NIS2, GDPR & AI Act readiness
Know which rules apply to you, what they require, and how to meet them without overbuilding.
European regulation keeps piling up: NIS2 and the Dutch Cyberbeveiligingswet, the GDPR, and now the AI Act. We work out which of them apply to your organisation, translate the requirements into concrete measures and help you put the evidence in place.
Because the frameworks overlap, we tackle them together, so one measure counts towards several obligations.
What this service includes
Applicability check
Whether NIS2 applies (sector and size), which GDPR obligations matter most, and whether your AI use falls under the AI Act.
Gap analysis
Your current measures against NIS2 Article 21, the GDPR and the AI Act obligations that apply to you.
Combined roadmap
A prioritised plan that handles overlapping requirements once, instead of law by law.
Governance and documentation
Management responsibilities, policies, records of processing, DPIAs and an inventory of AI use where needed.
Incident and breach reporting
Procedures for the NIS2 24-hour early warning and the GDPR 72-hour data breach notification.
How it works
- 1
Applicability
Which laws apply, and which obligations within them.
- 2
Gap analysis
What is already in place and what is missing.
- 3
Roadmap
One prioritised plan across NIS2, GDPR and the AI Act.
- 4
Implementation support
Help putting the measures in place, from policies to Microsoft 365 configuration.
NIS2 packages
More about NIS2 complianceCommon questions
Does NIS2 apply to us?
That depends mainly on your sector and size. The compliance check on our homepage gives a first indication in two minutes; the applicability check confirms it.
Is this legal advice?
No. We focus on information security and governance. Where a question needs a legal opinion, we will tell you so.
Why combine NIS2, GDPR and the AI Act?
They overlap: risk management, incident handling, supplier management and governance appear in all three. Tackling them together avoids doing the same work twice.
