Three EU regimes now govern enterprise AI deployments: the AI Act regulates the AI itself, DORA governs operational resilience in finance, and NIS2 sets cybersecurity duties across essential and important sectors. They differ in scope, but they converge on one demand — you must be able to document and evidence control. Reading them as one obligation stack, rather than three separate projects, is the practical way to plan for 2026.
The cost of getting the first one wrong sets the stakes:
Each tier is “or the stated percentage of total worldwide annual turnover, whichever is higher” — so for a large group, the percentage, not the euro figure, is the real exposure.
The three regimes, side by side
The fastest way to see the overlap is to put them in one table.
| Regime | What it governs | Applies to | In force |
|---|---|---|---|
| EU AI Act | The AI system itself, by risk tier | Anyone building or deploying AI in the EU | Phased from Feb 2025 |
| DORA | ICT & operational resilience | Financial entities + critical ICT providers | 17 Jan 2025 |
| NIS2 | Cybersecurity & supply-chain security | Essential & important entities | Transposed from Oct 2024 |
Where they overlap — and why it favours owning the stack
Each regime, in its own language, asks for the same four things: know what your systems do, control your third parties, log what happens, and be able to prove it on demand.
The practical consequences for a retrieval-augmented generation (RAG) deployment are concrete:
- Documentation and audit trails. All three expect you to evidence how a system behaves and who did what. AI that logs every retrieval, answer and citation makes this routine rather than a scramble.
- Third-party and supply-chain control. DORA’s ICT-provider oversight and NIS2’s supply-chain duties get harder with every external dependency. A self-hosted platform removes a sub-processor from the assessment entirely.
- Resilience and continuity. DORA’s testing and NIS2’s risk management both favour systems you can run, inspect and recover yourself — including air-gapped — over a black-box cloud you cannot.
What a RAG deployment needs to satisfy the stack
If you are deploying RAG across regulated data, these are the properties to insist on — each maps to one or more of the three regimes.
Stack-ready checklist
- Auditability by default — per-answer citations and query traces you can export for an auditor (AI Act, DORA, NIS2).
- Minimised third parties — self-hosting on your PostgreSQL, Redis and vector store removes the new sub-processor (DORA, NIS2).
- No phone-home — an offline licence key and local models keep the system working air-gapped, with no external dependency to test or disclose (DORA resilience, NIS2 supply chain).
- Model choice on record — document which model handled which workload, and change it without re-architecting (AI Act transparency).
This is the design RAGSuite is built around; see the compliance page and the EU AI Act overview for specifics.
A note on timing
The AI Act’s high-risk deferral to 2 December 2027 (via the Digital Omnibus) took the pressure off one deadline — but it is the exception, not the rule.
The honest read for 2026: the regimes are not going away, and they ask for the same evidence. Build the audit trail once, and you have answered most of the questions all three will put to you.
This is general information, not legal advice; confirm your specific obligations with qualified counsel. For the current AI Act timeline, see EU AI Act readiness.
Frequently asked questions
Do all three regimes apply to my organisation?
It depends on sector and role. The AI Act applies broadly wherever you build or deploy AI; DORA applies to financial entities and their critical ICT providers; NIS2 applies to designated essential and important entities. Many enterprises fall under two or all three at once — which is exactly why treating them as one stack is efficient.
Does self-hosting make us automatically compliant?
No. Self-hosting removes data-transfer and third-party exposure and makes documentation easier, but you still need lawful basis, risk assessments (including a DPIA where required), incident processes and Article 32 security controls. Sovereign infrastructure is an enabler of compliance, not a substitute for the work.
What is the single most useful capability to prioritise?
Auditable evidence. A platform that logs retrievals, answers and citations — and lets you export them — satisfies the common requirement across all three regimes and turns audits from a project into a query.
Sources & further reading
- EU AI Act — Article 99 (Penalties) — fine tiers: €35M/7%, €15M/3%, €7.5M/1%
- European Commission — Regulatory framework for AI — AI Act scope and application dates
- DORA — Regulation (EU) 2022/2554 — applies from 17 January 2025
- NIS2 — Directive (EU) 2022/2555 — transposition deadline 17 October 2024