The CISO's Guide to Regulatory Compliance in 2026: NIS2, DORA, and EU AI Act

All three frameworks require a common set of technical capabilities. Building these once, robustly, satisfies requirements across all three:

Tamper-evident audit trails. NIS2 Article 21(2)(g) requires audit logging. DORA Article 9(4)(d) requires logging of ICT operations. EU AI Act Article 12 requires logging for high-risk AI systems. One implementation of tamper-evident, integrity-verified logging satisfies all three.

Data integrity verification. NIS2's integrity and authenticity requirements. DORA's data integrity requirements for ICT systems. EU AI Act Article 10's training data governance. All three require the ability to demonstrate that specific data assets have not been modified. One integrity verification infrastructure, applied consistently, covers all three.

Incident detection and response. All three frameworks require incident detection capabilities, documented response procedures, and notification to authorities within specific timeframes. A unified incident management framework with appropriate escalation logic for each framework is more efficient than separate programmes.

Supply chain security assessments. NIS2 Article 21(2)(d) and DORA Chapter V both require supply chain security programmes. The EU AI Act adds AI supply chain considerations. A single supply chain security framework can be extended to cover all three with appropriate documentation.

For a technical implementation of these common capabilities, see the ROOTKey enterprise hub which provides a unified compliance infrastructure across all three frameworks.

Some requirements are genuinely framework-specific and require dedicated compliance effort:

DORA-specific:

• TLPT (Threat-Led Penetration Testing) for significant financial entities - mandatory under DORA, not required by NIS2 or EU AI Act
• ICT concentration risk assessment - the systemic risk analysis of third-party dependencies is DORA-specific
• Critical ICT third-party provider (CTPP) register oversight - requirements applying to CTPPs designated by ESAs are DORA-specific

EU AI Act-specific:

• Conformity assessment and EU Declaration of Conformity for high-risk AI systems
• Registration in the EU AI Office database
• Post-market monitoring plan for AI systems
• EU AI Act-specific transparency obligations (Article 52)

NIS2-specific (beyond DORA scope):

• Management body personal liability for cybersecurity measures (Article 20)
• Sector-specific supervisory arrangements under national transpositions
• National registration with competent authority timelines

For Portuguese organisations, the NIS2 Portugal guide covers the national-specific requirements that add to the base NIS2 obligations.

The most efficient architecture for managing all three frameworks:

Tier 1: Common infrastructure. Tamper-evident audit logging, data integrity verification, incident management, and supply chain security programme. Built once, maintained once, used for all three frameworks.

Tier 2: Framework-specific documentation. The same technical facts, documented in the specific format and language each framework requires. The evidence base is shared; the presentation layer is framework-specific.

Tier 3: Framework-specific processes. TLPT for DORA. Conformity assessment for EU AI Act. Management body training and liability documentation for NIS2. These are genuinely separate processes that cannot be consolidated.

This architecture minimises duplication at the infrastructure level while maintaining the flexibility to satisfy each framework's specific evidence requirements.

ROOTKey's verifiable trust platform is designed specifically for Tier 1 of this architecture - providing the common technical foundation that satisfies integrity, auditability, and monitoring requirements across all three frameworks. Start building your compliance foundation.