# AI Act, NIS2, DORA, CRA: what is coming

> Four EU laws reach business owners through audits, customers, suppliers and everyday AI use. What the AI Act, NIS2, DORA and the CRA mean in practice.

Source page: https://netsenx.com/en/blog/2026-10-26_ai-act-nis2-dora-cra · NetSenX Team · 2026-10-26

There is one sentence many business owners may say too late:

**“I thought this did not apply to us.”**

After an audit. After a cyber incident. After a question from a major client. After a supplier-related breach. After a failed enterprise contract review. Or after discovering that employees have been using AI for months in ways the company never formally approved.

For many entrepreneurs, AI Act, NIS2, DORA and the Cyber Resilience Act still sound like European regulatory acronyms for lawyers, compliance teams or IT departments.

That is a mistake.

A dangerous one.

Because these regulations are not only about legal compliance.

They are about a much bigger shift: the way companies will be expected to understand, control and prove what is happening inside their digital environment.

Technology is no longer just a support function.

AI, data flows, cybersecurity, cloud systems, suppliers, remote access and digital products are becoming part of board-level responsibility.

Not every company will be affected by every regulation in exactly the same way.

But almost every company will feel the pressure.

Directly or indirectly.

Through clients. Through suppliers. Through banks. Through insurers. Through audits. Through procurement requirements. Through enterprise contracts. Through questions that many companies are not yet prepared to answer.

The real shift is simple:

**The era of declarations is ending. The era of evidence is beginning.**

For years, companies could say:

“We have a security policy.” “We have an IT provider.” “We use AI carefully.” “We have procedures.” “We are not a high-risk company.” “This probably does not apply to us.”

But the new reality asks a much harder question:

**Can you prove it?**

Can you prove who is using AI inside your organisation? Can you prove what data is being entered into AI tools? Can you prove whether employees are using private accounts? Can you prove what suppliers with remote access are doing in your environment? Can you prove where sensitive data is flowing? Can you prove which network behaviours are normal and which are not? Can you reconstruct an incident if a client, regulator, insurer or board member asks: “What exactly happened?”

These are no longer purely technical questions.

They are questions of responsibility.

And they are moving closer to the owner, CEO and board.

The AI Act sends one clear message: artificial intelligence cannot remain invisible inside companies.

AI is not just another productivity tool.

It can influence decisions, documents, customer communication, recruitment, risk assessment, software development, sales, reporting and internal operations.

The problem is not that AI is bad.

The problem is that AI can become invisible.

An employee wants to work faster. Someone summarises a contract. Someone checks source code. Someone improves a client document. Someone analyses internal data. Someone uses an AI tool because competitors are already using it.

And suddenly Shadow AI appears.

Not because employees want to damage the company.

But because people are under pressure to move faster.

That is why this risk is so difficult.

It does not always look like a threat.

Sometimes it looks like productivity.

One prompt. One customer file. One contract. One piece of source code. One internal document. One uncontrolled workflow.

And only later does someone ask:

What was sent? To which tool? By whom? Was customer data included? Was confidential information exposed? Can we check it? Can we document it? Can we prove we had control?

NIS2 brings the same logic into cybersecurity.

Cybersecurity is no longer just about having a firewall, antivirus software, backups or an external IT provider.

It is about whether the company can manage cyber risk continuously, consciously and in a way that can be demonstrated.

If an organisation cannot see unusual behaviour in its own network, does not understand supplier access, cannot detect abnormal data movement and cannot reconstruct an incident, it does not only have an IT problem.

It has a business problem.

DORA makes this even clearer in the financial sector.

Digital operational resilience is no longer an optional improvement.

It becomes a condition of trust.

If a financial organisation depends on technology, third parties, cloud services and digital infrastructure, it must be able to show that it can withstand disruption, manage risk and respond properly.

The Cyber Resilience Act pushes responsibility even further into digital products, software, connected devices and the full lifecycle of technology.

Security can no longer be treated as something added later.

It must be part of how digital products are designed, maintained and monitored.

