EU AI Act, DORA and NIS2: AI security evidence for European enterprises
Europe wrote the rules the rest of the world is copying. Kapālins turns the EU AI Act, DORA and NIS2 into controls proved continuously, so a European CISO can show a supervisor which AI the company runs and that each still behaves as approved.
What changes for the EU enterprises, and when.
The Digital Omnibus on AI, in force since 27 July 2026, moved Annex III high-risk obligations to 2 December 2027 and Annex I product obligations to 2 August 2028. It did not move Article 50 transparency, which has applied since 2 August 2026. DORA has applied to financial entities since January 2025, NIS2 transposition is complete in most member states, and the Cyber Resilience Act's reporting duties begin in September 2026. The deferral bought time to build evidence, not to wait.
- In force
Digital Omnibus on AI, Regulation (EU) 2026/1744, in force. Delays high-risk obligations; leaves transparency duties in place. Source (secondary)
- In force
EU AI Act general date of application; Article 50 transparency duties apply. Disclosure of AI interaction and generated content for every deployer. Source (secondary)
- In force
Cyber Resilience Act reporting obligations begin. Actively exploited vulnerabilities in products with digital elements, including AI-enabled products, must be reported. Source (secondary)
- In force · upcoming
EU AI Act Annex III high-risk requirements apply. Risk management, data governance, technical documentation, human oversight, accuracy and cybersecurity for standalone high-risk systems. Source (secondary)
- In force · upcoming
EU AI Act Annex I product-related high-risk requirements apply. AI embedded in products already under EU product-safety law. Source (secondary)
Dates: each entry links to its source. A source marked secondary is a law firm, analyst or vendor summary; check the primary text before relying on the date. The full calendar is on the AI regulation tracker.
Mapped on the platform for the EU.
Every framework page says which controls are proved by a live signal from the gateway, probes or device sensor, and which by assessment evidence. Both are exported in the regulator evidence pack.
Hosting and residency.
Today the platform and its data are hosted in Australia. A Sovereign plan for on-premises or air-gapped deployment is announced as coming soon; GDPR transfer mechanisms are addressed in the privacy policy.
Industries and cities.
Questions buyers in the EU ask.
Is Kapālins available in the EU?
Yes. Kapālins is delivered remotely from Melbourne, Australia, and through partners in the Authorised, Premier and Elite tiers. Organisations in Dublin, Frankfurt, Amsterdam, Paris, Berlin are served in the same way: a briefing on your own estate, then onboarding.
Which the EU frameworks does the platform map?
EU AI Act, GDPR, DORA, NIS2, Cyber Resilience Act, ISO/IEC 42001, ISO/IEC 27001, OWASP LLM Top 10, MITRE ATLAS. Each framework page lists the controls mapped and whether a control is proved by a live platform signal or by assessment evidence.
Where is our data hosted?
Today the platform and its data are hosted in Australia. A Sovereign plan for on-premises or air-gapped deployment is announced as coming soon; GDPR transfer mechanisms are addressed in the privacy policy.
Did the Digital Omnibus cancel the high-risk obligations?
No. Regulation (EU) 2026/1744 moved Annex III obligations to 2 December 2027 and Annex I obligations to 2 August 2028. Article 50 transparency duties have applied since 2 August 2026.