Regulation as engineering.
EU AI Act, NIS2, GDPR, UNECE R155. Legal text turned into technical evidence.
TheEUAIActsetsrisk-basedobligationsforAIsystems.NIS2extendscybersecurityduties.UNECER155gatestypeapproval.Wemapeachrequirementtoevidence:riskclassification,gapanalysis,documentation,conformityassessment.
| Sector | EU AI Act | NIS2 | UNECE R155 | GDPR |
|---|---|---|---|---|
| Automotive | ||||
| Healthcare | ||||
| Finance | ||||
| Energy | ||||
| Tech / SaaS |
EU AI Act
Risk classification (unacceptable, high, limited, minimal). Obligations mapping, technical documentation, conformity assessment support.
NIS2 Directive
Posture against NIS2: incident reporting, supply chain, continuity, vulnerability handling. Gap analysis with a remediation roadmap.
UNECE R155 & Type Approval
CSMS per ISO/PAS 5112 audit criteria. Engineering evidence and support through the Technical Service audit. Integrated with ISO 21434 work.
GDPR for AI & Connected Vehicles
Impact assessments for AI systems on personal data: vehicle telemetry, driver analytics, V2X data. DPO advisory and privacy-by-design reviews.
Frequently Asked Questions
Four tiers. Unacceptable (banned), high-risk (conformity assessment), limited (transparency), minimal (no obligations). Most enterprise systems fall in high-risk or limited.
18 critical sectors, more than 50 employees or €10M turnover, or any entity a member state designates as essential. Fines up to €10M or 2% of global turnover.
R155 is the regulation: a certified CSMS for type approval. ISO/SAE 21434 is the standard that says how. One produces the evidence the other audits.
A gap analysis for one regulation takes 4 to 6 weeks. Full support to an audit-ready state, 3 to 9 months depending on maturity.