Compliance
Regulatory compliance: NIS2, DORA, CRA and AI Act
Fixed-price readiness for NIS2, DORA, the Cyber Resilience Act and the AI Act.
I establish which regulations reach you and turn the obligations into a prioritised, costed plan the board can approve, with the price agreed before I start.
- Independent and agnostic
- Evidence-driven analysis
- Clear, actionable recommendations
- Senior attention, end to end
The challenge
A regulation is not a decision.
NIS2, DORA, the Cyber Resilience Act and the AI Act set obligations, not priorities. Read on their own, they leave a board with a legal text and no clear answer to the only questions that matter: what applies to us, where we fall short, and what we do first. Left unresolved, that ambiguity turns into either over-spending on the wrong controls or exposure the supervisor will eventually notice.
Regulatory scope
The four regulations
The method is the same for all four: scope, gap analysis, plan. What changes is who is covered and what is required. The current deadlines are in the official-sources calendars, with the primary texts.
NIS2
Directive (EU) 2022/2555 and Legislative Decree 138/2024
Who it applies to
Essential and important entities identified under Legislative Decree 138/2024, the Italian transposition of the Directive.
What I do
- Confirm whether the company is in scope, and as an essential or an important entity.
- Measure the gap against the basic security measures and the incident-notification obligations.
- Sequence the work to the deadlines ACN sets for your case.
DORA
Regulation (EU) 2022/2554
Who it applies to
The financial entities listed in Article 2 of the Regulation, such as banks, payment institutions, investment firms and insurers, and ICT third-party service providers.
What I do
- Assess the ICT risk-management framework against the Regulation’s requirements.
- Check how major ICT-related incidents are classified and reported.
- Review contracts with ICT service providers against Article 30.
CRA
Cyber Resilience Act, Regulation (EU) 2024/2847
Who it applies to
Manufacturers of products with digital elements, with obligations of their own for importers and distributors. As a regulation it applies without national transposition.
What I do
- Classify the products against the important and critical product categories.
- Review how vulnerabilities are handled and reported.
- Plan the essential requirements, technical documentation and conformity assessment.
AI Act
Regulation (EU) 2024/1689
Who it applies to
Providers and deployers of AI systems. Deployers include companies and firms that use AI tools in their own work.
What I do
- Map the AI tools in use and the company’s role for each of them.
- Check that no use falls under the prohibitions, and which uses are high-risk.
- Set internal rules and staff training on the use of AI.
What I do
From obligations to decisions the board can take.
A focused assessment and a roadmap you own, usable with a board, a supervisor or a customer. It works for each of the four regulations.
How I workScope Determination
Confirm which of the four regulations reach you, and how far.
Gap Assessment
Where you stand against each regulation’s obligations, with evidence.
Prioritised Roadmap
What to do first, why, and what it takes, sequenced to the deadlines. Shared obligations are handled once.
Board-Ready Report
A document you can table, and reuse, with anyone.
Policies & Templates
The governance artefacts to start from, written to cover several regulations at once.
Ongoing Support
Optional help to execute and stay ready.
My approach
A structured path to proportionate compliance.
I confirm scope, assess against the obligations, and hand you a plan, not a binder.
Explore my method- 01
Scope
Confirm which obligations reach you, and how far.
- 02
Discover
Collect controls, governance and evidence.
- 03
Assess
Measure the gap against the regulations that apply: NIS2, DORA, the CRA or the AI Act.
- 04
Report
Findings and a prioritised, costed roadmap.
- 05
Support
Optional help to execute and maintain readiness.
- A clear answer on whether, and how far, each obligation applies to you.
- A prioritised, costed roadmap the board can approve and act on.
- A board-ready report you can reuse with a supervisor, a customer or an auditor.
- Governance artefacts you keep and build on, not a binder that dates on the shelf.
Case study
DORA readiness for a financial entity
A DORA readiness programme that closed the main gaps in ICT risk management, incident reporting, and critical ICT providers, with an operational resilience testing cycle in place.
Read the case study
Work & insights
What I’ve done
NIS2Public Body Operating an Essential Service
NIS2 compliance and operational continuity for an essential service, with a Zero Trust architecture and assurance demonstrable to the competent authority.Public Sector
NIS2NIS2 in practice: who is in scope, what changes, how to prepare
Directive (EU) 2022/2555 widens the perimeter and puts accountability on management bodies. An operational reading, without alarmism.12 Sep 2025 · 4 min read
DORADORA for the financial sector: digital operational resilience
Regulation (EU) 2022/2554 harmonises ICT risk management, incident reporting, resilience testing and oversight of critical providers.21 Nov 2025 · 4 min read
Frequently asked
Questions I get asked.
How do you price this?
The readiness assessment is fixed-price, agreed before I start, so the cost is known in advance. Any follow-on support to execute the roadmap is scoped separately.
Which of these regulations apply to us?
That is the first thing I confirm. It depends on sector, size, activity and role in the supply chain: DORA covers the financial sector and ICT providers, the CRA whoever places products with digital elements on the market, the AI Act whoever develops or uses AI systems. Getting scope wrong in either direction is expensive, so I establish it before assessing anything else.
Do the four regulations have to be tackled separately?
No. When several regulations reach the same company I apply one method, so overlapping obligations such as governance, incident handling and supplier oversight are handled once.
Do you guarantee compliance?
No one credibly can. I give you an accurate view of where you stand and a defensible plan to close the gaps. Compliance is a determination for you, your auditors and the supervisor — my job is to make it reachable and evidenced.
Ready to start?
Let’s talk about your case.
Every situation is unique. Tell me the context and I’ll help you define the best approach.
Book a consultation