Different regulations. Different sectors. Different obligations.

But one shared message:

**A company must understand what the technology it uses, sells, buys or allows into its environment is actually doing.**

And this is where the real problem starts.

Not in Brussels.

Inside the company.

Because many organisations already have tools.

They have systems. They have vendors. They have logs. They have policies. They have access rights. They have cloud platforms. They have AI tools. They have documents. They have procedures.

But when a specific question appears, the picture becomes unclear.

Who had access? When? To what? From where? What data moved? Was this behaviour normal? Was this automation, human error, misuse, an attack or a data leak? Was AI used according to internal rules? Is there evidence, or only an assumption?

This gap is where the biggest risk is created.

Not first between the company and the regulator.

First between the company and its own reality.

That is why entrepreneurs should stop asking only:

“What do we need to do to comply?”

That question is too small.

A better question is:

**Do we really see the risks that already exist inside our company?**

Because regulations often do not create the risk.

They expose it.

Shadow AI existed before the AI Act. Supplier risk existed before NIS2. Weak digital resilience existed before DORA. Insecure digital products existed before the Cyber Resilience Act.

The difference is that it will become harder to pretend the company did not know.

And this is where many entrepreneurs underestimate the issue.

The biggest cost may not be a fine.

It may be a lost contract. A failed audit. A client who chooses another provider. An insurer who asks harder questions. A bank that wants stronger evidence. A regulator who asks for documentation. A board that suddenly realises the company has been operating with blind spots for years.

So what should entrepreneurs do?

Do not panic.

But do not wait.

The first step is not buying another fashionable tool.

The first step is taking an honest look at the organisation.

Where is AI being used? Which data is sensitive? Which suppliers have access? Which systems are critical? Which processes would hurt the business if they failed tomorrow? Can incidents be reconstructed? Can unusual behaviour be detected early? Can the company show evidence instead of opinions?

This is not about turning every entrepreneur into a lawyer.

It is not about stopping AI.

It is not about slowing down innovation.

It is about building a company that can innovate without becoming blind.

Because speed without visibility becomes risk.

Automation without control becomes exposure.

AI without governance becomes uncertainty.

Cybersecurity without evidence becomes a belief system.

And trust without proof becomes marketing.

In the next few years, the strongest companies will not be the ones that simply say:

“We use AI.” “We are secure.” “We are compliant.” “We have policies.”

The strongest companies will be the ones that can show:

where AI is used, how data flows, who has access, what suppliers are doing, what behaviour is normal, what changed, what happened, when it happened, and what evidence exists.

That is a very different level of maturity.

For some companies, these regulations will be treated as a burden.

For others, they will become a competitive advantage.

Because when a large client has to choose between a company that says “we are secure” and a company that can show how it manages risk, the decision becomes easier.

Trust is no longer just a sentence on a website.

Trust now requires infrastructure.

This is why we believe AI Act, NIS2, DORA and the Cyber Resilience Act should not be treated only as compliance topics.

They are a maturity test.

A test of whether a company understands its own technology. Its data. Its suppliers. Its dependencies. Its AI usage. Its operational resilience. Its ability to reconstruct events. Its ability to prove what happened.

So our question to entrepreneurs is simple:

Are you treating these regulations as another box to tick?

Or as an opportunity to build a company that can actually see, control and understand its own risk?

Because in a few years, the real difference may not be who implemented AI faster.

It may be who implemented AI, cybersecurity and control in a way that clients, partners, insurers and regulators can actually trust.

Where do you think the biggest blind spot is today: Shadow AI, supplier access, data flows, incident evidence or board-level awareness?

**Further reading:** [our NIS2 network monitoring checklist](/en/blog/2026-09-24_nis2-network-monitoring-checklist), [the NIS2 readiness overview](/en/nis2-readiness) and [what NetSenX detects and how each alert explains itself](/en/features).

---

*Written by the NetSenX Team at TriStiX S.L. This article is general information, not legal advice. Questions: [info@netsenx.com](mailto:info@netsenx.com).*