Regulatory context
GDPR remains the dominant data protection framework in Europe, but the EU AI Act (transparency from August 2026, high-risk in December 2027 following the June 2026 omnibus) and the NIS2 directive create new obligations in AI governance and cybersecurity.
Organizations must now simultaneously manage personal data compliance, AI system classification by risk level, and NIS2 requirements for essential and important entities.
Regulatory frameworks covered
GDPR: foundation of data protection in Europe
EU AI Act: transparency from Aug. 2026, high-risk in Dec. 2027
NIS2: cybersecurity directive for essential entities
CNIL: French specificities (LIL)
nLPD: new Swiss law aligned with GDPR
UK GDPR: post-Brexit, similar but distinct
Assessed domains
Data Protection
GDPR, nLPD, UK GDPR
AI Governance
EU AI Act
Cybersecurity
NIS2, ISO 27001
Main jurisdictions
EUUERGPD, AI Act, NIS2
FRFranceCNIL
CHSuissenLPD
GBUKUK GDPR
BEBelgiqueAPD
DEAllemagneBDSG
+ 42 other European jurisdictions covered