EU Compliance Glossary

Regulation (EU) 2024/1689, the EU's law on artificial intelligence, regulating AI systems according to the risk they pose.

The Article 4 duty, in force since February 2025, to ensure staff working with AI systems have sufficient AI knowledge and skills.

The European Commission body that supervises general-purpose AI models and coordinates AI Act enforcement across the EU.

The NIS2 principle that security measures must protect against all threats to network and information systems, not just cyber attacks.

The list of 11 sectors under NIS2 considered most critical, whose in-scope organisations are classified as essential entities.

The list of 7 sectors under NIS2 considered important but generally lower-risk than Annex I.

The AI Act's list of use-case areas in which AI systems are classified as high-risk.

The NIS2 provision requiring management bodies to approve, oversee, and be trained on cybersecurity risk measures.

The section of the NIS2 Directive that sets out the 10 mandatory cybersecurity risk-management measures.

The NIS2 provision setting the mandatory incident reporting timeline.

The Article 21(c) measure requiring backup management, disaster recovery, and crisis management to keep services running during and after incidents.

The conformity mark that high-risk AI systems must carry before being placed on the EU market, signalling compliance with the AI Act.

Directive (EU) 2022/2557 on the resilience of critical entities — NIS2's sister directive covering physical resilience.

Sweden's national CSIRT, operated by MSB, which receives incident reports under Cybersäkerhetslagen.

The national body in an EU member state responsible for supervising NIS2 compliance.

The process of verifying that a high-risk AI system meets the AI Act's requirements before it can be CE-marked and sold in the EU.

An ICT provider designated as critical to the EU financial system and placed under direct European supervisory oversight.

Computer Security Incident Response Team — the national body organisations report significant incidents to under NIS2.

The Article 21(g) measure covering basic security practices and cybersecurity training for all staff.

Regulation (EU) 2024/2847 setting mandatory cybersecurity requirements for products with digital elements sold in the EU.

Sweden's national law transposing the NIS2 Directive, in force since 2026.

The two main types of EU law: a regulation applies directly in all member states, while a directive must be transposed into national law first.

The Digital Operational Resilience Act, Regulation (EU) 2022/2554, the EU's ICT security law for the financial sector, applicable since 17 January 2025.

The first NIS2 incident report, due to the CSIRT within 24 hours of becoming aware of a significant incident.

The European Union Agency for Cybersecurity, which supports NIS2 implementation with guidance, coordination, and reporting.

The three European Supervisory Authorities for banking, securities markets, and insurance, which jointly develop DORA's technical standards and oversee critical ICT providers.

An organisation classified under NIS2 Annex I sectors that faces the strictest supervisory regime and highest penalty ceiling.

The concluding NIS2 incident report, due no later than one month after the incident notification.

Sweden's Financial Supervisory Authority, the competent authority for DORA compliance among Swedish financial entities.

An assessment of the impact on fundamental rights that certain deployers must complete before using a high-risk AI system.

The interplay between NIS2 and GDPR — one incident can trigger both a CSIRT report and a personal data breach notification, on different clocks and to different authorities.

AI models trained for broad capability and usable across many tasks, subject to their own obligations under the AI Act since August 2025.

An AI system in a use case listed by the AI Act as high-risk, subject to the law's full compliance regime.

The documented set of strategies, policies, and tools that DORA requires financial entities to maintain for managing ICT risk.

An organisation under NIS2 Annex I or II sectors that meets the medium-enterprise threshold without reaching essential-entity status.

The second NIS2 incident report, due within 72 hours, updating the early warning with an initial assessment of severity and impact.

The international standard for information security management systems, widely used as a framework for implementing NIS2's requirements.

The European Supervisory Authority appointed to directly oversee a critical ICT third-party provider under DORA.

The legal principle that a sector-specific law overrides a general one — the reason financial entities follow DORA instead of NIS2.

An ICT incident meeting DORA's classification thresholds, triggering mandatory reporting to the financial supervisor.

The board of directors, executive committee, or equivalent governing body of an organisation.

The Swedish Civil Contingencies Agency, the central coordinating authority for NIS2 in Sweden.

A login security method requiring more than one form of verification, required under NIS2 Article 21(j).

The process by which an EU member state converts the NIS2 Directive into its own national law.

Directive (EU) 2016/1148, the EU's first cybersecurity law, replaced by NIS2 in 2023.

The EU's Directive (EU) 2022/2555, the updated cybersecurity law covering critical sectors across the Union.

An independent organisation designated by a member state to perform third-party conformity assessments of certain high-risk AI systems.

The AI uses banned outright under Article 5 of the AI Act, applicable since 2 February 2025.

The DORA principle that requirements scale with an entity's size, risk profile, and the criticality of its services.

The AI Act's two central roles: the provider develops or places an AI system on the market; the deployer uses it under its own authority.

The mandatory register of all contractual arrangements with ICT third-party providers that DORA requires financial entities to maintain and report.

The NIS2 duty for in-scope entities to identify themselves to the national authority with basic information about their organisation.

A controlled environment, run by authorities, where AI systems can be developed and tested under regulatory supervision before market launch.

The AI Act's structure of four risk tiers — unacceptable, high, limited, and minimal — with obligations scaled to each.

Regulatory and Implementing Technical Standards — the detailed EU rules that specify how DORA's high-level requirements work in practice.

An incident that has caused, or could cause, severe operational disruption, financial loss, or considerable damage to others.

The NIS2 rule that brings organisations into scope based on size: at least 50 employees or over EUR 10 million in annual turnover, in a covered sector.

One of the 10 Article 21 measures, requiring entities to assess and manage cybersecurity risk from suppliers and service providers.

The AI Act's designation for the most capable general-purpose AI models, whose reach could cause large-scale harm across the EU.

The European framework for Threat Intelligence-Based Ethical Red Teaming, developed by the ECB, on which DORA's TLPT requirements build.

Advanced penetration testing based on real threat intelligence, required at least every three years for significant financial entities under DORA.

The AI Act duties to disclose when people interact with AI, and when content is AI-generated or manipulated.

Coordinated Vulnerability Disclosure — a structured process for receiving, handling, and remediating vulnerability reports from third parties.