Lost in Regulation: Five EU Laws and What They Mean for Tech Companies

Five sets of rules, one company

SFSCON is South Tyrol’s free software conference. In the “Digital Sovereignty” track, we had 15 minutes to explain how tech companies can navigate the EU regulatory landscape. The starting point: five sets of rules now affect most technology companies, and most of their provisions already apply. Here is the overview as of November 2026:

• GDPR: Data protection; applicable since 2018;
• NIS2: Cyber resilience; in force in Italy since 16 October 2024 through Legislative Decree No. 138/2024;
• AI Act: Rules for AI; prohibitions and AI literacy requirements have applied since 2 February 2025. Under the AI Omnibus, obligations for high-risk AI will apply from 2 December 2027 for standalone systems and from 2 August 2028 for AI in regulated products;
• Data Act: Data access and switching providers; applicable since 12 September 2025. Switching charges will be abolished from 12 January 2027;
• Cyber Resilience Act (CRA): Product security; reporting obligations have applied since 11 September 2026, with full application from 11 December 2027.

Each law looks at your company from a different angle. That is why the honest answer to most detailed questions remains: it depends.

Does this apply to me? Usually, yes

A common misconception is: “We’re too small for that.” A look at what triggers the obligations shows why that is rarely the case:

• GDPR: If you process personal data, the GDPR applies. There is no company-size threshold.
• NIS2: The directive has size thresholds, so many small companies are not directly covered. Their customers often are, however, and must secure their supply chains (Article 21(2)(d) of the NIS2 Directive). NIS2 then reaches you through contract clauses or security questionnaires.
• CRA: If you place products with digital elements on the EU market, you are covered, regardless of where your company is based.
• AI Act: If you use AI systems in your business, you are a deployer (Article 3(4) of the AI Act). That includes using an AI assistant to draft marketing copy or AI to review code. Article 4 requires measures to promote employees’ AI literacy. Since 27 July 2026, a less stringent version has applied: no one has to guarantee a specific level of competence, but the obligation itself remains.
• Data Act: If you provide cloud services or connected products, you must enable customers to switch providers and take their data with them. From 12 January 2027, you cannot charge them for switching.

One incident, three clocks

The laws are relatively easy to understand in isolation. Things get harder when they overlap. Imagine a vulnerability in your SaaS solution is exploited on a Friday evening, personal data is exposed, and one of your customers is an entity covered by NIS2. Three reporting timelines then run in parallel:

• NIS2 (Article 23 of the NIS2 Directive): Your customer must send an early warning to its CSIRT within 24 hours, an incident notification within 72 hours and a final report within one month. To do that, it needs information from you—and quickly.
• GDPR (Articles 33 and 34): A personal data breach must be reported to the supervisory authority within 72 hours; if there is a high risk, affected individuals must also be informed. As a processor, you must notify your controller without undue delay (Article 33(2) GDPR), so it can meet its deadline.
• CRA (Article 14): If a vulnerability in your product is being actively exploited, you as the manufacturer must submit an early warning within 24 hours, a notification within 72 hours and a final report no later than 14 days after a corrective measure becomes available. These go to the coordinating CSIRT and ENISA through the Single Reporting Platform.

Same incident, same facts, three deadlines and three recipients. The European Commission has recognised the problem: the Digital Omnibus proposal of 19 November 2025 proposes a single reporting point, so an incident would only need to be reported once. It would also extend the GDPR deadline from 72 to 96 hours. On 21 October 2026, the Council adopted its negotiating mandate. It provides for 96 hours and a “high risk” reporting threshold, but favours national reporting points rather than an EU-wide one. Nothing has been adopted yet, and Parliament has not taken a position. Until then, all three clocks keep ticking.

Open source as a route to demonstrable compliance

Open source does not automatically make a company compliant. It can, however, make compliance easier to demonstrate. Running your own systems can mean fewer processors, fewer data transfers and less paperwork. Auditors can examine open security tools without having to peer into a black box. A community can review open-source code, while open interfaces and formats make switching providers part of the architecture rather than a project to tackle later.

This is also what digital sovereignty is about: not building everything in Europe, but retaining control over what you run, where your data is stored and whether you can switch providers. Regulation gives you the right to leave; open source gives you the ability to do so.

What business leaders and technical decision-makers should do now

• Identify which rules apply: document what you develop, what data you handle and who your customers are. Then determine which of the five laws apply to you.
• Start with active systems: take a risk-based approach and prioritize the systems and products that would pose the greatest risk if something went wrong.
• Practice incident reporting: create a shared incident template covering GDPR, NIS2 and CRA deadlines and recipients. Assign roles and run a dry run.
• Build for openness and auditability: where possible, choose open-source components, open interfaces and exportable data formats so that one architectural decision helps meet multiple obligations.
• Document everything: an imperfect policy that is written down is better than a perfect one that exists only in someone’s head.
• Make compliance visible: show what you do in a Trust Center on your website, so the next customer security questionnaire is much easier to complete.

At Nuviax, we help you put these steps into practice by bringing together IT security and data protection in a pragmatic way tailored to the requirements that actually apply to your business.

Conclusion

The five laws share the same core principles: transparency, accountability, security by design and data sovereignty. Look at them together rather than one law at a time, and you do not need a legal department—you need a roadmap. The result goes beyond meeting obligations: when you can demonstrate compliance, you can answer customer questions with confidence and build trust.

The path forward is manageable. The important thing is to start.