Regulations
One AI System Answers to Many Regimes
The EU AI Act sits at the centre. Data protection, cybersecurity, operational resilience and product safety law apply alongside it, with a growing number of regimes outside the EU. Each was written separately. We map every one down to the single obligation, so one body of evidence answers all of them.
Why this is hard
The Regimes Were Written for Different Purposes
Take one high-risk decision in a bank. The AI Act treats it as a high-risk system. The GDPR treats it as automated processing of personal data. NIS2 and DORA treat it as a resilience matter, and the Product Liability Directive as a possible defect. One incident can start reporting duties under three of them, each with its own deadline.
Different bodies wrote these rules for different purposes. Meeting one does not meet the others, and sometimes two of them conflict. A checklist that ties a control to a named act cannot settle that. It takes a map of each obligation.
- EU AI Act
- A high-risk system
- GDPR
- Automated processing of personal data
- NIS2 and DORA
- A resilience matter
- Product liability
- A possible defect
The regimes
The Regimes That Reach the Most Systems
Each has its own page: what it governs, who owes what, the timeline, the penalties, and where it meets the AI Act.
- Reg. 2024/1689
EU AI Act
Applies across every sector. Obligations by risk tier for providers and deployers, phasing in to December 2027.
Full guideRead the guide - Reg. 2016/679
GDPR
Data protection. Lawful basis, impact assessments (DPIAs) and people's rights, wherever AI uses personal data.
In forceRead the guide - Dir. 2022/2555
NIS2
Cyber resilience for essential and important entities. The management body is personally responsible.
In forceRead the guide - Dir. 2024/2853
Product liability
Software, AI included, becomes a product under EU liability law. A defect can be presumed where it breaks a safety requirement meant to prevent the harm, which may include the EU AI Act.
Applies 9 Dec 2026Read the guide - Reg. 2022/2554
DORA
Operational resilience of the financial system. ICT risk, third-party oversight, resilience testing.
In forceRead the guide - Reg. 2017/745 · 746
MDR / IVDR
Patient safety and clinical performance. An AI medical device goes through one conformity assessment under two regimes.
In forceRead the guide - Finance · Work · Health
Sectoral AI rules
The largest sector rules: model risk in finance, hiring and platform work, and clinical AI.
GuideRead the guide - UK · US · APAC · more
Rest of World
The regimes outside the EU that reach the same systems, across the regions we map.
Guide
When AI Software Becomes a Product
From 9 December 2026, software is a product under EU liability law, and that includes AI. Liability becomes strict and no-fault. A defect can be presumed where a product breaks a safety rule meant to prevent the harm. The technical documentation you keep for the regulator becomes evidence you must disclose in court. Complete, your governance file is your defence. With a gap, it is the presumption against you.
Your next step