Sector guides · Compliance
Regulatory compliance by sector
Compliance by sector starts with one question: which EU and Spanish rules apply to your organisation? Each sector has its own mix of obligations. For example, compliance in the financial sector is driven by DORA, while NIS2 also covers energy and other essential services. Choose yours to see which regulations weigh most, with their deadlines and where to start.
Banking and fintechOperational resilience, the ICT third-party register and TLPT testing. DORA has applied since 17 January 2025, and GDPR and the EU AI Act complete the picture.DORA · NIS2 · GDPRInsurersICT risk management, critical providers and customer data. In addition, AI that sets prices in life and health insurance is high-risk. Health data also needs a stronger legal basis under GDPR.DORA · GDPR · EU AI ActPublic-sector suppliersWhat public tenders require of you, by ENS category. NIS2 measures also arrive through the supply chain. Medium and high categories need a certification audit.ENS · NIS2 · GDPREnergy and essential servicesArticle 21 measures and incident reporting within 24 h. The management body must also approve and oversee those measures. Spain’s NIS2 transposition law is still pending.NIS2 · ISO 27001 / 22301 · GDPRConnected-product manufacturersSecurity by design, vulnerabilities and access to data. Since 11 September 2026, the CRA has required actively exploited vulnerabilities to be reported. Data Act design rules apply to products placed on the market from 12 September 2026.CRA · Data Act · ISO 27001 / 22301
Compliance by sector: can’t see yours?
Answer five questions and we will tell you which regulations apply. That way, even if your activity is not listed here, you get a first view of compliance for your sector. Then the platform maps each regulation to your services, with deadlines and alerts. In addition, one control can serve several regulations, so overlapping obligations are handled once.
