Regulation as Constraint: DORA, NIS 2, CER, the AI Act, the GDPR and the Data Act

European regulation reaches operations as clocks, records, tests and named people. It does not describe an operations loop and says little about how far a machine may act; it states outcomes an operations organisation must be able to show: services that continue, incidents recorded and reported within hours, recovery that has been tested, providers that can be left, and a management body that answers for all of it. This chapter maps the instruments to the five functions of the loop at the level of the article, and it concerns all five: O1 Observe, O2 Diagnose, O3 Change, O4 Restore and O5 Sustain. It covers DORA (Regulation (EU) 2022/2554), NIS 2 with two national forms, the CER Directive, the AI Act, the GDPR, the Data Act and, at the edge, the Cyber Solidarity Act, and closes with the rules on working time and co-determination that govern the people who run the loop. Every article number was read against the live text on EUR-Lex, or in the gazette of the member state concerned, on 10 November 2026. The statements are organisational and architectural implications and not legal advice.

The chapter builds on conclusions of the earlier volumes: AI literacy is evidenced in competence records, and Articles 14 and 26(2) of the AI Act still demand competent oversight (1, European Union, 2024) (AI Governance, Chapter 14, F25) (296, Nordqvist, 2026); reporting deadlines are design constraints on the logs (AI Platform and Security, Chapters 17 and 21, F46) (297, Nordqvist, 2026); duties fall on named people and management bodies (2, European Union, 2022); (3, European Union, 2022) and accountability cannot be delegated to a system (The Transformed Security Architect, Chapter 18, F78) (300, Nordqvist, 2026); monitoring and scoring of workers falls within co-determination and data-protection law (6, European Union, 2016), and agreements govern classes of change (AI Boss, Chapters 13 and 23, F86) (301, Nordqvist, 2026); one incident can open several clocks (2, European Union, 2022); (3, European Union, 2022); (6, European Union, 2016), and AI drafts while a person classifies and sends (AI Blue, Chapter 19, F106) (302, Nordqvist, 2026); and a register that maps each obligation to a control and to evidence with an age is re-verified every six months (AI Purple, Chapter 21, F135) (304, Nordqvist, 2026). Chapter 4 defines the autonomy budget and the observer principle used here, and Chapter 14 gives the reporting clocks in detail.

Scope per entity, seven instruments, five operations functions, and what the organisation keeps: control, evidence and clock

Figure 23.1: Seven instruments land on the five operations functions and leave the organisation with controls, evidence and clocks. The mapping table later in the chapter gives the articles per function.

How to read the mapping

A row of the mapping has five parts: the instrument and article, the duty in the words of the text, the function or functions that perform it, the control, and the evidence that the control works, with an age. A duty does not belong to one function (Chapter 4): a restore test serves DORA Article 12, NIS 2 Article 21(2)(c), GDPR Article 32(1)(c) and the CER resilience measures at once. The mapping therefore starts from the control and the evidence and lists the instruments each serves.

Three rules keep the mapping honest. Every row has a named owner, because the instruments address the management body and named roles, and a team is not accountable in the sense of DORA Article 5(2) or NIS 2 Article 20(1). Every row has an evidence artefact with an age limit, so that nothing is called compliant, any more than recoverable, without saying what was tested, when and with what result. And every row records the date the text was read: the Digital Omnibus on AI amended the AI Act in July 2026 (11, European Union, 2026), so the register is re-verified every six months and on every announced amendment.

One observation shapes everything that follows. Among the articles mapped here, only two speak directly to how far a machine may act: Article 14 of the AI Act, which requires that a person can disregard, override or interrupt a high-risk AI system, and Article 22 of the GDPR, on decisions based solely on automated processing about a person. The rest state outcomes and leave the means to the organisation, so no instrument sets a level of autonomy for a restart or a failover. The autonomy budget of Chapter 4 is the book's own design, and its purpose here is to make the outcomes demonstrable when an agent performs the action.

Who is in scope

Hansa Mutual: DORA first

DORA lists insurance and reinsurance undertakings among its financial entities (Article 2(1), point (n)) and excludes the smallest insurers, those referred to in Article 4 of Directive 2009/138/EC (Article 2(3), point (b)) (2, European Union, 2022). Hansa Mutual, with about 9,500 employees, is a financial entity for its EU entities, and the Regulation has applied since 17 January 2025 (Article 64).

