EU Data, AI and Resilience Rules: GDPR, AI Act, DORA, NIS2

Four EU rules now reach the same company systems from different directions. GDPR governs personal data. The EU AI Act governs how AI systems are documented, tested and supervised. DORA sets resilience rules for financial entities and their critical technology providers. NIS2 adds resilience rules of its own. A company that operates in several markets may have to satisfy all four at once, in the same audit cycle.

What GDPR Asks of Your Systems

GDPR is a privacy law, and it starts with a map. A company has to know where personal data is stored and processed, and in which country. It has to limit who can read or change that data, encrypt it in transit and at rest, keep it only as long as needed, and show the records that prove these controls.

The systems work is familiar. Data flows, access rules, retention and deletion, logs and evidence. The hard part is that personal data rarely sits in one place. It spreads across the ERP, the CRM, the data warehouse, backups, analytics copies and the services of third parties.

What the EU AI Act Asks of Your Systems

The AI Act sorts AI systems by risk and sets duties for each level, such as documentation, human oversight and testing. A company has to classify its systems and then build the records and controls each level requires.

In practice, that means an owner for each AI system, an approval step, a test record, limits on inputs and outputs, and a log of what the model or agent did. A model that arrives from a vendor still needs a place in that record. The company has to show who approved it, how it was tested and what stops it doing harm.

What DORA and NIS2 Ask of Your Systems

DORA sets resilience rules for financial entities in the EU and their critical technology providers. Your compliance team confirms whether it applies, and we then engineer and evidence the controls.

NIS2 is another EU resilience rule. Its scope and duties depend on the organisation, so your legal team confirms whether it applies and what it requires.

Both rules turn resilience into evidence. A company has to show that it knows its critical systems, that access is controlled, that incidents are detected and handled, that recovery has been tested and that suppliers are part of the picture. A plan on paper is not enough. The evidence has to come from the systems that run the business.

Where the Rules Overlap

The same controls appear under several rules. A data map supports GDPR, the AI Act and DORA. An asset inventory supports DORA and NIS2. Access control, logging, retention, incident response and recovery testing appear again and again.

A company that builds these controls once, with evidence attached, can answer several regulators from one place. A company that treats each rule as a separate project pays for the same work several times and ends with several versions of the truth.

The overlap is also where the conflicts appear. Data residency rules may differ by country. A model that one rule allows may need extra controls under another. The design has to handle those differences without breaking the shared controls.

Where Programmes Fail

• Each rule is owned by a different team, with its own spreadsheet.

• Evidence is gathered by hand after the event, from systems that were not built to provide it.

• AI systems have no owner and no test record.

• Recovery plans exist but have never been exercised.

• Supplier contracts do not match the controls the company relies on.

• The map of personal data is out of date before the audit starts.

What to Do First

Build one evidence model. List the systems, the data they hold, the controls that protect them and the record each control produces. Map each rule to that list. The gaps then become visible, and the order of work follows risk and the timetable that applies.

Classify the AI systems next, because that work feeds the AI Act and the data map. Give each system an owner, an approval step and a test record. For resilience, test one recovery path and keep the result. A tested plan is worth more than a longer plan that has never run.

The EU publishes the current scope and timetable for each rule. Check the version that applies to your business with your legal team. This guide describes what the rules ask of systems. It is not legal advice.

How XSIS Helps

XSIS engineers controls and evidence for privacy, AI and resilience rules, inside your environment. We work with your legal and compliance teams, who decide how the rules apply. We do not give legal advice.