How do NIS2, the GDPR, DORA, the CRA and the AI Act fit together?

Each looks at a different object, so one company can be under several at once. NIS2NIS2: the EU's second Network and Information Security directive. The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies. is about the cybersecurity of organisations in listed sectors: risk-management measures, management responsibility and reporting of significant incidents under Article 23. The GDPRGDPR: General Data Protection Regulation. The EU data protection law (Regulation (EU) 2016/679). is about personal data, wherever it is processed, including the duty to notify personal data breaches under Article 33. DORA is the specific rulebook for financial entities and takes precedence over NIS2 where they overlap. The CRA is about products with digital elements and places duties on the companies that make and sell them. The AI Act is about AI systems and puts duties on their providers and deployers according to risk. A ransomware attack on a hospital supplier may therefore trigger a NIS2 report and a GDPR notification on the same day, and a product flaw behind it may be the manufacturer’s CRA report. Map which laws apply to you, who owns each, and how one incident record can feed several reports. NetSenX tracks NIS2 deadlines per incident and, from the Starter plan, prepares a GDPR draft; it does not submit anything.

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

← All 20 questions on EU law: GDPR, DORA, CRA and AI ActAll topics