New European rules. What applies to you?
The AI Act, NIS2 and DORA affect many more companies than just the large ones. We work out what applies to your product and your customers, and what you need to do.
AI Act and our products
Asked in Slack · today 09:12
About this question
From rule to action list.
Not a forty-page report, but what you need to do, and when.
EU AI Act
If you use or build AI, it falls into a risk class. That comes with obligations that take effect in phases.
- Classification per application
- What you need to do as provider or deployer
Obligations
NIS2 and DORA
NIS2 affects companies in critical sectors and their suppliers. DORA applies to financial institutions and their ICT suppliers.
- Whether your company falls under it, directly or as a supplier
- What your customers will ask of you contractually
Questions from your customers
The points that go wrong in practice.
Does it apply to you
Directly, as a supplier to someone it applies to, or not.
Role
Under the AI Act: are you the provider or the deployer of the system?
Contracts
What your customers will demand of you, and what you need to ask of your own suppliers.
Reporting
Which incidents you must report, to whom and how quickly.
Documentation
What you must be able to show if someone asks for it.
Timeline
Which obligations take effect when.
A fixed price per item.
In credits, within your plan or separately. Full price list
Short check: does my company fall under it
Fixed price, however long it takes us.
Assess a customer's DORA or NIS2 addendum
Fixed price, however long it takes us.
Short answers.
Does the AI Act already apply?
Partly. The obligations take effect in phases. Which ones apply to you depends on what you do with AI.
We supply a bank. Does DORA affect us?
Probably, through your contract. Forward the addendum and you will see what you can accept.