Skip to the page
Eurus
Try it live
Menu

Which laws apply

Which laws apply, and on what provision.

The scoping questions the software asks every business it serves. Each law gets a verdict as you answer (applies, may apply or does not apply) with the provision it rests on, the reasons, and what is still unknown. A question left unanswered keeps the law at may apply. Your answers give the verdicts on this page and are then discarded.

Try it live Book an audit

Compliance, kept on every record

The check

Answer what you know. Each answer moves the verdicts at once.

0 of 20 answered

The business

Where is the business established?

NIS2, DORA and GDPR are read by where the business is established; GDPR and the AI Act also reach businesses outside the EU.

How many people does the business employ, as annual work units?

The enterprise size ceilings (Recommendation 2003/361/EC) start at headcount: under 10, under 50, under 250.

Annual turnover, from the last approved accounts?

The size ceilings take turnover or the balance sheet total, whichever keeps the business smaller.

Annual balance sheet total?

Within each ceiling, turnover and the balance sheet are alternatives: only one has to be under it.

Do those figures include partner and linked enterprises (a holding of a quarter or more in the business, or held by it)?

The size ceilings count partner and linked enterprises (Annex to Recommendation 2003/361/EC, Articles 3 and 6).

GDPR

Does the business keep personal data on a computer or in organised files: staff, customers, patients, contacts?

GDPR applies to processing personal data wholly or partly by automated means, or in a filing system (Article 2(1)).

Does the business decide why and how that personal data is used, for its own purposes?

That makes it a controller (Article 4(7)).

Does the business also handle personal data on behalf of customers, on their instructions (hosting, payroll, IT support, marketing)?

That makes it a processor for that work (Article 4(8)), with a contract under Article 28.

Is the business a public authority or public body?

A public authority or body designates a data protection officer (Article 37(1)(a)).

Do the business's core activities include regular and systematic monitoring of people on a large scale (tracking, profiling, CCTV networks)?

That requires a data protection officer (Article 37(1)(b)).

Do the business's core activities include processing health, biometric or other special-category data, or criminal records, on a large scale?

That requires a data protection officer (Article 37(1)(c)).

NIS2

Which of these does the business do? (NIS2 Annex I)

NIS2 applies to entities of the types in its Annexes I and II (Article 2(1)).

And which of these? (NIS2 Annex II)

Annex II entities are important entities when in scope; Annex I entities can be essential.

Do either of these describe the business?

Both bring an entity into NIS2 whatever its size (Article 2(3) and (4)).

Has a national authority told the business it is an essential or important entity under NIS2?

A Member State can identify an entity of an Annex I or II type whatever its size (Article 2(2), points (b) to (e)).

DORA

Is the business any of these? (DORA Article 2(1))

DORA applies to the financial entities it lists, and reaches ICT third-party service providers through them.

Does the business provide ICT services (software, hosting, IT support, data) to banks, insurers, payment or investment firms?

Financial entities must put DORA's contract terms into those contracts (Article 30).

EU AI Act

Does anyone at the business use AI systems for work (chat assistants, copilots, a chatbot on the website, AI in a product)?

A business using an AI system under its authority is a deployer (Article 3(4)).

Does the business do any of these with AI systems?

Importers, distributors and product manufacturers have their own place in the Act (Article 2(1), points (d) and (e)).

ISO/IEC 27001

ISO/IEC 27001: what does the business want?

A standard the business chooses; customers and tenders often ask for it.

The verdicts

  • GDPR

    May apply

    Waiting for answers

    Rests on

    • GDPR Article 2(1): Applies to processing personal data wholly or partly by automated means, and otherwise where it is in, or meant for, a filing system.
    • GDPR Article 30(1), (2) and (5): Controllers and processors keep a record of processing; under 250 staff it is not required unless the processing is likely to result in a risk, is not occasional, or includes special-category or criminal data.

    Still unknown

    • Whether the business keeps personal data.
    • Where the business is established.
    • Whether it decides why and how the data is used (controller).
    • Whether it handles personal data on others' behalf (processor).
    • Whether Article 37(1) requires a data protection officer.

  • NIS2

    May apply

    Waiting for answers

    Rests on

    • NIS2 Article 2(1): Applies to entities of a type in Annex I or II that are medium-sized or larger and provide their services or carry out their activities in the Union.
    • Recommendation 2003/361/EC, Annex, Article 2: Medium-sized: fewer than 250 staff and turnover up to EUR 50 million or a balance sheet up to EUR 43 million; small: fewer than 50 and EUR 10 million; micro: fewer than 10 and EUR 2 million.

    Still unknown

    • Which NIS2 Annex I or II activities the business carries out.
    • Whether a national authority has identified the business under Article 2(2), points (b) to (e).
    • Headcount.
    • Turnover or balance sheet total.
    • Whether the figures include partner and linked enterprises (Recommendation 2003/361/EC, Annex, Articles 3 and 6).

    Ireland had not transposed NIS2 into Irish law by 1 November 2026, though Article 41(1) set 17 October 2024. This reads the Directive itself; the Irish Act, once passed, sets the duties, the registration and the regulator, and may differ.

  • DORA

    May apply

    Waiting for answers

    Rests on

    • DORA Article 2(1): Applies to the financial entities in points (a) to (t), and to ICT third-party service providers (point (u)).

    Still unknown

    • Whether the business is one of the entities in DORA Article 2(1).
    • Whether it provides ICT services to financial entities.

  • AI Act

    May apply

    Waiting for answers

    Rests on

    • AI Act Article 2(1): Applies to providers placing AI systems on the Union market, deployers established in the Union, providers and deployers outside it whose output is used in it, importers, distributors and product manufacturers.

    Still unknown

    • Whether anyone uses AI systems for work.

  • ISO/IEC 27001

    May apply

    Waiting for answers

    Still unknown

    • Whether the business wants certification, alignment, or neither.

    A standard: it applies when the business chooses it, or when a customer or tender asks for it.

How to read a verdict

The law by sector

  • The provision, every time

    Each verdict shows the article that sets the law's scope, in a sentence close to its own words, with a link to the official text.

  • Unknown is said

    What the answers leave open is listed under each law, as unknown.

  • NIS2 in Ireland

    Ireland had not transposed NIS2 by 1 November 2026. The verdict reads the Directive itself and says so.

Start here

See it on a business of your own.

Open your own copy in a few seconds and use it for two hours, with nothing to sign up for. When you want it on your own systems, we start with an audit.

Try it live Book an auditNext: What each system is checked for