Research area · Regulation
Regulatory Intelligence: from the primary source to the auditable control
NIS2, DORA, the Cyber Resilience Act, and the EU AI Act overlap in risk management, supply chain, and incident reporting — and individual deadlines shift. Vami Research reads the primary sources, separates obligation, guideline, and draft, tracks deadlines, and translates requirements into controls and evidence. This forms the basis for Agentic GRC Engineering.
- NIS2
- DORA
- Cyber Resilience Act
- EU AI Act
- BaFin AI & ICT
- EBA Third-Party Risk
- KRITIS
- Deep Dives
- 8
- Whitepapers
- 7
- Solutions
- 2
Dense regulation needs clear context
EU law and its German implementation are taking effect in quick succession: DORA has applied since January 17, 2025, the NIS2 Implementation Act has been in force since December 6, 2025, and the KRITIS umbrella act (KRITIS-Dachgesetz) since March 17, 2026. The transparency obligations of the AI Act have applied since August 2, 2026, and the reporting obligations of the Cyber Resilience Act since September 11, 2026. On top of this come guidelines and guidance from supervisory authorities, for example from the EBA on third-party risk and from BaFin on AI.
In practice, status is what matters. BaFin's AI guidance is explicitly non-binding; for the new KRITIS ordinance, a ministerial draft bill without legal force has been available since May 26, 2026; and the date of application of the EBA Guidelines will only be set by the publication of the translations. Mixing up obligation, interpretation, and draft means planning too early or too late.
We read the primary sources and back core statements with precise references; we label our own assessments as such. This results in deep dives, some with interactive tools, the Reality Check whitepapers on NIS2, DORA, the CRA, and the AI Act, as well as control sets that let a measure, once implemented, serve several regulations.
Open questions in practice
- 01
What is a binding obligation — and what is a guideline, a draft, or our own recommendation?
Our approach
We state the status of every source and consistently separate what the regulation and technical standards require, what supervisors describe as proven practice, and what we recommend on top. Take BaFin as an example: its AI guidance creates no new obligations — the obligations arise directly from DORA and the technical standards.
- 02
How do you keep track of deadlines that shift — as with the AI Act?
Our approach
We track dates of application, transition periods, and reporting deadlines for each regulation at the primary source. The Digital Omnibus postponed the high-risk obligations for standalone systems to December 2, 2027, and for systems embedded in products to August 2, 2028. The transparency obligations have applied since August 2, 2026; only existing generative systems have until December 2, 2026, for machine-readable marking.
- 03
How do you implement NIS2, DORA, the CRA, and the AI Act without building the same measure several times?
Our approach
We map requirements to a shared control framework — for example ISO/IEC 27001 as the foundation and DORA as an overlay, with one risk methodology and shared evidence. OSCAL makes this machine-readable: the Framework Composer in VamiGRC uses one control set for multiple standards, through to the Statement of Applicability.
- 04
Which obligations already apply to AI systems and AI agents in regulated organizations?
Our approach
The AI literacy obligation has applied since February 2, 2025, and the transparency obligations, which also cover agents in customer contact, since August 2, 2026. In the financial sector, AI systems are also subject to ICT risk management under DORA. We start with a complete AI inventory and role mapping as provider or deployer, followed by a gap analysis.
Key takeaways
- 01
Transparency obligations have applied since August 2, 2026 — to AI agents as well
AI systems in direct contact with people must be recognizable as AI, and according to the Commission's draft guidelines of May 8, 2026, a notice in the manual alone is not sufficient. Generative outputs, including those of agentic systems, must be marked in a machine-readable way.
Source: AI Act Transparency Obligations
- 02
AI under DORA needs no parallel structure
BaFin's guidance of December 18, 2025, is non-binding and creates no new obligations. It classifies AI systems as network and information systems within the meaning of DORA: models, training data, and libraries belong in the asset inventory, and AI incidents in the existing reporting process. The leverage lies in integration into the ICT risk management framework.
Source: BaFin AI guidance
- 03
Third-party risk converges: the EBA adopts the DORA logic
With EBA/GL/2026/09 of September 18, 2026, the EBA applies the DORA definition of a critical or important function to non-ICT services. Register, policy, and monitoring role may be merged with their DORA counterparts. The date of application follows with the translations; a two-year transitional period then applies for critical or important functions.
- 04
You check NIS2 applicability yourself — no notification will come
The NIS2 Implementation Act has been in force since December 6, 2025; according to the legislator's estimate, around 30,000 entities are affected. For entities already in scope when the law entered into force, the registration deadline expired on March 6, 2026, and the grace period communicated by the BSI on July 31, 2026. Registering late ends the ongoing violation but does not cure the past.
Source: NIS2
How we work
Our method follows the path of a requirement: from the primary source through status and deadline to the control with evidence.
Primary source reading
Evaluate legal acts, technical standards, guidelines, and final reports in the original and back core statements with precise references.
Status labeling
Consistently identify obligation, supervisory practice, draft, and our own recommendation separately.
Deadline radar
Track dates of application, transition periods, and reporting deadlines for each regulation — including postponements such as those made by the Digital Omnibus.
Control mapping
Map obligations onto a shared control framework so that one measure serves several regulations — machine-readable via OSCAL.
Reality checks for CISOs
Whitepapers on NIS2, DORA, the CRA, and the AI Act with implementation roadmaps — including agentic AI as a new ICT risk under DORA.
Tools and competence
Interactive tools such as the Scope Navigator and Register Builder make guidelines applicable; hands-on trainings and role-based VamiAcademy learning paths embed the knowledge.
How to get started
- 1Read and classifyEvaluate the primary source, determine status, addressees, and deadlines, and delineate it from existing obligations.
- 2Translate into controlsTranslate obligations into controls, processes, and evidence and consolidate them with existing frameworks instead of building parallel structures.
- 3Operate and demonstrateImplement controls once and maintain evidence continuously; in VamiGRC, AI agents handle routine work according to approval rules, and your team reviews draft notifications.
Deep dives, whitepapers, and analyses
Deep Dives 8
Whitepapers 7
NIS2 Reality Check — Registration, Supply Chain & Liability
DORA Reality Check — Third-Party Risk & Agentic AI
CRA Reality Check — Zero-Days, Supply Chain & AI
AI Act Reality Check — High-Risk Deadlines, GPAI & Agentic AI
EU AI Act — Compliance Guide for Companies
KI unter DORA für CISOs — BaFin guidance on ICT risks
Third-Party Risk für CISOs — EBA Non-ICT Guidelines 2026Analyses & news
More pages
- ENISA NIS2 Technical Implementation Guidance
- Implementing DORA & ISO 27001 in Synergy
- AI Compliance
- NIST Cybersecurity Framework 2.0: Advisory & Assessment
- CIS Controls v8.1
- ISO/IEC 27005:2022
- ISO 31000 Risk Management: Framework for Cyber Risk
- ISO/IEC 27035: Incident Management Explained
- ISO/IEC 27036: Supplier & Supply Chain Risk
From research area to implementation
Related research areas
Which obligations apply to you — and from when?
We determine where your organization stands under NIS2, DORA, the CRA, and the AI Act, separate obligation from recommendation, and show how one measure serves several regulations.