Understand regulations. Use automation right.
EU regulations are reshaping how businesses use technology. Here is what matters for your automation projects.
GDPR
Since 2018The General Data Protection Regulation governs how personal data of EU residents is collected, stored, and processed.
Who is affected?
Any company processing personal data of EU residents, regardless of where the company is located.
Key Requirements
- Purpose limitation: Data only for specified purposes
- Data minimization: Collect only what you need
- Right to erasure: Delete data on request
- Breach notification: 72 hours to report
- Data Processing Agreements with all processors
Business Implications
- US cloud services require Standard Contractual Clauses (SCCs) and additional safeguards
- AI tools processing personal data need Data Processing Agreements
- Automated decision-making requires human oversight option
FluxHuman Approach
EU hosting preferred. No data to US services without your consent. All automations documented.
FAQ
EU AI Act
Phased 2024-2027The world's first comprehensive AI regulation. Classifies AI systems by risk level and sets requirements accordingly.
Who is affected?
Anyone developing or deploying AI systems in the EU. Requirements depend on risk classification.
Timeline
Risk Categories
- Prohibited: Social scoring, manipulative AI, real-time biometrics in public
- High-Risk: HR decisions, credit scoring, critical infrastructure
- Limited Risk: Chatbots (transparency required)
- Minimal Risk: Most business automation
Business Implications
- High-risk AI requires conformity assessment, documentation, human oversight
- Chatbots must disclose they are AI
- Most workflow automation falls under minimal risk
FluxHuman Approach
We design use cases to stay in the minimal or limited risk categories where possible.
FAQ
NIS2
DE: Dec 2025 / AT: Oct 2026The Network and Information Security Directive 2 expands cybersecurity requirements to more sectors and smaller companies.
Who is affected?
Medium and large companies (50+ employees or €10M+ turnover) in covered sectors. In Germany: ~30,000 companies.
Covered Sectors
Energy, Transport, Banking, Healthcare, Digital Infrastructure, Manufacturing, Waste, Chemicals, Food, Postal, Research
Key Requirements
- Risk management policies and procedures
- Incident reporting within 24 hours
- Supply chain security audits
- Business continuity plans
- Management liability: Directors personally accountable
Business Implications
- Software vendors become part of your attack surface
- Security questionnaires for every new tool
- No more shadow IT purchases by departments
FluxHuman Approach
Open standards, documented processes, no black boxes. We provide security documentation.
FAQ
DORA
Since Jan 2025The Digital Operational Resilience Act creates a unified framework for ICT risk management in the financial sector.
Who is affected?
Banks, insurers, investment firms, payment providers, crypto service providers, and their critical ICT providers.
Key Requirements
- ICT risk management framework
- Incident classification and reporting
- Regular resilience testing
- Third-party provider register (due April 2025)
- Exit strategies for all critical vendors
Business Implications
- No vendor lock-in allowed, must be able to switch providers
- All ICT providers must be documented and monitored
- Contracts must include security, audit rights, and exit clauses
FluxHuman Approach
No vendor lock-in. Open standards. Exit strategy always possible. Full documentation.
FAQ
Our Principles
Vendor Freedom
Open standards. n8n, Make, Zapier, or custom. We use what fits, not what locks you in.
Maintainable by Anyone
Documented processes, standard tools. Any developer can continue the work.
AI Only Where It Helps
Often simple automation is more reliable. We recommend what actually fits.
You Approve What Matters
Critical decisions require manual approval. Automation supports, does not override.