AI Act, NIS2, DORA and GDPR – which requirements affect your AI solution?

AI Act, NIS2, and DORA are often mentioned together, but they regulate different things. The AI Act focuses on risks and liabilities in AI systems. NIS2 and the Swedish Cybersecurity Act apply to cybersecurity in affected organizations. DORA sets requirements for digital operational resilience in the financial sector. GDPR applies when personal data is processed.

A platform can provide technical support for authorization, logging, and data control, but this does not automatically mean that the customer complies with the regulations. The specific usage, the organization's role, and the division of responsibility must be assessed.

Note: This article provides an overview and does not constitute legal advice. Regulations and guidance change. Last fact-checked on September 16, 2026, after the EU's Digital Omnibus Regulation on AI entered into force.

Four regulations with different purposes

AI Act

The AI Act is risk-based and distinguishes, among other things, between prohibited uses, high-risk systems, transparency requirements, and systems with low or minimal risk.[1][2]

NIS2 and the Cybersecurity Act

NIS2 and the Cybersecurity Act focus on risk management, security measures, management responsibility, and incident reporting in essential and other affected sectors.[5]

DORA

DORA harmonizes requirements for digital operational resilience for financial entities, including ICT risk, incidents, testing, and third-party risk.[7]

GDPR

GDPR regulates the processing of personal data and requires, among other things, a legal basis, purpose limitation, data minimization, and appropriate security.[9]

The same solution can be covered by several regulations, but for different reasons.

Supporting a requirement is not the same as a customer automatically complying with the regulation.

AI Act: risk, transparency, and responsibility

The AI Act, Regulation (EU) 2024/1689, entered into force on August 1, 2024, and is being applied in phases.[2] The timeline was amended in July 2026 by the Digital Omnibus Regulation on AI, Regulation (EU) 2026/1744, which entered into force on July 27, 2026. The amendment delays, among other things, the requirements for high-risk systems.[3][4]

This is what the timeline looks like after the amendment:[1][3][4]

• February 2, 2025: The prohibitions on certain AI uses and the provision on AI literacy began to apply.

• August 2, 2025: The rules for general-purpose AI (GPAI) models and governance began to apply.

• August 2, 2026: The Regulation began to apply generally, including the transparency rules in Article 50.

• December 2, 2026: New prohibitions begin to apply to AI that generates intimate images without consent or material depicting child sexual abuse. On the same date, the transitional period expires for machine-readable marking of AI-generated content in generative systems that were on the market before August 2, 2026.

• December 2, 2027: The requirements for high-risk systems under Annex III begin to apply, for example, systems for recruitment, education, critical infrastructure, and access to essential services. The previous date was August 2, 2026.

• August 2, 2028: The requirements for high-risk systems integrated into products covered by EU product legislation under Annex I begin to apply. The previous date was August 2, 2027.

The delay provides more time but does not eliminate the requirements. Risk management, documentation, and data quality take time to build up, so organizations planning systems that may become high-risk should start preparing now. Always check the current timeline and the legal text.

First, the organization needs to determine whether the solution is an AI system under the regulation and what role the organization has, such as provider or deployer. Subsequently, the usage is assessed.

Systems within areas such as recruitment, education, critical infrastructure, and access to certain essential services can be high-risk depending on their function and context. The requirements can cover risk management, data quality, documentation, logging, information for users, human oversight, robustness, and cybersecurity.

The transparency rules have applied since August 2, 2026. They may require that individuals are informed when they interact with certain AI systems or when certain content is generated or manipulated.

AI literacy remains an organizational matter. Following the amendment, providers and deployers must take measures to support the development of AI literacy among their staff. The previous phrasing was that they should, to the extent possible, ensure a sufficient level.[3] Staff still need relevant competence for their role.

AI assistant or AI agent – what is the difference?

NIS2 and the Swedish Cybersecurity Act

NIS2 has been implemented in Sweden through the Cybersecurity Act (2025:1506) and the Cybersecurity Ordinance (2025:1507), which have applied since January 15, 2026. Entities in 18 sectors may be covered. The exact scope depends, among other things, on the sector and the size of the entity. The NCSC's guidance describes which organizations are affected and what requirements apply to registration, risk management, and incident reporting, among other things.[5]

An AI solution becomes part of the organization's information and system landscape. Relevant questions are therefore:

• Is the solution part of an essential or critical process?

• What vendor and cloud dependencies exist?

• How are identity, vulnerabilities, continuity, and backup managed?

• Can incidents be detected, assessed, and reported in time?

• Are management's responsibilities and oversight clear?

ENISA published its NIS2 technical implementation guidance in June 2025. It is primary aimed at digital infrastructure, ICT service management, and digital providers, but can also help other organizations translate requirements into concrete controls. The organization needs to adapt the controls to its own risk profile.[6]

DORA for financial entities

DORA, Regulation (EU) 2022/2554, began to apply on January 17, 2025, and applies to the financial entities covered by the regulation. The focus is on ICT risk management, incident management, testing, information sharing, and third-party risk. DORA also contains an oversight framework for critical ICT third-party service providers in the financial sector, such as large cloud providers.[7][8]

For an AI solution, a financial entity needs to assess whether it supports a critical or important function, which ICT third parties are involved, and how continuity and exit can be ensured. A provider of a model via API can be part of a longer chain along with platform, cloud, and logging services.

