⚡ NEW
NIS2 enforcement active — EU member states issuing first supervisory decisions. Essential entities must demonstrate Art. 21 compliance.
NIS2
Art. 20(4) — Board members personally liable for NIS2 non-compliance. Management body must approve and oversee cybersecurity measures.
NIS2
Art. 21(2)(a–j) — 10 mandatory cybersecurity measures including risk management, incident handling, supply chain security, and cryptography.
NIS2
Fines up to €10M or 2% of global annual turnover — whichever is higher — for essential entities under Art. 32.
NIS2
24-hour initial notification required for significant incidents under Art. 23. Full report within 72 hours.
DORA
DORA fully applicable Jan 2025 — financial entities must have ICT risk management frameworks, incident classification, and TLPT programmes in place.
DORA
RTS 2025/532 — technical standards for ICT risk management now in force. Covers policies, procedures, and contractual arrangements.
DORA
ICT third-party risk under Arts. 28–44 — register of all ICT providers mandatory. Critical TPPs subject to direct oversight by ESAs.
DORA
TLPT — threat-led penetration testing required for significant financial entities under Arts. 26–27. TIBER-EU framework applies.
DORA
Fines up to €5M for natural persons, up to 1% of global daily turnover for entities under DORA Art. 50.
EU AI
EU AI Act enforcement begins Aug 2026 — high-risk AI systems in regulated sectors require conformity assessments and registration.
EU AI
Art. 9 risk management — continuous risk management system mandatory throughout AI system lifecycle for high-risk systems.
EU AI
Prohibited AI systems — social scoring, real-time biometric surveillance in public spaces, and manipulative AI banned from Feb 2025.
EU AI
Arts. 43–49 conformity — high-risk AI must undergo conformity assessment before market placement. EU database registration required.
GxP
EU GMP Annex 11 revision underway — updated guidance on computerised systems validation expected 2026. GAMP 5 (2022) applies now.
GxP
FDA 21 CFR Part 11 — electronic records and signatures requirements apply to all regulated pharma and medical device software.
GxP
ICH Q10 Pharmaceutical Quality System — lifecycle approach to quality management. CSV audit preparation workbench covers all 5 phases.
ALERT
NIS2 ≠ ISO 27001 — ISO certification does not satisfy NIS2 obligations. Specific Art. 21 measures and incident reporting are mandatory additionally.
ALERT
NIS2 scope — ~160,000 EU organisations now obligated. Energy, health, banking, transport, digital infrastructure, water, public admin, space.
NIS2
Supply chain security Art. 21(2)(d) — assess and document cybersecurity practices of direct suppliers and service providers.
DORA
Business continuity Arts. 11–12 — ICT business continuity policy, response & recovery plans, backup strategies must be documented and tested.
EU AI
NIS2 + EU AI Act overlap — 6 shared control areas where both regulations apply simultaneously. One structured assessment covers both.
⚡ NEW
NIS2 enforcement active — EU member states issuing first supervisory decisions. Essential entities must demonstrate Art. 21 compliance.
NIS2
Art. 20(4) — Board members personally liable for NIS2 non-compliance. Management body must approve and oversee cybersecurity measures.
NIS2
Art. 21(2)(a–j) — 10 mandatory cybersecurity measures including risk management, incident handling, supply chain security, and cryptography.
NIS2
Fines up to €10M or 2% of global annual turnover — whichever is higher — for essential entities under Art. 32.
NIS2
24-hour initial notification required for significant incidents under Art. 23. Full report within 72 hours.
DORA
DORA fully applicable Jan 2025 — financial entities must have ICT risk management frameworks, incident classification, and TLPT programmes in place.
DORA
RTS 2025/532 — technical standards for ICT risk management now in force. Covers policies, procedures, and contractual arrangements.
DORA
ICT third-party risk under Arts. 28–44 — register of all ICT providers mandatory. Critical TPPs subject to direct oversight by ESAs.
DORA
TLPT — threat-led penetration testing required for significant financial entities under Arts. 26–27. TIBER-EU framework applies.
DORA
Fines up to €5M for natural persons, up to 1% of global daily turnover for entities under DORA Art. 50.
EU AI
EU AI Act enforcement begins Aug 2026 — high-risk AI systems in regulated sectors require conformity assessments and registration.
EU AI
Art. 9 risk management — continuous risk management system mandatory throughout AI system lifecycle for high-risk systems.
EU AI
Prohibited AI systems — social scoring, real-time biometric surveillance in public spaces, and manipulative AI banned from Feb 2025.
EU AI
Arts. 43–49 conformity — high-risk AI must undergo conformity assessment before market placement. EU database registration required.
GxP
EU GMP Annex 11 revision underway — updated guidance on computerised systems validation expected 2026. GAMP 5 (2022) applies now.
GxP
FDA 21 CFR Part 11 — electronic records and signatures requirements apply to all regulated pharma and medical device software.
GxP
ICH Q10 Pharmaceutical Quality System — lifecycle approach to quality management. CSV audit preparation workbench covers all 5 phases.
ALERT
NIS2 ≠ ISO 27001 — ISO certification does not satisfy NIS2 obligations. Specific Art. 21 measures and incident reporting are mandatory additionally.
ALERT
NIS2 scope — ~160,000 EU organisations now obligated. Energy, health, banking, transport, digital infrastructure, water, public admin, space.
NIS2
Supply chain security Art. 21(2)(d) — assess and document cybersecurity practices of direct suppliers and service providers.
DORA
Business continuity Arts. 11–12 — ICT business continuity policy, response & recovery plans, backup strategies must be documented and tested.
EU AI
NIS2 + EU AI Act overlap — 6 shared control areas where both regulations apply simultaneously. One structured assessment covers both.