Automotive sector compliance: GDPR, AI Act, NIS2 & Data Act

Why the 'Automotive' sector is concerned

The connected vehicle is a data platform: location, driving style, diagnostics, and usage of onboard services. A large proportion of this data is personal (attributable to the driver), placing GDPR at the forefront — particularly with regard to geolocation, which is especially sensitive.

The Data Act opens access to this generated data: the manufacturer must allow the user to access it and share it with third parties of their choosing (independent repairers, insurers) — a major issue for the aftersales market.

Automated driving relies on AI systems that play a safety role and are liable to be classified as high-risk under the AI Act, in conjunction with type approval for vehicles. In addition, vehicle manufacturing falls within the scope of NIS2, with a particularly extensive and exposed supply chain.

Data Act — connected vehicle data

The Data Act requires manufacturers to make data generated by the vehicle and its associated services accessible to the user, and to allow it to be shared with designated third parties. This is a structural lever for enabling independent repairers and insurers to access vehicle data.

The design must incorporate this access, and connected service contracts must be reviewed.

Key obligations

• User access to vehicle-generated data.
• Sharing with designated third parties (repairers, insurers).
• 'Data access by design' architecture.
• Revision of connected services contracts.

AI Act — driving AI as a safety component

AI systems playing a safety role in automated driving may be classified as high-risk, in conjunction with type approval. The obligations are substantial: risk management, data quality, human oversight, and documentation. Other uses (infotainment, assistants) fall under lighter regulatory regimes.

Key obligations

• Qualifying driving AI (potentially high risk).
• Risk management and data quality.
• Human oversight and technical documentation.
• Interaction with reception by type.

NIS2 — vehicle manufacturing

The manufacture of vehicles and transport equipment is listed among the important entities under NIS2, beyond the size threshold. Manufacturers and equipment suppliers must deploy risk management measures, secure IT/OT convergence and, above all, a particularly extensive automotive supply chain.

Key obligations

• Risk management measures (art. 21) IT/OT.
• Security of an extended supply chain.
• Notification of significant incidents.
• Management accountability.

GDPR — driver's personal data

The connected vehicle generates personal data: location, driving habits, synchronised contacts. The manufacturer and embedded service providers are controllers or joint controllers and must govern these processing activities, with geolocation requiring particular vigilance.

Key obligations

• Legal basis and information on vehicle data.
• Strengthened framework for geolocation.
• Allocation of roles: controller / joint controller / processor.
• Security and retention periods.

CRA — components with digital elements

The Cyber Resilience Act may apply to certain automotive components with digital elements, in conjunction with the sector-specific type-approval framework, which already sets out cybersecurity requirements for vehicles. The analysis must be conducted on a component-by-component basis.

Key obligations

• Analysing CRA applicability component by component.
• Articulate with reception by type (vehicle cybersecurity).
• Vulnerability management of digital components.

Comparative overview of regulations

How these regulations interact

Vehicle data sits at the intersection of two regimes: GDPR (when it is personal data: location, driving behaviour) and the Data Act (access to and sharing of all generated data). Both must be addressed together, as the same location data falls simultaneously under GDPR protection and Data Act access rights.

Security, for its part, plays out across three interconnected dimensions: type approval (vehicle cybersecurity), NIS2 (manufacturing and supply chain security), and, where applicable, CRA (digital components). A coherent security policy covering product, factory, and components avoids duplication and blind spots.

Application timeline

• 1GDPR. In force; strong vigilance required on geolocation.
• 2Data Act. Majority of obligations applicable from 12 September 2025.
• 3AI Act. Prohibitions since February 2025; high-risk according to the product rollout schedule (2026–2027).
• 4NIS2. French transposition in progress; anticipate across an extended supply chain.

Applicable penalties

The regimes are cumulative: AI Act up to €35M or 7%, GDPR up to €20M or 4%, NIS2 up to €10M or 2%, CRA up to €15M or 2.5%. The Data Act refers to national sanctions.

The risk has a physical safety dimension: a cybersecurity flaw in a connected vehicle can affect the safety of its occupants, beyond any administrative penalty.

Compliance roadmap

• 1Mapping vehicle data. Distinguish personal data (GDPR) from generated data (Data Act) and implement tools to govern access to each.
• 2Qualify the driving AI. Identify high-risk systems and produce the required documentation, in line with type-approval requirements.
• 3Securing product, factory and supply chain. Coordinate intake by type, NIS2 and CRA under a common security policy.
• 4Governing connected services. Revise contracts and information notices (geolocation, third parties).
• 5Steer. Involve management, appoint a DPO and CISO, periodic review.

How Data Comply One supports the sector

Data Comply One covers GDPR, AI Act, NIS2, and DORA on a single platform, with outsourced DPO and CISO services, and supports automotive players in navigating the GDPR / Data Act intersection (vehicle data) as well as product and factory security.

DCO provides tailored templates (register, AI Act documentation, connected vehicle data mapping) to address these regulatory texts in a coordinated manner.

Frequently asked questions