Contracts need to provide sufficient information, access, security requirements, and support for incidents and termination. DORA is not an AI regulation, but AI services used in operations are covered by the organization's ICT risk management.

Secure document analysis with AI in regulated activities

GDPR applies when personal data is processed

If prompts, documents, logs, or outputs contain personal data, the GDPR applies. The organization needs to define purposes and legal bases, minimize data, ensure transparency, and manage the rights of data subjects.

Automated decisions with legal or similarly significant effects may trigger specific rules. A data protection impact assessment (DPIA) may be required when the processing is likely to result in a high risk. The IMY's guidance emphasizes that data protection must be integrated throughout the lifecycle.[9]

The GDPR assessment is separate from the AI Act's risk classification. A system can be low-risk under the AI Act but still process sensitive personal data.

In November 2025, the Commission proposed amendments to the GDPR in a separate digital omnibus package, including the definition of personal data and the use of data for AI development. The proposal has not yet been adopted, and for the time being, the GDPR applies in its current form.[10]

What happens to corporate data when you use AI?

What requirements should be placed on the platform and provider?

• Documented data flow, regions, retention periods, and subcontractors.

• Federated identity, least privilege, and separated administrator roles.

• Logging and traceability that support auditing without unnecessary personal data.

• Version control for models, prompts, data sources, and agent tools.

• Testing of quality, robustness, cybersecurity, and correct rejections.

• Incident management procedures with contact channels, timeline, and customer information.

• Plan for continuity, backup, and exit.

• Documentation of the division of responsibilities between customer, platform, and model provider.

Request evidence in the form of architecture, contracts, and processes. Certifications can be relevant, but they do not replace an assessment of the actual solution.

Permission-controlled AI with Microsoft Entra ID – how access works

Local language models or cloud models – how to choose?

Read more about security in Violet AI Platform

Documentation and responsibility

Create a register of use cases with purpose, owner, data, model, users, risk assessment, and decision. Document changes and test results. For high-risk systems, more extensive documentation may be required.

Management must understand risk and responsibility. The business operations own the use, IT owns the system landscape, information owners are responsible for data and security, and legal sets requirements and follows up. The provider is responsible for the parts specified in the agreement.

AI in the executive team: 10 questions that take you from idea to business value

When is a legal assessment needed?

Involve legal expertise and data protection competence when the solution affects individuals, processes sensitive personal data, is used in a regulated sector, or may be covered by the rules for high-risk AI systems.

Make the assessment before a pilot with real data, not after development.

Checklist questions:

• Which laws and sector rules apply to the organization and the process?

• What role do we have under the AI Act?

• Can the system be high-risk or subject to transparency requirements, and from what date do the requirements apply in that case?

• Is personal data processed and is a DPIA required?

• Is the organization covered by the Cybersecurity Act or DORA?

• What risks exist linked to third parties and transfers?

• Who makes decisions on approvals and changes?

From idea to pilot: what is PoC, prototype, and pilot?

Sources

1. European Commission, AI Act – the framework for AI (updated August 3, 2026): https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai

2. Regulation (EU) 2024/1689 (AI Regulation), EUR-Lex: https://eur-lex.europa.eu/eli/reg/2024/1689/oj/swe

3. Regulation (EU) 2026/1744 (Digital Omnibus Regulation on AI), EUR-Lex: https://eur-lex.europa.eu/eli/reg/2026/1744/oj/swe

4. Council of the European Union, Artificial Intelligence: Council gives final green light to simplify and streamline rules (June 29, 2026): https://www.consilium.europa.eu/en/press/press-releases/2026/06/29/artificial-intelligence-council-gives-final-green-light-to-simplify-and-streamline-rules/

5. National Cybersecurity Center, This is the Cybersecurity Act: https://www.ncsc.se/sv/radgivning-och-stod/cybersakerhetslagen-nis2/det-har-ar-cybersakerhetslagen/

6. ENISA, NIS2 Technical Implementation Guidance (June 2025): https://www.enisa.europa.eu/publications/nis2-technical-implementation-guidance

7. Regulation (EU) 2022/2554 (DORA), EUR-Lex: https://eur-lex.europa.eu/eli/reg/2022/2554/oj/swe

8. European Commission, Digital operational resilience – DORA: https://finance.ec.europa.eu/digital-finance/cyber-resilience_en

9. IMY, Guidance on GDPR and AI: https://www.imy.se/verksamhet/dataskydd/innovationsportalen/vagledning-om-gdpr-och-ai/

10. European Parliament, Legislative Train Schedule – Digital Omnibus Regulation Proposal: https://www.europarl.europa.eu/legislative-train/theme-a-new-plan-for-europe-s-sustainable-prosperity-and-competitiveness/file-digital-package