European Union

GDPR, Cyber Resilience Act & AI Act Compliance

Beyond NIS2 and DORA, the EU regulates personal-data privacy (GDPR), the security of connected products (Cyber Resilience Act) and AI system governance (AI Act) — each with its own scope and timeline. Cyberox provides readiness and governance support across all three, delivered remotely for organizations without an EU office.

Request an EU Readiness Assessment → Talk to an Expert

Last reviewed: September 2026. Verify current requirements against the official regulator before acting — sources linked below.

GDPR

In force since 2018

Dec 2027

CRA full compliance deadline

Aug 2026

AI Act general application date

Remote Delivery

For non-EU-based organizations

Regulatory Landscape

What This Framework Requires

🔐

GDPR

The General Data Protection Regulation remains the EU's foundational privacy law, applicable to any organization processing the personal data of individuals in the EU, regardless of where the organization itself is based. Core obligations include lawful basis, data-subject rights, breach notification, and accountability through documentation.

🛡️

Cyber Resilience Act (CRA)

The CRA regulates the cybersecurity of “products with digital elements” — hardware and software placed on the EU market. Vulnerability and active-exploitation reporting obligations begin in September 2026, with full essential-requirements compliance required by December 11, 2027. Medical devices, vehicles and other product types with their own dedicated safety/security regimes are generally excluded.

🤖

EU AI Act

The AI Act reached its general-application date on August 2, 2026, bringing the bulk of its substantive obligations into active enforcement — including risk-tiered requirements for AI systems classified as high-risk, and governance obligations for providers and deployers.

📐

ISO/IEC 42001 & the AI Act

ISO/IEC 42001 (AI Management System) is a useful governance framework for AI risk and controls, but as of 2026 it is not a harmonized standard under the AI Act — certification does not by itself grant a presumption of conformity. It remains valuable as a structured foundation for AI governance regardless.

🏭

Who Should Pay Attention

Software and hardware vendors selling into the EU (CRA), any organization processing EU personal data (GDPR), and any organization developing or deploying AI systems used in or affecting the EU market (AI Act) should each assess applicability separately — the three regimes have different triggers and timelines.

⚠️

Verify Before You Commit

All three regimes continue to evolve through delegated acts, implementing guidance and (for CRA and the AI Act) phased timelines. Confirm current obligations and deadlines directly against official EU sources (European Commission, ENISA, EUR-Lex) or qualified EU legal counsel.

How Cyberox Helps

EU Regulatory Readiness Services

We help organizations determine which of these three regimes actually apply to them, then build a governance program that addresses the overlapping requirements together.

✓
GDPR Privacy Gap Assessment — Assessment of data-processing activities, lawful basis, data-subject rights processes and breach-notification readiness against GDPR.
✓
Cyber Resilience Act Readiness — Assessment of product security practices — vulnerability management, secure development, and reporting readiness — for hardware/software vendors selling into the EU.
✓
AI Act Applicability & Governance — Determining AI Act risk classification for your systems and building governance documentation and controls appropriate to that classification.
✓
ISO 42001 Alignment — Using ISO/IEC 42001's AI management system structure as a practical governance foundation, independent of formal AI Act conformity mechanisms.
✓
DPIA & Security/Privacy Integration — Data Protection Impact Assessments and alignment between security controls (ISO 27001) and privacy governance (GDPR/ISO 27701).

Request an EU Readiness Assessment

Three Distinct Regimes

1GDPR — personal data privacy

2Cyber Resilience Act — connected product security

3AI Act — AI system governance

Different Triggers, Different Timelines

Applicability to your organization depends on what you process, what you sell, and whether you build or deploy AI — assess each separately.

FAQs

European Union Compliance — Common Questions

Does GDPR apply to organizations outside the EU?+

Yes — GDPR applies extraterritorially to any organization that processes the personal data of individuals in the EU, regardless of where the organization itself is based, subject to the regulation's specific applicability criteria (such as offering goods/services to, or monitoring the behavior of, individuals in the EU).

What is the Cyber Resilience Act compliance deadline?+

The CRA's vulnerability and active-exploitation reporting obligations begin in September 2026, while full compliance with the essential cybersecurity requirements is required by December 11, 2027. It applies to hardware and software “products with digital elements” placed on the EU market, with categories like medical devices and vehicles generally excluded as they have their own regimes.

Is my company subject to the EU AI Act?+

The AI Act reached general application on August 2, 2026, with obligations that scale by risk tier and depend on whether you are a provider or deployer of an AI system, and whether that system is used in or affects the EU market. Applicability requires a specific risk-classification assessment — it is not a blanket requirement on every organization that uses AI.

Does ISO 42001 certification satisfy EU AI Act requirements?+

Not automatically. As of 2026, ISO/IEC 42001 is not a harmonized standard under the AI Act, so certification does not by itself grant a presumption of conformity with the Act's requirements. It remains a useful structured framework for AI governance, but AI Act compliance requires its own dedicated assessment.

Related Services & Frameworks

🇪🇺

NIS2 Compliance

The EU's broader cybersecurity directive for essential and important sector entities.

Learn more →

🔒

ISO 27701 Consulting

Privacy information management system certification that complements GDPR compliance work.

Learn more →

🇬🇧

UK Cyber Essentials

Neighboring market requirement for organizations also targeting UK public-sector or supply-chain contracts.

Learn more →

Not Sure Which EU Regulations Apply to You?

GDPR, the Cyber Resilience Act and the AI Act each have different triggers — start with an applicability assessment before building a program.

Request an EU Readiness Assessment Talk to an Expert