NIS2
Directive (EU) 2022/2555
Detection capability, incident handling and supplier risk for more than 160,000 European entities across eighteen sectors. Early warning within 24 hours, full notification within 72.
Exposure
€10M or 2%
Status
In force
REGULATORY REPORTING & EUROPEAN MANDATES
Compliance
Five regulations. One evidence base.
Most organisations rebuild their evidence from scratch for each audit, for each regime. The controls overlap heavily — so we maintain one evidence base and map it to whichever regulator is asking.
DORA
Regulation (EU) 2022/2554
Operational resilience for financial entities: tested recovery, ICT third-party oversight, and threat-led penetration testing for the significant ones.
Exposure
Supervisory action
Status
Binding since Jan 2025
CRA
Cyber Resilience Act
Security obligations on manufacturers of digital products: vulnerability handling, a PSIRT function, SBOMs, and 24-hour ENISA reporting of exploited flaws.
Exposure
€15M or 2.5%
Status
Reporting binds Sept 2026
GDPR
Regulation (EU) 2016/679
Personal-data protection, breach notification within 72 hours, and the privacy constraints that shape any monitoring you deploy on your own staff.
Exposure
up to €20M or 4%
Status
In force
AI Act
Regulation (EU) 2024/1689
Risk classification, documentation and human oversight for AI systems — including the AI you buy, and the AI inside your security tooling.
Exposure
up to €35M or 7%
Status
Phasing in
The overlap is the opportunity
Access control, logging, incident handling, supplier risk and business continuity appear in almost all five regimes with different wording. Build the control once, evidence it once, and map it five ways. That is why a second regime costs a fraction of the first.
We prepare files. We do not sign them.
Certification against ISO 27001, and CRA conformity where a third party is required, is issued by an accredited body — never by us. We take you to audit-ready and we sit with you through the audit. Anyone who offers you a certificate directly is selling you a problem.
Figures shown are statutory maxima and are given for orientation, not as legal advice. The AI Act ceiling shown applies to prohibited practices; other breaches carry lower ceilings. Confirm your own exposure with counsel.
