All services / EU digital regulation & cyber compliance
EU digital regulation and cybersecurity compliance
Beyond the GDPR and the AI Act, a second wave of EU rules governs data access, product cybersecurity and operational resilience. Most companies are in scope of at least one. I map which rules apply to which products and build one compliance structure rather than several.
NIS2 / CyberbeveiligingswetData ActCyber Resilience ActData Governance ActGDPR
What I help with
- NIS2 and the Dutch Cyberbeveiligingswet: scoping, governance duties, incident reporting, supply-chain security
- Data Act: data access and sharing duties for connected products and related services, cloud switching rules
- Cyber Resilience Act: obligations for products with digital elements, conformity and vulnerability handling
- Data Governance Act and data intermediation services
- Regulatory mapping across the EU digital rulebook for a product portfolio
- Policies, supplier requirements and board reporting that satisfy several regimes at once
Typical engagements
- Digital regulation map for a product portfolio (fixed fee)
- NIS2 governance and incident process design
- Data Act readiness for connected-product manufacturers
- Training for leadership and engineering on duties and timelines
Who this is for
SaaS and cloud providers, IoT and connected-product manufacturers, managed service providers, and suppliers to essential and important entities.
Frequently asked
Is NIS2 already enforceable in the Netherlands?
Dutch implementation has followed the EU deadline with delay; obligations such as registration, governance and incident reporting apply as the national law enters into force. I track the current status.
We make software, not devices. Does the Cyber Resilience Act apply?
Software placed on the EU market is a product with digital elements, so often yes, with timelines running to 2027.
Can one framework really cover several regimes?
Mostly. Risk management, incident handling, supplier management and documentation overlap heavily. The differences are handled as deltas.
Have a regulatory question?
Send a short description of the matter. I reply within one working day, usually with a view on scope and a fixed fee where possible.