DORA's relationship to NIS 2 is settled in both instruments. Recital 16 of DORA states that the Regulation is lex specialis with regard to Directive (EU) 2022/2555, and Article 4(1) of NIS 2 disapplies its relevant provisions where sector-specific Union acts are at least equivalent in effect (2, European Union, 2022) (3, European Union, 2022). Germany, where the group is headquartered, has applied this. Its law of 2 December 2025, published in the Bundesgesetzblatt on 5 December 2025 and in force the day after (Article 30), contains the new BSI-Gesetz, whose § 28(6) point 1 provides that §§ 30, 31, 32, 35, 36, 38 and 39, which carry the risk-management measures, the reporting duties and the duties of the management, do not apply to financial undertakings within Article 2(2) of DORA and to undertakings to which DORA applies by virtue of § 293(5) of the Versicherungsaufsichtsgesetz (31, Bundesrepublik Deutschland, 2025). For the German entities DORA is the regime, and no second set of NIS 2 duties runs beside it. The annexes of NIS 2 do not mention insurance, so NIS 2 would reach a group entity only through an activity of its own under a listed type, which the book does not assume.

The Swedish act follows the pattern: 1 kap. 11 § provides that, for an operator covered by DORA, the obligations in 2 kap. 3 to 10 §§ do not apply (29, Sveriges riksdag & Regeringskansliet, 2025). The United Kingdom and Swiss subsidiaries follow their own regimes, and the Norwegian one the EU instruments with an EEA lag.

Nordvik Region: NIS 2 through national law

DORA does not apply to the Region. NIS 2 reaches public administration through Article 2(2), point (f): central government as the member state defines it, and regional-level entities as the member state defines them that, following a risk-based assessment, provide services whose disruption could significantly affect critical societal or economic activities (3, European Union, 2022). The answer for a region therefore comes from national law. The profile places the Region in "a Nordic member state"; this chapter takes Sweden, because the Region's co-determination follows the pattern of the Swedish MBL (32, Sveriges riksdag & Regeringskansliet, 1976) (AI Boss, Chapters 13 and 23), and a different Nordic state would need its own check.

The Swedish act applies to "a region, a municipality or a federation of municipalities" without a further test (1 kap. 3 § point 2) and counts a region larger than a medium-sized enterprise among the essential operators (1 kap. 9 § first paragraph point 2 a) (29, Sveriges riksdag & Regeringskansliet, 2025). With about 6,000 employees, Nordvik Region is an essential operator in this setting. The question that Chapter 4 left open, whether the Region is in scope depending on national transposition, is answered here, and the Region's practice of planning as if its Tier 1 services were in scope becomes a legal position. The act took effect on 15 January 2026, and the county administrative board (länsstyrelse) designated for the area supervises regions under the Cybersäkerhetsförordning (2025:1507) (30, Sveriges riksdag & Regeringskansliet, 2025).

CER and the others

The CER Directive applies to entities that a member state identifies as critical, with identification due by 17 July 2026 (Article 6(1)) (17, European Union, 2022). The Region is not identified at the start of the book (profile, illustrative). The annex lists, among others, transport, banking, financial market infrastructure and health, and for public administration only central government; insurance is not listed. Hansa Mutual is outside it on the text and the Region on the facts of the profile, and the chapter still maps the articles because an organisation identified later, or dependent on one that is, inherits their clocks.

Regime Hansa Mutual Nordvik Region
DORA Applies to the EU entities as an insurance undertaking Does not apply
NIS 2 Displaced by DORA for financial entities (Article 4(1); BSIG § 28(6); Cybersäkerhetslag 1 kap. 11 §) Applies as an essential operator under the Swedish act (setting of this chapter)
CER Not listed in the annex Not identified at the start of the book; exposure through a neighbouring region's hospital
AI Act Provider and deployer of its own systems; deployer of vendors' Deployer of high-risk systems, among them SVC-NR-001
GDPR Controller; national rules on employee data differ by country Controller; public-sector legal bases
Data Act, Chapter VI Customer of two hyperscalers and a managed provider Customer of the hosting provider and, where the service qualifies, of SamDrift
Staff rights Works councils: BetrVG § 87 in Germany; Dutch and Swedish rights; Polish representatives Swedish MBL: negotiation before important change

DORA, article by article

Articles 5 to 16: ICT risk management

Chapter II of DORA is the part that operations performs every day. The table gives the titles of the live text, the duty, the functions and the control (2, European Union, 2022).

