laws

• NIS2The EU cybersecurity directive for 18 sectors.
• DORAICT resilience for finance, applying directly since 17 January 2025.
• AI ActIf your staff use AI at work, you are probably a deployer.
• GDPRIt almost certainly applies to you already.
• Cyber Resilience ActA regulation on the security of products that contain software: connected hardware and software sold in the EU.
• CER DirectiveThe EU directive on the resilience of critical entities: physical, operational and people risk for the operators a member state names.
• Data ActA regulation on who may access and use data from connected products, how cloud customers can leave a provider, and which data clauses between businesses do not bind.
• RED cybersecurityCybersecurity requirements for radio devices that connect to the internet, plus toys, childcare and wearable devices.
• Product Liability DirectiveLiability law: who pays when a defective product harms a person.

standards customers ask for

• ISO 27001A voluntary standard for running security as a management system.
• SOC 2A report from a licensed auditor on your controls, built on US audit standards and asked for in sales questionnaires.
• ISO 42001A voluntary standard for running AI as a management system.
• ISO 22301A voluntary standard for running business continuity as a management system.
• TISAXAn information security assessment for the automotive supply chain, run by the ENX Association on the VDA ISA catalogue.
• PCI DSSA security standard for payment card data.
• ISO 27701A voluntary standard for running privacy as a management system, for organisations that decide how personal data is processed and for those that process it for others.