Which EU cybersecurity rules apply to me? NIS2, DORA, the CRA and the AI Act
A short profile, in up to five screens, to see which of four EU laws to review first and continue in each check without repeating answers. Every question accepts “I don't know”: whatever you do not know stays pending and is never taken for granted.
You see the map on screen, without leaving your email. If you have already taken a check in this tab, the map uses those answers.
The four EU laws it reviews
Cybersecurity of essential and important entities, by activity and size.
Digital operational resilience of financial entities and their ICT third-party service providers.
Does the Cyber Resilience Act apply to me?
Products with digital elements: manufacturers, importers and distributors.
Does the EU AI Act apply to me?
EU AI Act: those who use, integrate, develop or distribute AI systems.
Who it is for
For companies and professionals who do not know which EU cybersecurity rules affect them and want to decide where to start: management, IT, compliance or data protection leads. You do not need to know these laws: each question explains why it is asked and accepts “I don't know”.
What you get and what you do not
- Four cards, always: the laws with a confirmed fit, those that are probable or have information pending, and those that do not fit with what you have answered.
- Each card uses the same rules as its check, with its version and review date, and takes you there to complete whatever is missing.
- The questions are those of each check. When two laws count something differently, we ask for it separately.
Scope. This profile only reviews four EU laws: the NIS2 Directive, DORA, the Cyber Resilience Act and the EU AI Act. It does not cover the GDPR, consumer law, anti-money laundering obligations, e-invoicing, employment or tax law, or the national rules of any Member State. A negative result does not complete the legal review of your organisation.
Your answers
While you use the map, your answers stay in your browser and we do not send them to our servers; they are deleted after two hours, when you close the tab or when you press “Delete my answers”. If you accept analytics cookies, Google Analytics receives that you use the map, how many screens you go through, a summary of the result (confirmed fit, pending or no fit) and which check you move on to, never your answers.
The map and the checks share your answers in this tab so that we do not ask for them twice. They never travel in the page address.
What it is not
For guidance only; this is not legal advice. It does not certify compliance, it does not review all the rules that affect you and it does not replace a professional analysis of your case. If a card is left pending or probable, review it with your legal adviser.
Frequently asked questions
Which laws does the map review?
Four EU laws: the NIS2 Directive, DORA, the Cyber Resilience Act (CRA) and the EU AI Act. It does not cover the GDPR, consumer law, anti-money laundering, e-invoicing, employment or tax law, or the national rules of any Member State.
Does the map replace the individual checks?
No. It asks just enough to point you in the right direction for each law, with the same rules as its check. If a card is left pending or probable, continue in its check to complete it without repeating what you have already answered.
Which is the ISO cybersecurity standard, and why is it not included?
ISO/IEC 27001, which sets the requirements for an information security management system and allows certification. It is not in the map because it is not a general legal obligation: it is a voluntary standard, although a client or a contract may require it.
What does Regulation (EU) 2019/881 (the Cybersecurity Act) establish?
It strengthens the mandate of ENISA, the European Union Agency for Cybersecurity, and creates the European cybersecurity certification framework for ICT products, services and processes (Art. 1). That certification is voluntary unless another law requires it, which is why the map does not review it.
Do you keep my answers?
We do not send them to our servers: they stay in your browser and are deleted after two hours, when you close the tab or when you press “Delete my answers”. The map does not ask for an email.