Cross-regulation mappings¶
Most organizations don't face one EU digital regulation. They face several at once. The expensive mistake is building a separate compliance silo for each. These mappings show where obligations overlap so one control, one document or one process can serve multiple regulations.
Planned mappings¶
| Mapping | The practical question it answers |
|---|---|
| DORA × NIS2 | A financial entity is largely carved out of NIS2 where DORA applies, but group entities and suppliers may not be. Who follows which rulebook? |
| DORA × AI Act | AI systems inside a financial entity: which incident, risk and third-party obligations stack? |
| AI Act × GDPR | Training data, automated decision-making, DPIAs vs. FRIAs, and where one assessment can feed the other |
| Incident reporting across all four | One incident, multiple clocks: a single reference for what must be reported to whom, and when |
| Third-party / supply-chain obligations | DORA Art. 28–30, NIS2 Art. 21(2)(d), GDPR Art. 28: one vendor-management process to satisfy all three |
Under construction
Mappings ship once their underlying single-regulation artefacts exist. Announcements on the blog.
From my library¶
Tooling for working with the regulations as data, plus multi-framework collections.
GRC skills for AI assistants
A collection of AI-assistant skills covering more than 30 frameworks, ISO to SOC 2 to GDPR. Shows how compliance knowledge can be packaged for LLM tooling.
github.comChat EUR-Lex
RAG chat over EUR-Lex texts. If you spend your days inside EU regulations, this kind of tooling is worth watching.
github.comeurlex (R package)
Retrieve EU law data from EUR-Lex programmatically. The workhorse if you want to analyse regulation texts as data.
github.comEUR-Lex visualiser
Visualises EUR-Lex legislation. From the Maastricht Law & Tech Lab.
github.comeur-lex scripts
Download, parse and visualise EU legislative data. Useful raw material for mapping work.