Regulations and standards
Security requirements and how to meet them
Legal obligations, customer expectations and certification requirements can overlap. We identify what applies, build on your existing work and help implement a coordinated plan.
How EU laws and standards differ
| EU law | Standard | |
|---|---|---|
| Who sets it | EU lawThe EU. Directives such as NIS2 become national law in each country. | StandardInternational or industry bodies, such as ISO or the card payment industry. |
| Who must follow it | EU lawEvery business or product the law covers. | StandardBusinesses that choose it, or whose customers, partners or card agreements require it. |
| Who checks you | EU lawNational regulators and other authorities. | StandardIndependent auditors or certification bodies. |
| What you end up with | EU lawDuties you keep meeting and, for most of these laws, reports when something serious happens. | StandardThe evidence the framework requires, such as a certificate, audit report or documented assessment. |
| Examples | EU lawNIS2, DORA, MiCA, the EU AI Act, the Cyber Resilience Act | StandardISO 27001, ISO 42001, SOC 2, PCI DSS, IEC 62443 |
EU laws
Rules set by EU law
Your obligations depend on your activities, products and role. We assess applicability, set priorities and support the security and compliance work required.
Run the free CRA checkNIS2
Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the UnionAn EU directive on cybersecurity risk management and incident reporting for organisations in specified critical sectors.DORA
Regulation (EU) 2022/2554 on digital operational resilience for the financial sectorEU rules for financial institutions on IT risk, incident response, recovery, resilience testing and IT suppliers.MiCA
Regulation (EU) 2023/1114 on markets in crypto-assetsEU rules for crypto-assets, including licensing and operating requirements for service providers and obligations for token issuers.EU AI Act
Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligenceEU rules for developing and using AI. Your obligations depend on your role and the risks of the AI system.Cyber Resilience Act
Regulation (EU) 2024/2847 on horizontal cybersecurity requirements for products with digital elementsEU cybersecurity requirements for connectable software and hardware products, including security updates and vulnerability handling.
Standards
Standards and independent assurance
These frameworks help you manage security and demonstrate it to customers. We support preparation and implementation; the relevant independent auditor or certification body conducts the formal assessment where required.
ISO 27001
ISO/IEC 27001:2022: Information security management systems: RequirementsAn international standard for managing information security risks, with independent certification of your management system.SOC 2
System and Organization Controls 2An independent assurance report assessing a service provider’s controls for protecting customer data.PCI DSS
Payment Card Industry Data Security StandardA security standard for organisations that handle payment card data or can affect the security of the card data environment.IEC 62443
ISA/IEC 62443 series: Security for industrial automation and control systemsInternational standards for protecting industrial automation and control systems throughout their lifecycle.ISO 42001
ISO/IEC 42001:2023: Artificial intelligence management systemAn international standard for managing how organisations develop and use AI, with responsibilities, risk assessment and ongoing oversight.
Requirements to consider in your sector
| Sector | Requirements to consider |
|---|---|
| Financial services & fintech | DORA, plus PCI DSS for firms that handle card data |
| Crypto & digital assets | MiCA for crypto-asset services; DORA for authorised CASPs |
| Technology & SaaS | ISO 27001 or SOC 2 for customer assurance; DORA through financial-sector contracts; CRA for products within scope |
| Energy & utilities | NIS2, plus IEC 62443 for industrial systems |
| Healthcare | NIS2, depending on your size and national rules |
Free 30-minute call
Find the requirements that matter
Tell us about your business and customer requests on a free call to check which laws and standards apply.
