Every regulation, explained.
What each framework is, who it applies to, what it requires — and how SenecAI helps you meet it.
EU AI Act
- The EU's risk-based law for AI systems and general-purpose AI (GPAI) models.
- Sorts AI into prohibited, high-risk, transparency and minimal-risk tiers.
- Obligations phase in from 2025; under the 2026 AI Omnibus deal, most high-risk duties move to December 2027 and August 2028.
- Providers, deployers, importers and distributors of AI systems in the EU market.
- Non-EU companies too, when their AI or its output is used in the EU.
- Providers of general-purpose AI models.
- High-risk providers: risk management, data governance, technical documentation, human oversight, conformity assessment and CE marking.
- Deployers: AI literacy, human oversight and use in line with instructions.
- Transparency: tell users they're interacting with AI and label AI-generated content.
- Inventory every AI system you build, buy or embed.
- Determine your role and each system's risk tier.
- Prepare the documentation, oversight design and conformity work your tier requires.
GDPR
- The EU's general data protection law for any processing of personal data.
- Covers AI training, inference and log data too.
- Gives individuals enforceable rights over their data.
- Any organisation processing personal data of people in the EU, wherever it is based.
- Both controllers and the processors acting on their behalf.
- A documented legal basis and records of processing for every activity.
- DPIAs for high-risk processing, and processing agreements with vendors.
- Breach notification within 72 hours; data-subject requests answered within one month.
- Map your data flows and review your legal bases.
- Run DPIAs and draft privacy notices, policies and T&Cs.
- Review vendor agreements and international data transfers.
NIS2
- The EU's updated cybersecurity directive, replacing the original NIS Directive.
- Transposed into national law, so details vary by member state.
- Medium and large "essential" and "important" entities across 18 sectors.
- Includes energy, transport, banking, health, digital infrastructure, ICT services and manufacturing.
- Some providers are in scope regardless of size.
- Cybersecurity risk-management measures, including supply-chain security.
- Incident reporting: early warning in 24 hours, notification in 72 hours, final report within a month.
- Management approves the measures and can be held personally liable.
- Confirm whether and how NIS2 applies to you.
- Build the governance, controls and incident-response process.
- Align with ISO 27001 so one framework covers both.
DORA
- The Digital Operational Resilience Act: the EU's ICT risk framework for finance.
- Applies directly across the EU since 17 January 2025.
- Banks, insurers, investment firms, payment and e-money institutions, crypto-asset service providers.
- ICT third-party providers serving them, with critical ones under direct EU oversight.
- An ICT risk-management framework with board-level accountability.
- Classification and reporting of major ICT incidents.
- Resilience testing and a register of ICT third-party arrangements.
- Design the ICT risk framework and incident-reporting process.
- Plan a resilience-testing programme matched to your size.
- Build your third-party register and review vendor contracts.
Cyber Resilience Act (CRA)
- Mandatory cybersecurity requirements for hardware and software "products with digital elements".
- Reporting duties apply from 11 September 2026; most other requirements from 11 December 2027.
- Manufacturers of connected products and software sold in the EU.
- Importers and distributors placing those products on the market.
- Secure-by-design development and security updates for the support period.
- Vulnerability handling, including a software bill of materials (SBOM).
- Report actively exploited vulnerabilities and severe incidents, with an early warning within 24 hours.
- Confirm scope and your product's risk class.
- Set up secure development and vulnerability-handling processes.
- Prepare technical documentation, the SBOM and reporting workflows.
ISO 27001
- The international standard for an Information Security Management System (ISMS).
- Voluntary, but the most widely recognised proof of security maturity.
- Any organisation that wants to demonstrate strong information security.
- Often requested by enterprise customers and investors, and a strong fit for NIS2 and DORA.
- A risk assessment and treatment process, with Annex A controls and a Statement of Applicability.
- Internal audits and management reviews.
- External certification audit, annual surveillance audits and recertification every three years.
- Run the gap assessment.
- Design and document your ISMS and controls.
- Get you audit-ready and support you through certification.
ISO 42001
- The first international standard for an AI Management System (AIMS).
- Voluntary and certifiable, it complements the AI Act rather than replacing it.
- Organisations that develop, provide or use AI systems.
- Especially AI vendors facing enterprise procurement and security questionnaires.
- AI policy, objectives and clear governance roles.
- AI risk and impact assessments across the system lifecycle.
- Supplier controls, internal audits and certification audits.
- Build your AI governance framework and AIMS.
- Map its controls to your AI Act obligations.
- Prepare you for certification.
Regulations FAQ
How do I know which regulations apply to my business?
It depends on your products, your customers, your sector and how you use data and AI — there's no one-size-fits-all answer. Most companies building with AI are touched by at least the AI Act and GDPR. Book a free intro call and we'll map your exposure in a Discover session.
Do these rules apply if we're not based in the EU?
Usually, yes. GDPR, the AI Act, the CRA and DORA focus on whether you offer products or services in the EU, or process data of people in the EU — not on where your company is registered. NIS2 generally applies to entities providing services in the EU, with national rules deciding the details.
We only use third-party AI tools. Does the AI Act still apply to us?
Often it does — as a deployer. Your duties are lighter than a provider's: AI literacy for the staff using the tools, using them as instructed, and transparency where the use case requires it. They grow if you use AI in a high-risk area such as hiring or credit decisions, or if you substantially modify or rebrand a system.
Does GDPR still apply if we're building AI products?
Yes. Training data, inference logs and any personal data processed by an AI system are still subject to GDPR. AI doesn't create a carve-out; it usually adds obligations, like DPIAs for higher-risk processing or a clearer legal basis for the data you train on.
Does DORA only apply to banks?
No. DORA covers most regulated financial entities — insurers, investment firms, payment and e-money institutions, crypto-asset service providers and more — and reaches their ICT third-party providers through contracts, with critical providers overseen directly at EU level.
Are ISO 27001 and ISO 42001 mandatory?
No, both are voluntary. But they give you a structured, certifiable way to show that you manage security and AI responsibly, they overlap heavily with NIS2, DORA and the AI Act, and enterprise customers increasingly ask for them.
Can one compliance programme cover several regulations?
Yes, and it should. Risk management, incident reporting, supplier management and documentation overlap across the AI Act, GDPR, NIS2, DORA, the CRA and the ISO standards. We build the controls once and map them to every framework that applies to you.
What happens if we don't comply?
Penalties vary by regulation: the AI Act allows fines of up to €35M or 7% of global annual turnover for prohibited practices, GDPR up to €20M or 4%, and NIS2 up to €10M or 2% for essential entities, with personal liability for management. Beyond fines, non-compliance increasingly surfaces in investor due diligence and enterprise procurement — it's a commercial risk, not just a legal one.
Ready to get compliant?
Tell us what you build, and we'll tell you how exposed you are
Book a free intro call →