DORA, NIS2 and the AI Act: what actually overlaps
Organisations in scope of several EU regimes usually build several programmes. Most of the underlying evidence is the same; what differs is the reporting deadline, the accountable person and the amount of documentation.
By Piotr Zenon Żabrowski · Published · Updated
1Internal control set
- Access control
- Logging
- Third-party risk
- Resilience testing
2Mapped to
- DORA
- NIS2
- ISO 27001
- GDPR
- EU AI Act
3Evidence source
- Cloud config
- Identity logs
- Change records
- Test reports
4Output
- Audit evidence pack
- Gap register
- Remediation plan
Where the requirements converge
| Theme | DORA | NIS2 | AI Act | Reusable evidence |
|---|---|---|---|---|
| Governance and accountability | Management body responsible for ICT risk | Management liability and training duty | Provider/deployer duties per risk class | Charter, RACI, board reporting pack |
| Asset and system inventory | ICT asset and function mapping | Network and information system inventory | AI system inventory with risk classification | One inventory with regime-specific attributes |
| Risk management | ICT risk framework | Risk-based technical measures | Risk management system for high-risk AI | Single methodology, multiple scopes |
| Incident reporting | Major incident, strict timelines | Early warning within 24h, report within 72h | Serious incident reporting for high-risk AI | One classification matrix mapped to each deadline |
| Third-party risk | Register of information, contractual clauses | Supply chain security measures | Obligations along the AI value chain | Vendor register with regime flags |
| Testing and resilience | Threat-led penetration testing where applicable | Testing and audit of measures | Robustness, accuracy, post-market monitoring | Test plan with shared reporting |
| AI management system | Not addressed directly | Not addressed directly | Risk management system under Article 9 for high-risk systems | ISO/IEC 42001 as a voluntary, certifiable structure many providers use to evidence it |
Where they genuinely differ
- Reporting clocks and recipients differ, so the classification decision must be made once and routed automatically.
- DORA prescribes contractual content for ICT providers to a level the others do not.
- The AI Act attaches obligations to a role (provider, deployer, importer) rather than to a sector.
- NIS2 puts personal liability on management, which changes who must sign off on what.
- ISO/IEC 42001 is not mandatory under any of these regimes, but it is becoming the default way providers structure the AI Act's risk-management and documentation duties — the same role ISO 27001 already plays for NIS2's technical measures.
- The AI Act's compliance calendar moved once already in 2026: the Digital Omnibus, adopted June 2026, pushed the Annex III high-risk deadline from August 2026 to December 2027 and the Annex I deadline from August 2027 to August 2028. Prohibited-practice bans (February 2025) and GPAI transparency duties (August 2025) were untouched by that change. A control catalogue built around the risk classification, not the calendar date, survives the next revision.
01Build one control catalogue
Controls stated once, each tagged with the regimes it satisfies.
02Map evidence to controls
One artefact can serve four regimes if it is written for the control, not for the auditor.
03Route incidents from one matrix
Severity classification drives which clocks start and who is notified.
04Close the real gaps
The remaining delta is usually contractual and documentary rather than technical.
05Track the calendar separately from the controls
Regulatory dates move; the control catalogue and evidence mapping do not need to. Assign one owner to track deadline changes across all four regimes so the rest of the programme is not disrupted by a headline.
Frequently asked questions
Does ISO 27001 certification cover DORA or NIS2?
It covers a large share of the management-system expectations but not the sector-specific obligations: reporting timelines, the register of information, or resilience testing requirements.
Where do most programmes actually fail?
Evidence freshness. Controls exist, but nobody can show they operated on a given date — which is what an examination asks for.
Has the AI Act timeline actually changed?
Yes, formally. The EU's Digital Omnibus package was adopted by the European Parliament on 16 June 2026 and by the Council on 29 June 2026, and is now in force: the original 2 August 2026 deadline for high-risk systems listed in Annex III is deferred to 2 December 2027, and the Annex I product-safety high-risk deadline moves from 2 August 2027 to 2 August 2028. Neither change touches the prohibited-practice bans or the GPAI provider obligations, both already in force. The inventory and classification work does not depend on the date and should proceed regardless.
Related
Compliance
Turning DORA, NIS2, ISO 27001, GDPR and the EU AI Act into one control set with reusable evidence and aligned reporting clocks.
Compliance readiness
Gap assessment and remediation planning for DORA, NIS2, ISO 27001, GDPR and the EU AI Act — mapped to controls and evidence, not paperwork.
EU AI Act readiness
A practical sequence for AI Act readiness: inventory, classification, obligations mapping, documentation and human oversight evidence — plus the current state of the Digital Omnibus timeline changes.
DORA / NIS2 gap checklist
Printable gap checklist for organisations in scope of DORA, NIS2 or both — governance, inventory, incident-reporting clocks and third-party risk.
AI governance & AI Act readiness
Build a workable AI governance framework: system inventory, risk classification, acceptable-use policy, review gates and AI Act evidence.
Disclosure as a control
Telling users they're talking to AI, and labeling synthetic audio and video, works as an operational defense against AI-accelerated phishing and fraud.