Understand what applies to you. Then build the architecture that proves it.
NIS2, DORA, the AI Act and GDPR reach different parts of your organisation on different timelines. We establish which obligations are yours, what they require of the systems you already run, and in what order to close the gap.
A directive, which means it reaches you through your own country’s law.
NIS2 raises the baseline for cybersecurity across essential and important entities in the EU. Because it is a directive, the thresholds, registration duties and supervision regime arrive through national implementing acts — in Sweden, the Cybersecurity Act, in force since 15 January 2026. Two organisations in the same sector in different member states can face materially different obligations.
Scope arrives nationally
The sectors come from the directive; the thresholds, registration duty and audit regime come from the national act. Determining which applies to which legal entity is the first piece of work, not an assumption.
Management-body accountability
Management bodies must approve and oversee cybersecurity risk-management measures, follow training, and can be held liable for infringements. In Sweden, a supervisory authority can ask a court to bar a person from management functions at an essential entity.
Risk-management measures
Policies on risk analysis, incident handling, business continuity, supply-chain security, access control, cryptography and vulnerability handling — each required to be evidenced in the architecture, not only in a document.
Reporting on a clock
Early warning within 24 hours, notification within 72, a final report within one month. Whether those deadlines can be met is a question about detection and classification, answered before an incident rather than during one.
Supply chain
Obligations extend to the security of suppliers and service providers. Contractual terms and supplier assessment become part of the control set rather than a procurement afterthought.
Where CloudOptly fits
Scope determination with a written, defensible rationale. Obligations translated into architectural requirements with named owners. An incident-reporting chain tested against the clock. Reporting the management body can use to evidence oversight.
Is there a date in your calendar?
Organisations that missed the first round of NIS2 supervision usually get 180 days, not a year — enough time to be ready, not enough to be leisurely. If your date is further out the same programme stretches; the order of the work does not change.
See the sequenceA regulation, which means it applies directly and has done since January 2025.
DORA has applied across the EU since 17 January 2025 with no national act in between. It binds financial entities and, through them, the ICT providers they depend on. Ultimate responsibility for ICT risk sits with the management body of the financial entity.
Who it binds
Around twenty categories of financial entity, plus ICT providers designated as critical, who come under direct EU oversight. Suppliers to regulated entities inherit obligations through contract even where they are not themselves in scope.
ICT risk-management framework
A documented framework for identifying, protecting, detecting, responding and recovering, with the management body required to maintain enough knowledge to exercise its responsibility.
Incident classification and reporting
Major ICT-related incidents classified against prescribed criteria and reported on the regulator’s templates: initial, intermediate and final. The classification logic has to exist before the incident.
Resilience testing
A regular testing programme, and for significant entities threat-led penetration testing against live production systems — an exercise rather than an annual scan.
Third-party ICT risk
Prescribed contractual terms with every ICT provider, plus a Register of Information covering every arrangement, filed with the regulator. For most entities the register is a data-collection project in its own right.
Where CloudOptly fits
Gap analysis against the five pillars. The contractual and register work on third-party ICT risk. Incident classification and reporting workflows agreed in advance. Exit strategies and concentration risk assessed as architecture.
Where does your data actually sit, and who can reach it?
A regional datacentre answers almost none of the sovereignty question. What matters is who holds the encryption keys, who can access the control plane, which entity operates support, and which jurisdiction that entity answers to. Those are architectural facts, discoverable today.
Assess your positionObligations that depend on what the system does, and on whether you built it or deployed it.
The AI Act applies in stages. Prohibited practices have applied since 2 February 2025. High-risk obligations under Annex III follow from 2 December 2027, and Annex I systems from 2 August 2028. What applies to you depends on the risk class of each system and on whether you are its provider or its deployer.
System inventory first
You cannot classify what you have not listed. An inventory of AI systems in use, including those arriving inside third-party products, precedes every other obligation.
Risk classification
Prohibited, high-risk, limited-risk or minimal. The classification determines the obligations, and it is a decision that has to be recorded with its reasoning.
Provider or deployer
The same system carries different duties depending on your role. Fine-tuning or rebranding a model can move you from deployer to provider without anyone deciding to.
Documentation and logging
Technical documentation, record-keeping and logging requirements that are design constraints on the system, not paperwork produced afterwards.
Human oversight
Oversight has to be meaningful and specified: who can intervene, on what signal, and with what authority to stop the system.
Where CloudOptly fits
AI system inventory and risk classification. Provider-versus-deployer determination per system. Documentation, logging and oversight requirements expressed as architecture. Alignment with GDPR obligations on the same data.
The others, assessed against the same underlying work.
NIS2, DORA and the AI Act are what we are asked about most. They are not the only obligations that land on a European organisation, and most of them draw on controls you will already be building.
Framework mapping
Requirements across regulations, standards and internal policy mapped into one structure, so a control you already operate is not rebuilt for each new obligation.
Control ownership
Controls, responsibilities and tasks organised so every item has an owner and a date rather than a status colour.
Evidence tracking
Documentation and proof points attached to the requirement they satisfy, which is what makes the second assessment cheaper than the first.
Board reporting
Readiness scored, gaps ranked, and a report written for the management body rather than for the audit file.