Article (title) What it asks, in summary Functions Control and evidence in this book
5 (Governance and organisation) The management body defines, approves, oversees and is responsible for the ICT risk management framework; bears ultimate responsibility; approves the continuity policy and response and recovery plans (5(2)(e)) and the budget (5(2)(g)); members keep up to date, with training (5(4)) All Delegation profiles DLG-* approved by a named authority; board report; training records
6 (ICT risk management framework) A documented framework reviewed at least yearly and after major incidents; a control function independent of the managers (6(4)); continuous improvement All Mapping record; second-line owner independent of operations
7 (ICT systems, protocols and tools) Tools that are reliable, with sufficient capacity, including where new technology is introduced, and resilient under stress O1, O5 Capacity records CAP-*; evaluation of operations AI before promotion
8 (Identification) Classify and document ICT-supported functions, assets and dependencies, at least yearly; risk assessment on each major change O1, O5 Service records SVC-*; dependency map; configuration database
9 (Protection and prevention) Change management that records, tests, assesses, approves, implements and verifies every change (9(4)(e)); patch policies; connections that can be instantaneously severed or segmented (9(4), second subparagraph) O3, O5 Change records CHG-*; the stop path of Chapter 4
10 (Detection) Mechanisms to promptly detect anomalies, including network performance issues, and to identify single points of failure; regularly tested under Article 25; alert thresholds O1, O2 Observer manifest OBS-*; alert tests; golden incident sets
11 (Response and recovery) Continuity policy and plans; independent internal audit of response and recovery plans (11(3)); yearly tests and tests after substantive change, with cyber-attack scenarios and switchovers (11(6)); records before and during disruption (11(8)) O4, O2 Resilience register of Chapter 19; incident timeline with agent traces
12 (Backup policies and procedures, restoration and recovery procedures and methods) Backup policies; periodic testing; restoration on systems physically and logically segregated from the source (12(3)); redundant capacity (12(4)) O4 Restore-test records RST-*; restore-overwrite held at Level 1
13 (Learning and evolving) Post-incident reviews after major incidents (13(2)); lessons into the risk assessment; yearly report by senior ICT staff to the management body (13(5)); training for all staff (13(6)) O5, O2 PIR-*, PRB-* and action closure (Chapter 12)
14 (Communication) Crisis communication plans; at least one person tasked with communication on ICT-related incidents O2 Communication plan; drafts by the assistant, send by the named person

Four of these rows are where an agent changes how the duty is met.

Article 9(4), point (e), asks for documented policies, procedures and controls for ICT change management so that all changes are "recorded, tested, assessed, approved, implemented and verified in a controlled manner", with the process approved by appropriate lines of management. It does not say who approves a change and does not forbid an agent from proposing or executing one; it requires the record and the verification, which are the change record and the independent observer of Chapters 8, 9 and 17. An AI-authored change that arrives without provenance fails the first verb, and a change that an agent both applies and verifies with its own metric fails the last.

Article 6(4) requires the control function for ICT risk to have an appropriate level of independence, on the three lines of defence model or an equivalent. Hansa Mutual's head of operational resilience, in the second line under the chief risk officer, is that function, and the independence is what makes the register of Chapter 19 more than the operations team's opinion of itself. Article 24(4) states the same principle for tests: independent parties, and no conflict of interest for an internal tester. The observer principle of Chapter 4 is the engineering form of two sentences that the law already contains.

Article 11(8) requires readily accessible records of activities before and during disruption events. For an organisation with an operations agent, the agent's trace of tool calls, approvals and policy decisions is part of that record and is kept where the agent cannot alter it. Article 12(3) requires restoration from backup on the entity's own systems to use systems physically and logically segregated from the source; with the irreversibility of overwriting production data, that is the reason for the ceiling of Level 1 on restore-overwrite. Article 9(4), second subparagraph, requires network connection infrastructure that can be "instantaneously severed or segmented" to prevent contagion between interconnected financial processes (2, European Union, 2022). The stop path outside the system it stops is the same property applied to the operator's own agents, and the book reads the article as support for it and not as a requirement of it.

Articles 17 to 23: incidents

Article 17 requires an ICT-related incident management process, records of all ICT-related incidents and significant cyber threats, procedures that ensure root causes are identified, documented and addressed (17(2)), early warning indicators, assigned roles and information to the management body at least on major incidents (17(3)). Article 18(1) sets the classification criteria: clients and counterparts affected, duration, geographical spread, data losses, criticality of the services affected and economic impact. These six criteria are the fields of the incident record INC-* of Chapter 14, and an assistant that fills them in proposes values that the incident commander confirms.

Article 19 requires financial entities to report major ICT-related incidents to the competent authority as an initial notification, an intermediate report and a final report (19(4)), and permits outsourcing of the reporting while the entity remains fully responsible (19(5)). The time limits are in Delegated Regulation (EU) 2025/301, Article 5: the initial notification within four hours of classification as major and no later than 24 hours from awareness (where classification as major comes only after those 24 hours, within four hours of the classification, Article 5(2)), the intermediate report within 72 hours of the initial notification, and the final report no later than one month after the intermediate report (12, European Commission, 2025). Member states may also require a copy to the CSIRT designated under NIS 2 (19(1)). The design consequence belongs to Chapter 14: the incident record carries the first signal and the awareness as separate timestamps, one clock per regime and a named person who may close each; the agent drafts, and the person classifies and sends.

