Six regimes. One evidence core.
NIS2/NISG, DORA, ISO/IEC 27001, the EU AI Act, GDPR, and SOC 2 often require essentially the same evidence — just in different formats, with different deadlines, overseen by different authorities. This overview summarises, for each regulation: what applies, from when, where the primary source is — and how ReportAct solves the evidence trail for it.
Choose your regime.
Cybersecurity for essential and important entities. Transposed in Austria as the NISG 2026, in Germany as the NIS2UmsuCG — with an explicit duty for management bodies to implement, supervise and train (Art. 20 NIS2).
Regulation in detail →Digital operational resilience for financial entities: ICT risk management, third-party register, major-incident reporting cascade, and resilience testing.
Regulation in detail →International standard for information security management systems. 93 Annex A controls, voluntary certification, widely recognised as evidence against NIS2 and by customers.
Regulation in detail →The world's first horizontal AI regulation: prohibited practices, obligations for general-purpose AI, and a high-risk regime with a phased application timeline running to 2027.
Regulation in detail →General Data Protection Regulation: record of processing activities, breach notification within 72 hours, data-subject rights, and fines of up to 4% of global annual turnover.
Regulation in detail →A US-shaped, internationally recognised attestation of a service provider's trustworthiness — increasingly a market standard for enterprise customers and international business relationships.
Regulation in detail →ReportAct is not a consultancy. This overview is for orientation and makes no claim to completeness or legal validity — every detail page links to its primary source. For a concrete assessment of your obligations, we recommend legal advice. A sector-specific applicability matrix is available on the homepage under "Who it's for". Our Terms of Service apply.
One evidence base for all six regimes.
Instead of handling every regulation separately: capture evidence once, seal it cryptographically, and credit it across every installed Framework Pack.