We help organisations turn regulatory questions into work that teams can assign and track. We start with the activities, services or systems in scope, review available policies and records, and discuss where teams need clearer responsibilities, controls or evidence.
EU compliance frameworks
GDPR · General Data Protection Regulation
The GDPR governs how organisations collect, use, store and share personal data. It sets duties for controllers and processors and gives individuals rights over their data.
Key provisions
Identify a lawful basis and collect only what is necessary (Arts. 5–6). Explain how data is used and respond to rights requests (Arts. 12–22). Build in data protection and appropriate security, notify qualifying breaches and assess high-risk processing (Arts. 25, 32–35).
Risks of non-compliance
Authorities can restrict or order a halt to processing. Depending on the infringement, fines can reach €10 million or 2% of worldwide annual turnover, or €20 million or 4%, whichever is higher within the applicable tier for undertakings (Arts. 58, 83).
Legal references
AI Act · EU Artificial Intelligence Act
The AI Act sets rules for AI systems and general-purpose AI models. The obligations depend on the organisation’s role, the system’s intended use and its risk classification.
Key provisions
Take measures to support AI literacy and screen for prohibited practices (Arts. 4–5). For high-risk systems, address requirements such as risk management, data governance, documentation and human oversight, including separate duties for deployers (Arts. 9–15, 26). Check transparency duties for specified uses, including certain AI-generated content (Art. 50).
Risks of non-compliance
Prohibited practices can attract fines of up to €35 million or 7% of worldwide annual turnover. Certain other breaches can attract up to €15 million or 3%. Article 99 sets specific rules for calculating fines, including lower ceilings for SMEs.
Legal references
NIS2 · Network and Information Systems Directive
NIS2 strengthens cybersecurity in specified sectors. The applicable requirements depend on factors such as the services provided, the size of the entity and its classification under national law.
Key provisions
Assign management oversight of cybersecurity (Art. 20). Put measures in place for incident handling, business continuity and supply-chain security (Art. 21). Report significant incidents to the competent authority or incident response team within the applicable deadlines (Art. 23).
Risks of non-compliance
Authorities can issue corrective orders and impose fines under national law. For breaches of Arts. 21 or 23, NIS2 requires national maximum fines of at least €10 million or 2% of worldwide annual turnover for essential entities and €7 million or 1.4% for important entities, whichever is higher in each case (Art. 34).
Legal references
CER · Critical Entities Resilience Directive
The CER Directive helps protect essential services from disruption. It applies to critical entities identified by national authorities and addresses risks such as natural hazards, accidents and deliberate acts (Arts. 6, 12).
Key provisions
Assess the risks that could disrupt essential services (Art. 12). Put proportionate measures in place to prevent incidents, protect facilities, respond and recover (Art. 13). Notify incidents that significantly disrupt, or could significantly disrupt, essential services (Art. 15).
Risks of non-compliance
Authorities can inspect entities, require evidence and order corrective action. Penalties are set under national law, so the applicable sanctions depend on the country and the infringement (Arts. 21–22).
Legal references
