European Union: compliance context

Regional regulatory landscape

EU compliance is layered: directly applicable regulations sit alongside directives implemented through national law, supervisory guidance, and sector rules. The same organisation may have GDPR, DORA, NIS2, and AI Act roles.

13 relevant framework guides across 5 coverage categories.

Mandatory regulations

These requirements apply only when their legal, sector, entity, activity, data, or contract scope is met.

• GDPR for personal-data processing in scope
• DORA for covered financial entities and ICT providers
• NIS2 as implemented by each Member State for covered entities
• EU AI Act duties based on role, system, and risk

Voluntary standards and contractual assurance

These frameworks can support a consistent control baseline but do not replace mandatory legal duties.

• ISO 27001
• ISO 42001
• NIST AI RMF
• CSA STAR
• TISAX

Implementation priorities

1. Map legal entity, sector, role, and system applicability
2. Maintain a single evidence inventory with regulation-specific overlays
3. Track Member State transposition and authority guidance
4. Document vendors, transfers, incidents, resilience tests, and human oversight

Frameworks to explore

Information Security

• ISO 27001
• SOC 2
• CSA STAR
• InfoSec Governance

Data Privacy

• GDPR

Financial & Critical Infrastructure

• PCI DSS
• DORA
• IEC 62443

AI Governance

• EU AI Act
• ISO 42001

Business Continuity & Automotive

• ISO 22301
• TISAX
• NIS2

AssureCore workflows

Manage your controls and evidence together in a workspace.

• Start your workspace
• Compare workspace plans
• Browse all framework guides

Official regional references

• European Commission digital strategy
• EDPB

Keep exploring

Framework coverage is educational and does not determine legal obligations. Confirm scope with qualified professionals and the relevant authority.