Six regimes. One organisation. Three different clocks.

The GDPR, ePrivacy, the AI Act, NIS2, DORA and the Cyber Resilience Act were drafted separately and now apply to the same systems, the same data and the same decisions.

The map

Each line is a point where two regimes meet. Some share subject matter. Some impose overlapping obligations with different deadlines. Some conflict.

The lines in red are the reporting duties that collide: one security incident can trigger an early warning to the national CSIRT within 24 hours under NIS2, a notification to ENISA within 24 hours under the CRA, and a notification to the CNPD within 72 hours under the GDPR. None of the triggers align, and the judgement has to be made before the facts are complete.

02The regimes

What applies, to whom, and by when.

Five regimes carry a full page. The Cyber Resilience Act appears for its reporting duties, which are already in force.

In forceGDPRAccountability as an evidential burden. Portuguese implementing law and CNPD practice change the analysis more often than groups expect. In forceePrivacy DirectiveCookies, tracking, electronic communications and direct marketing. Transposed in Portugal by Law 41/2004. Not the proposed Regulation, which was never adopted. PhasedAI ActClassification first; every other obligation depends on it. Timeline revised by the Digital Omnibus in July 2026. In forceNIS2Governance duties reaching the board, supply-chain obligations, and a 24-hour early warning. In forceDORAICT risk for financial entities, and for the providers that serve them. Reporting in forceCyber Resilience ActArticle 14 reporting applies from 11 September 2026 — including to products already on the market.

Adopted law only. This map carries instruments in force. Proposals under negotiation are excluded by design: a map that mixes the two undermines the precision it exists to demonstrate. Instruments enter when they are adopted.

03Where the duties collide

One incident, three reporting clocks.

NIS2 — 24 hours. An early warning to the national CSIRT where the incident is significant. Significance is assessed against the entity's service, not against whether personal data is involved.

Cyber Resilience Act — 24 hours. An early warning to ENISA and the coordinating CSIRT for actively exploited vulnerabilities and severe incidents affecting products with digital elements. Article 69(3) carves this duty out of the transitional rule, so it reaches products placed on the market long before the Regulation applies in full.

GDPR — 72 hours. Notification to the CNPD where there is a personal data breach likely to result in a risk. An incident can be significant for NIS2 without engaging the GDPR, and can engage the GDPR without being significant for NIS2.

The practical consequence is that the assessment has to be run across all three in the first hours, on incomplete facts, and recorded as it is made.

Cyber Incident Legal Response →

04Which of these apply to you?

The short answer depends on nine questions.

What your organisation does; whether you offer goods or services in the EU or monitor behaviour here; whether you operate or deploy AI systems, including the AI inside software you bought for another purpose; whether you fall in a NIS2 sector; whether you are a financial entity or an ICT provider to one; whether you make products with digital elements; whether you operate a platform; whether you provide or rely on electronic identity; and where your main establishment sits.

Answer them below. The tool runs entirely in your browser — nothing you enter is transmitted or stored.

Answer the nine questions

For the same question answered properly, against your facts, see the Digital Regulatory Health Check.

Expertise beyond Law & Technology

Digital regulation applies to systems, not to documents. We work where law, technology and governance actually meet — which is where the obligations bite.