The EU Regulatory Stack Is a Board-Level Problem Now
Three EU regimes hit the same audit committee agenda this year: NIS2, DORA, and a delayed AI Act. Most mid-market executives still handle them as three separate projects with three separate consultants.
The EU Regulatory Stack Is a Board-Level Problem Now
Three EU regimes hit the same audit committee agenda this year: NIS2, DORA, and a delayed AI Act. Most mid-market executives still handle them as three separate projects with three separate consultants. That is the mistake.
The overlap is not theoretical. NIS2 (Directive (EU) 2022/2555) demands board-approved cybersecurity risk-management measures and personal liability for management bodies. DORA (Regulation (EU) 2022/2554) imposes ICT third-party risk registers on financial entities. The AI Act (Regulation (EU) 2024/1689) requires providers of high-risk systems to maintain a post-market monitoring plan. Different regulators, same evidence: incident logs, vendor inventories, control attestations.
A CFO who signs three separate compliance budgets for the same underlying artifacts is buying the same house three times.
What executives are actually being asked to sign
Under NIS2 Article 20, management bodies must approve cybersecurity measures and undergo training — and Member States must ensure they can be held accountable for infringements. Romania transposed this via Law 58/2024, aligning national supervisors under DNSC. ENISA’s technical guidance (ENISA NIS2 Implementation Guide) treats the ten risk-management categories in Article 21 as auditable controls, not policy statements.
DORA raises the bar on ICT third-party risk. Financial entities in scope must maintain a Register of Information on all ICT providers, submitted to the competent authority. The ESAs joint templates fix the schema — spreadsheets improvised by procurement teams will fail the first submission.
The AI Act interlocks with both. Any AI system supporting a critical service under NIS2 inherits both regimes’ logging and incident-reporting obligations. A single production model can trigger three notifications.
The operating model shift
The pattern we now push in consulting engagements with mid-market clients is one control library, three regulatory views. Build the evidence layer once. Map it into each regulator’s taxonomy at the reporting boundary.
control_library:
ctrl_ir_07:
name: incident_response_playbook_ransomware
owner: CISO
evidence: [runbook_v3.pdf, tabletop_2026Q1.mp4]
maps_to:
nis2: art_21_2_b
dora: art_17
ai_act: art_15_post_market
last_reviewed: 2026-05-14
next_review: 2026-11-14That YAML is not aspirational. It is the shape of every mature GRC extract we have pulled this year.
Executives asking for a compliance roadmap should stop asking “which regulation first.” Ask instead: which internal controls, once evidenced, satisfy the largest surface across all three regimes? Our Lexnomia regulatory intelligence layer and Aegis security operations pillar are built on exactly that inversion — evidence-first, regulator-view second.
The executives who understand this will spend one budget cycle where their peers spend three. Talk to us before your next board pack goes out.