Overlaps

Where EU regulations overlap

The GDPR, the AI Act, NIS2 and DORA were drafted separately, yet they often apply to the same contract, system or incident. These pages deal with each overlap once, with the priority rule where there is one.

By Younes Lahrach, data protection specialist and external DPO, director of Sila International Advisory. First published on November 4, 2026, last reviewed against the texts on November 4, 2026.

Frequently asked questions

Areas of overlap

Incident reporting

72 hours, 24 hours, 4 hours: three reporting regimes for one incident, compared article by article.

NIS2 or DORA

The sector-specific act rule: when DORA displaces NIS2, and what stays under NIS2.

GDPR and DORA

Contracts, security and incidents: three areas where the GDPR and DORA target the same thing.

Reference texts

The information on this page is general in nature and does not constitute legal advice on a specific situation. Sila is not a law firm and does not provide representation before the courts.

The EU regulations we cover Request a quotation