Which regulations apply to my company?

GDPR (and nLPD in Switzerland) concerns almost every organisation processing personal data. NIS2 targets essential and important entities in critical sectors, DORA the financial sector, the AI Act providers and users of AI systems, the Data Act makers of connected devices, and the CRA vendors of digital products. The Data Comply One assessment determines your scope in a few minutes.

Is an ISO certification mandatory?

No. The ISO/IEC 27001 and 42001 standards are voluntary. They are not required by law, but they are increasingly requested in tenders and make it easier to prove compliance with regulations (NIS2, DORA, AI Act in particular).

Regulations & certifications

All your compliance obligations, regulations and certifications

Data Comply One covers European and Swiss regulations as well as the main ISO standards. Understand the difference, identify what applies to you, and manage everything from a single platform.

Test my compliance Request a demo

In brief

A regulation (GDPR, AI Act, NIS2, DORA, Data Act, CRA, nLPD) is a binding legal text whose breach exposes you to penalties. A certification or standard (ISO/IEC 27001, ISO/IEC 42001) is a voluntary approach, attested by an audit, that proves the application of best practices. The two are complementary.

Identify what applies to my organisation

2026 regulation calendarAll legal deadlines & news, filterable by regulation and country.

Mandatory · legal text

Regulations

Binding European and Swiss legal frameworks. Non-compliance exposes you to financial and operational penalties.

Regulation

RGPD

Règlement (UE) 2016/679 · European Union

Protection of personal data: legal bases, data subject rights, records of processing, security.

Explore RGPD

Regulation

AI Act

Règlement (UE) 2024/1689 · European Union

The world’s first AI framework: risk-based classification, obligations for providers & deployers.

Explore AI Act

Regulation

NIS2

Directive (UE) 2022/2555 · European Union

Cybersecurity for essential and important entities: governance, risk management, incident notification.

Explore NIS2

Regulation

DORA

Règlement (UE) 2022/2554 · European Union

Digital operational resilience for the financial sector: ICT risk management, testing, critical providers.

Explore DORA

Regulation

Data Act

Règlement (UE) 2023/2854 · European Union

Fair access to and sharing of data generated by connected products and related services.

Explore Data Act

Regulation

CRA

Cyber Resilience Act · European Union

Cybersecurity requirements for products with digital elements, throughout their lifecycle.

Explore CRA

Regulation

nLPD

LPD révisée (RS 235.1) · Switzerland

New Swiss federal data protection act: records of processing, security, information of individuals.

Explore nLPD

Voluntary · best-practice framework

Certifications & standards

Voluntary approaches attested by audit. They build trust and make regulatory compliance easier to prove.

ISO standard

ISO/IEC 27001

International standard

Information security management system (ISMS): risk control and continuous improvement.

Explore ISO/IEC 27001

ISO standard

ISO/IEC 42001

International standard

Artificial intelligence management system (AIMS): responsible and controlled AI governance.

Explore ISO/IEC 42001

Frequently asked questions

A regulation (GDPR, AI Act, NIS2, DORA, Data Act, CRA, nLPD) is a binding legal text: non-compliance exposes you to penalties (fines, injunctions). A certification or standard (ISO/IEC 27001, ISO/IEC 42001) is a voluntary approach: through an independent audit, it attests that your organisation applies recognised best practices. The two are complementary: certification often helps demonstrate regulatory compliance.

Assess your compliance in 5 minutes

Run our free assessment to find out which regulations apply to you and get your compliance score.

Start the assessment Request a demo

They trust us