European regulatory compliance

The regimes we cover

Four European instruments and one question of structure. Each page sets out who is caught, from when the obligations become enforceable, and what the competent authority can sanction.

Regulation (EU) 2016/679

GDPR

Scope under Articles 3(1) and 3(2), the representative under Article 27, records under Article 30, and the data protection officer mandate under Article 37(6).

Read the page

Regulation (EU) 2024/1689

AI Act

In force since 1 August 2024, applying in stages until 2 August 2027. The prohibited practices in Article 5 have been enforceable since 2 February 2025, the Annex III high-risk systems from 2 August 2026.

Read the page

Directive (EU) 2022/2555

NIS2

Essential and important entities, the size rule and the entities caught regardless of size, the 24-hour early warning, and the enhanced supervision regime for essential entities.

Read the page

Regulation (EU) 2022/2554

DORA

Applicable since 17 January 2025. The register of information under Article 28, the mandatory contractual clauses of Article 30, and the additional set required for critical or important functions.

Read the page

Structuring and registration

Registering in France

Registering a company in France as a foreign business: what each form commits you to in liability, tax and director social security, and the direct effect of the choice on GDPR, NIS2 and DORA scope.

Read the page

A recurring engagement

Outsourced DPO

The outsourced DPO mandate entrusted to Sila on the basis of a service contract, Article 37(6) of Regulation (EU) 2016/679. Annual subscription, tailored quotation within 48 hours.

Delegate ongoing oversight to an external DPO

The information on these pages is general in nature and does not constitute legal advice on a specific situation. Sila is not a law firm and does not provide representation before the courts.

Request a quotation