten kinds of security work.
- DORAICT resilience for finance, applying directly since 17 January 2025. If you sell software to a bank, it arrives on your desk as contract terms.
- AI ActIf your staff use AI at work, you are probably a deployer. The high-risk dates moved in July 2026. The literacy duty and the bans did not.
- GDPRIt almost certainly applies to you already. This page covers the security side: appropriate measures, processors, the 72-hour clock and being able to show your work.
- ISO 27001A voluntary standard for running security as a management system. No law requires it. Customers often do, and it gives the laws a structure to hang on.
- SOC 2A report from a licensed auditor on your controls, built on US audit standards and asked for in sales questionnaires. No law requires it, and new criteria were proposed in October 2026.
your next step
Not sure which of these touch you? Six questions will narrow it down.