Prove EU compliance to the board in 4 minutes.

CTOs operating in the EU must track: EU AI Act Annex III risk classification obligations (high-risk AI systems from August 2026); GDPR Article 32 technical security measures; NIS2 Article 21 technical controls for essential and important entities; DORA digital resilience requirements for the financial sector; and the CRA (Cyber Resilience Act) for products with digital elements. Companies using US-hosted infrastructure also face CLOUD Act exposure concerns relevant to sovereignty due diligence.

Teams building or deploying AI systems in Annex III risk categories (employment, education, biometric identification, critical infrastructure, essential services) must: conduct a conformity assessment before market placement; maintain Annex IV technical documentation; register high-risk systems in the EU AI database (Article 71); implement Article 9 risk management and Article 10 data governance. General-purpose AI models also face transparency obligations from August 2025.

Annex III lists 8 categories of high-risk AI: (1) biometric identification and categorisation; (2) management of critical infrastructure; (3) education and vocational training; (4) employment and workers management; (5) access to essential public or private services; (6) law enforcement; (7) migration, asylum, and border control; (8) administration of justice and democratic processes. Systems in these categories face mandatory registration, conformity assessment, and ongoing post-market monitoring.

NIS2 Article 21 requires 10 categories of technical measures: risk analysis and information security policies; incident handling; business continuity and disaster recovery; supply chain security; secure acquisition, development, and maintenance of network and information systems; cybersecurity effectiveness assessment policies; basic cyber hygiene and training; cryptography and encryption; human resources security and access controls; and multi-factor authentication or continuous authentication.

Annex IV requires: general description of the AI system and its intended purpose; detailed description of system elements and development processes; information on monitoring, functioning, and control including algorithmic logic; description of the risk management system; record of changes through the system's lifecycle; list of harmonised standards applied; copy of the EU declaration of conformity; and post-market monitoring plan. Documentation must be kept for 10 years after market placement.

The EU AI Act sets three fine tiers: €35 million or 7% of global annual turnover (whichever is higher) for placing prohibited AI systems on the market; €15 million or 3% for violating high-risk system obligations; €7.5 million or 1.5% for supplying incorrect information to authorities. Member State supervisory authorities determine the exact level within these ceilings based on the severity and duration of the infringement.

NIS2 Article 20 makes management bodies personally liable for cybersecurity compliance and requires them to approve security measures and undergo regular security training. The EU AI Act requires senior management oversight of high-risk AI systems. DORA Article 5 requires the management body of financial entities to define, approve, oversee, and be accountable for ICT risk management. Legal counsel increasingly advises board-level D&O policies to reflect these personal liability provisions.

GDPR Article 32 requires appropriate technical measures considering the state of the art and costs. Supervisory authorities expect: pseudonymisation and encryption of personal data; ongoing confidentiality, integrity, availability, and resilience of processing systems; a process for timely restoration of availability after incidents; and regular testing, assessing, and evaluation of security effectiveness. Documented risk assessments, security policies, access controls, penetration test results, and incident response procedures serve as evidence.