eu compliance

The EU AI Act does not arrive on a single date. It applies in stages between 2024 and 2028, and each stage switches on a different set of obligations for the organizations that build or use AI systems in Europe.

The schedule also moved. The Digital Omnibus on AI, in force since 27 July 2026, pushed the high-risk regime for Annex III systems back to 2 December 2027, which gives most compliance teams extra runway while the obligations themselves still arrive.

NIS2 is the EU Network and Information Systems Directive 2. It came into force on October 17, 2024 after a two-year transposition window, and it requires roughly 160,000 European organizations to implement cybersecurity risk-management measures that include workforce training. Management bodies are personally accountable for approving and following that training.

If you run security inside an essential or important entity, the training question is no longer abstract. Auditors and national competent authorities now expect documented evidence that staff and leadership have been trained, that the content reflects current threats, and that management is involved rather than observing from a distance.