Built in, not bolted on.
GDPR, EU AI Act, NIS2 and DORA: what applies to you, and what every project delivers for it.
Included in every project
What "GDPR-compliant" and "EU AI Act implemented" mean with us: these eight items are part of every project with an AI step or personal data, in writing. Without either, we deliver items 2 to 4 and a short classification.
GDPR
- Data processing agreement (Art. 28 GDPR) whenever we process personal data.
- Hosting in the EU or on your infrastructure, with a written list of every subprocessor and model provider.
- Data-flow documentation and technical and organisational measures (TOMs), ready for your record of processing.
- Defined retention and deletion periods, and logs of who and what accessed personal data.
EU AI Act
- A written risk classification of the AI system under the AI Act, with reasoning.
- AI labelling for chatbots and generated content where Art. 50 requires it.
- A person approves exceptions; automated decisions are logged and traceable.
- A documented briefing for your team on using the system (Art. 4).
GDPR
Since 2018. The General Data Protection Regulation governs how personal data of individuals is collected, stored, and processed, whatever their nationality or place of residence.
Who is affected? Any organisation established in the EU, and organisations outside the EU that offer goods or services to people in the EU or monitor their behaviour there (Art. 3).
Key Requirements
- Purpose limitation: Data only for specified purposes
- Data minimization: Collect only what you need
- Right to erasure: Delete data on request
- Breach notification: 72 hours from becoming aware (Art. 33)
- Data Processing Agreements with all processors
Business Implications
- US cloud services need an EU-US Data Privacy Framework (DPF) certification, or SCCs with additional safeguards if the vendor isn't DPF-certified
- AI tools processing personal data need Data Processing Agreements
- Solely automated decisions with legal or similarly significant effects are only allowed in narrow cases (contract, law, explicit consent) and need safeguards such as human intervention (Art. 22)
FluxHuman Advantage
- Data Sovereignty using Self-Hosting: We prefer n8n on your servers (or EU cloud like Hetzner). Data stays in your jurisdiction.
- Local AI: With the AI assistant on your own hardware, LLMs run locally. No data sent to OpenAI.
- Data Minimization: Our workflows process data through the pipeline and do not persist it beyond what is required for the automation.
Only with a DPA and a valid transfer basis: the provider's DPF certification or SCCs. We recommend EU-hosted or local alternatives, or anonymization first.
Not usually. GDPR Article 22 applies to decisions with legal or significant effects. Most workflow automations are excluded.
EU AI Act
Phased 2024-2028. The world's first comprehensive AI regulation. Classifies AI systems by risk level and sets requirements accordingly.
Who is affected? Anyone developing or deploying AI systems in the EU. Requirements depend on risk classification.
Annex III high-risk AI obligations deferred to 2 December 2027. Use the time until then to prepare.
Do you know how your AI systems are classified? The Digital Omnibus on AI (Regulation (EU) 2026/1744, in force since 27 July 2026) pushed Annex III high-risk obligations to December 2027, but chatbot transparency rules have applied since August 2026. Companies that prepare during this window will be better placed when the obligations kick in.
€290, credited in full against a package booked within 60 days
Timeline
- Feb 2025
- Prohibited AI practices banned, AI literacy (Art. 4)
- Aug 2025
- GPAI model rules apply
- Aug 2026
- General application, incl. transparency duties (Art. 50)
- Dec 2026
- New bans (non-consensual intimate deepfakes, CSAM); Art. 50 marking for legacy systems
- Dec 2027
- Annex III high-risk rules (Omnibus-deferred from Aug 2026)
- Aug 2028
- High-risk AI in products under Annex I
Risk Categories
- Prohibited: Social scoring, manipulative AI, emotion recognition at work, real-time biometric ID in public spaces for law enforcement
- High-Risk: HR decisions, credit scoring, critical infrastructure
- Limited Risk: Chatbots (transparency required)
- Minimal Risk: Most business automation
Business Implications
- High-risk AI requires conformity assessment, documentation, human oversight
- Chatbots must disclose they are AI
- Most workflow automation falls under minimal risk
FluxHuman Advantage
- Controlled AI: Workflow orchestration (n8n) is deterministic. AI components use human-in-the-loop approval for critical decisions, reducing (but not eliminating) hallucination risk.
