# How do NIS2, the GDPR, DORA, the CRA and the AI Act fit together?

Each looks at a different object, so one company can be under several at once. NIS2 is about the cybersecurity of organisations in listed sectors: risk-management measures, management responsibility and reporting of significant incidents under Article 23. The GDPR is about personal data, wherever it is processed, including the duty to notify personal data breaches under Article 33. DORA is the specific rulebook for financial entities and takes precedence over NIS2 where they overlap. The CRA is about products with digital elements and places duties on the companies that make and sell them. The AI Act is about AI systems and puts duties on their providers and deployers according to risk. A ransomware attack on a hospital supplier may therefore trigger a NIS2 report and a GDPR notification on the same day, and a product flaw behind it may be the manufacturer’s CRA report. Map which laws apply to you, who owns each, and how one incident record can feed several reports. NetSenX tracks NIS2 deadlines per incident and, from the Starter plan, prepares a GDPR draft; it does not submit anything.

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

FAQ: [EU law: GDPR, DORA, CRA and AI Act](https://netsenx.com/en/faq/eu-law) · https://netsenx.com/en/faq/how-do-nis2-gdpr-dora-cra-and-ai-act-fit-together

## Read next

- https://netsenx.com/en/blog/2026-10-26_ai-act-nis2-dora-cra
- https://netsenx.com/en/compliance
- https://netsenx.com/en/dpa

## Related questions

- [What is the GDPR, in plain terms?](https://netsenx.com/en/faq/what-is-the-gdpr-in-plain-terms)
- [Are IP addresses personal data under the GDPR?](https://netsenx.com/en/faq/are-ip-addresses-personal-data-under-the-gdpr)
- [What counts as a personal data breach under the GDPR?](https://netsenx.com/en/faq/what-counts-as-a-personal-data-breach)
- [What is the difference between a controller and a processor under the GDPR?](https://netsenx.com/en/faq/controller-or-processor-what-is-the-difference)
- [What security measures does the GDPR actually require?](https://netsenx.com/en/faq/what-security-does-the-gdpr-require)