Transport & mobility compliance: NIS2, AI Act, Data Act & GDPR

Why the 'Transport & Mobility' sector is affected

Transport is a critical sector under NIS2: a disruption to traffic management or ticketing systems has an immediate impact on the mobility of thousands of people. Securing supervision systems and connected infrastructure is a top priority.

The AI Act classifies as high-risk AI systems used as safety components in road traffic management and operation. Operators who automate traffic regulation therefore bear substantial obligations.

Finally, mobility generates vast amounts of personal data — ticketing, geolocation, travel histories — protected under the GDPR, as well as mobility data to which the Data Act promotes access and sharing in order to develop services (MaaS).

NIS2 — transport, an essential sector

Air, rail, road and maritime transport is among the essential entities under NIS2. Operators must deploy risk management measures, secure supervision and ticketing systems, notify incidents and involve senior management.

Sector-specific security regulations (aviation, rail) are coordinated with NIS2.

Key obligations

• Risk management measures (Art. 21).
• Security of supervisory and ticketing systems.
• Notification of significant incidents.
• Interaction with sector-specific security regimes.

AI Act — high-risk traffic management AI

The AI Act classifies as high-risk AI systems used as safety components in road traffic management and operation. Authorities and operators who automate traffic regulation are affected, along with the associated high-risk obligations.

Optimisation or passenger information use cases fall under lighter regulatory regimes.

Key obligations

• Classify traffic management AI (high risk).
• Risk management and data quality.
• Human oversight and documentation.
• Post-market surveillance.

Data Act — mobility data

The Data Act promotes access to and sharing of data generated by connected vehicles and mobility services, forming the foundation of multimodal mobility services (MaaS) and aftersales. Connected vehicle data is covered in detail on the "Automotive" page.

Key obligations

• User access to generated data.
• Sharing with designated third parties (mobility services).
• 'Data access by design' architecture.
• Revision of connected services contracts.

GDPR — ticketing, geolocation, travel

Mobility generates massive volumes of personal data: named travel tickets, geolocation, journey histories. GDPR governs these processing activities, with geolocation and travel habits being particularly sensitive.

Key obligations

• Legal basis and information for ticketing and geolocation.
• Minimisation of location data.
• Security and retention periods.
• Framework for travel profiling.

Comparative overview of regulations

How these regulations interact

Security and data are the two key dimensions. A traffic management system combines NIS2 (essential sector) and the AI Act (high risk if it includes a safety component). A mobility platform combines GDPR (movement data) and the Data Act (access to and sharing of mobility data).

Sector-specific regulations (aviation, rail) add a layer of security that must be articulated with NIS2 rather than duplicated.

Application timeline

• 1GDPR. In force; vigilance on ticketing and geolocation.
• 2Data Act. Majority of obligations applicable from 12 September 2025.
• 3AI Act. High risk (road traffic) from 2026–2027.
• 4NIS2. French transposition under way; essential regime to anticipate.

Applicable penalties

NIS2 up to €10M or 2% (essential entities), AI Act up to €35M or 7%, GDPR up to €20M or 4%. Data Act: national sanctions.

The risk is also operational: a disruption to transport systems immediately affects people's mobility.

Compliance roadmap

• 1Securing critical systems. Deploy NIS2 measures on supervision and ticketing.
• 2Qualify traffic AI. Identify AI security components and document them.
• 3Opening mobility data. Implement Data Act access and sharing.
• 4Protect transfers. Minimising and securing ticketing and geolocation data.
• 5Steer. Involve management, appoint a DPO and CISO, periodic review.

How Data Comply One supports the sector

Data Comply One covers GDPR, AI Act, NIS2 and DORA on a single platform, with outsourced DPO and CISO services, and supports transport and mobility operators on NIS2 essential entity status and AI-based traffic management.

DCO provides tailored templates (NIS2 measures, AI Act documentation, mobility data mapping).

Frequently asked questions