- Transparency: with full source code access, AI operations are fully auditable. No black box.
- Categorization: We focus on "Minimal Risk" automation and "Limited Risk" chatbots.
Usually not. High-risk applies to decisions affecting rights or safety. FAQ bots are limited risk, requiring only transparency.
This is explicitly high-risk under Annex III. Requires full documentation, testing, and human oversight.
NIS2
DE: in force / AT: in force since 1 Oct 2026. The Network and Information Security Directive 2 expands cybersecurity requirements to more sectors and smaller companies.
Who is affected? Medium and large companies in covered sectors (50+ employees, or both turnover and balance sheet over €10M). In Germany: ~30,000 companies.
Covered Sectors: Energy, Transport, Banking, Financial Market Infrastructure, Health, Drinking & Waste Water, Digital Infrastructure, ICT Service Management (B2B), Public Administration, Space, Postal & Courier, Waste, Chemicals, Food, Manufacturing (selected products), Digital Providers, Research
Key Requirements
- Risk management policies and procedures
- Incident reporting: 24h early warning, 72h notification, 1-month final report (Art. 23)
- Supply chain security measures (Art. 21(2)(d))
- Business continuity plans
- Multi-factor authentication and access control (Art. 21(2)(j))
Business Implications
- Software vendors become part of your attack surface
- Security questionnaires for every new tool
- No more shadow IT purchases by departments
FluxHuman Advantage
- Reduced Supply Chain Risk: You hold the infrastructure. No permanent vendor access reduces third-party exposure.
- Minimized Attack Surface: Self-hosting behind VPNs/Firewalls keeps automation off the public internet.
- Update Sovereignty: You decide when to update. No forced changes that break workflows.
Not directly, unless they qualify themselves. But you must address the security of your direct suppliers (Art. 21(2)(d) and (3)), so the requirements reach many thousands of upstream companies through contracts.
Size thresholds have exceptions. Trust services, DNS providers, and TLD registries are covered regardless of size.
DORA
Since Jan 2025. The Digital Operational Resilience Act creates a unified framework for ICT risk management in the financial sector.
Who is affected? Banks, insurers, investment firms, payment providers, crypto service providers, and their critical ICT providers.
Key Requirements
- ICT risk management framework
- Incident classification and reporting
- Regular resilience testing
- Register of information on all ICT contracts (since Jan 2025)
- Exit strategies for all critical vendors
Business Implications
- You must have documented exit strategies and the ability to switch providers (not necessarily no vendor lock-in)
- All ICT providers must be documented and monitored
- Contracts need data security and termination clauses; critical functions also need audit rights and exit plans
FluxHuman Advantage
- Documented exit strategy: full source code and documentation. If we disappear, your system keeps running.
- Independence: Built on standard tech, any developer can maintain the system.
- No Proprietary Cloud: We use Open Source standards (Docker, Postgres, Python), not closed platforms.
A register of all contracts for ICT services from third-party providers, required since 17 January 2025. Supervisors collect it once a year (reference date: 31 December of the previous year).
If your company is in DORA's scope, every contracted ICT service belongs in the register. Where a tool supports critical or important functions, stricter contract, audit and exit rules apply.
Our Principles
Paid once, no subscription
Compliance requires control. You don't rent our solutions: you get the full source code with comprehensive usage rights.
Open Source Standards
We use n8n, Docker, and Python. Auditors love these global standards. No obscure proprietary tech.
Safety First Architecture
We separate logic from data. Sensitive data flows through the pipeline but is not logged unnecessarily.
Documentation Included
You get code and data flow documentation. Saves your DPO days of work.
Information as of 8 October 2026
Monitored automatically every day for amendments, corrigenda, consolidated versions and repeals: the acts cited on this page, i.e. GDPR, AI Act, NIS2 Directive, DORA, the DORA register of information (Implementing Regulation (EU) 2024/2956), the EU-US adequacy decision, the Standard Contractual Clauses, the Austrian NISG 2026 and the German BSIG. Not monitored automatically: the content of other implementing acts, harmonised standards and national guidance. Changes are reviewed and worked into this page by hand; the date above is the last review.
Not Sure Which Regulations Apply?
We check one specific AI use against GDPR and the EU AI Act and give you the result in writing. €290, credited in full against a package booked within 60 days.