Exposure check

EU regulatory exposure check: which rules apply to your company?

Eight questions, about two minutes. The checker applies the scope criteria of the GDPR, the AI Act, NIS2 and DORA to your situation and cites, for each regulation, the article behind the result.

By Younes Lahrach, data protection specialist and external DPO, director of Sila International Advisory. First published on , last reviewed against the texts on .

Your answers stay in your browser: nothing is stored or sent.

Where is your company established?
Do you process personal data (customers, employees, prospects, users)?
What role does artificial intelligence play in your business?
What is your position relative to the financial sector?
How large is your company?

Your regulatory exposure

Answer every question to see the result.

How to read the result

In scope

The scope criteria are met on the basis of your answers.

Likely in scope

The main criteria are met, but the outcome depends on something to check: national transposition, contract terms or designation by an authority.

Needs review

A special case or exception may apply. Analysis is needed.

Not in scope prima facie

The criteria are not met today. Revisit if your business changes.

What the checker does not do

It does not replace an analysis of your situation. It ignores national regimes, corporate groups and multiple activities, and it calculates no fines. It tells you where to start.

Frequently asked questions

Are my answers stored?

No. Everything is computed in your browser. No answer is stored or sent to Sila or anyone else.

Is the result legal advice?

No. It is an orientation based on the scope criteria of each text. Only an analysis of your situation, including contracts and organisation, can settle the question.

Why is NIS2 only "likely"?

Directive (EU) 2022/2555 sets the criteria, but each Member State transposes it into national law. The exact regime depends on that law and on where you operate.

About the author

Younes Lahrach is the founder and director of Sila International Advisory. A GDPR legal consultant and external data protection officer since July 2025, he holds a Master's degree (M2) in European Union law, specialising in data protection, from the University of Lille, and an MBA in International Finance from Middlesex University. He is a legal consultant, not a lawyer (avocat).

His background →

Reference texts

The information on this page is general in nature and does not constitute legal advice on a specific situation. Sila is not a law firm and does not provide representation before the courts.