Articles 24 to 27: testing

Article 24 requires a digital operational resilience testing programme for entities other than microenterprises, risk-based, with independent testers, with procedures to prioritise, classify and remedy the issues found and to validate that every weakness is fully addressed (24(5)), and with appropriate tests at least yearly on all systems and applications supporting critical or important functions (24(6)). Article 26 requires threat-led penetration testing (TLPT) at least every three years for the entities identified in accordance with Article 26(8), on live production systems supporting critical or important functions, with the participation of the providers whose services are in scope (26(2) and (3)), and Article 27 sets requirements for the testers. Delegated Regulation (EU) 2025/1190 specifies the criteria for identifying entities, the use of internal testers and the phases of the test (14, European Commission, 2025).

The yearly test is a legal clock and not only a default of the book. The 180-day clock for restore tests (Chapter 19) is stricter than the 12 months of Articles 11(6) and 24(6), and the register states which of the two ended a result. A game day that injects a fault is not a TLPT and does not count as one (Chapter 19; AI Purple, Chapter 21).

Articles 28 to 44: third parties

Article 28 makes the entity fully responsible for compliance whatever it contracts out (28(1)(a)), requires a strategy on ICT third-party risk (28(2)), a register of information on all contractual arrangements, distinguishing those that support critical or important functions, with a yearly report to the competent authority on the arrangements (28(3)), and, for such services, exit strategies that are documented and "sufficiently tested and reviewed periodically" (28(8)). Commission Implementing Regulation (EU) 2024/2956 sets the register templates (20, European Commission, 2024). Article 30 lists the contract's content: for every ICT service, among others, locations and advance notice of a change of location (30(2)(b)), assistance in an incident at no additional or an ex-ante cost (30(2)(f)) and termination rights (30(2)(h)); for services supporting critical or important functions, in addition, full service levels (30(3)(a)), notice and reporting duties for developments that might materially affect delivery (30(3)(b)), participation in the entity's TLPT (30(3)(d)), unrestricted access, inspection and audit rights (30(3)(e)) and an exit strategy with a mandatory transition period (30(3)(f)). Articles 31 to 44 set up the Union oversight of critical ICT third-party service providers designated by the European Supervisory Authorities; Chapter 3 reports the first designations.

Three consequences follow for operations. Every tool that holds telemetry or acts on the estate is a third-party arrangement for Hansa Mutual and sits on the register: Lumenscope, Alster Managed Services, Cloud A and Cloud B. On the book's reading, a provider's change of the model inside its tooling is a development that "might have a material impact" under Article 30(3)(b), and the annexes of Chapters 21 and 24 should say so. And the exit test is an operations exercise with a record, not a paragraph in a strategy. Chapter 24 takes these articles in full.

Article 45: information sharing

Article 45 permits, and does not oblige, financial entities to exchange cyber threat information within trusted communities under arrangements that protect confidentiality, personal data and competition rules (45(1)); participation is notified to the competent authority (45(3)). Security operations (AI Blue) owns the participation; operations contributes configuration and dependency information after minimising personal data and internal names.

NIS 2: Articles 20, 21, 23 and 24

Article 20 requires member states to ensure that the management bodies of essential and important entities approve the cybersecurity risk-management measures, oversee their implementation and can be held liable for infringements, without prejudice to national rules on the liability of public institutions and officials (20(1)), and that members of the management bodies follow training (20(2)) (3, European Union, 2022). Article 21 requires appropriate and proportionate technical, operational and organisational measures on an all-hazards approach, and lists the minimum. Six of its ten points land on the loop.

NIS 2 Article 21(2) point Measure Functions Operations artefact
(b) Incident handling O2, O4 Incident process and records; clock sheet
(c) Business continuity, such as backup management and disaster recovery, and crisis management O4 Restore-test records; resilience register
(d) Supply chain security, including relationships with direct suppliers and service providers O3, O5 Provider register; notice of change in contracts
(e) Security in acquisition, development and maintenance, including vulnerability handling O3, O5 Change records; patch and lifecycle records (Chapter 11)
(f) Policies and procedures to assess the effectiveness of the measures All Resilience register; observer manifests; yearly review
(i) Human resources security, access control and asset management O3, O5 Agent identities, mandates MND-*, delegation profiles

Point (f) matters most for the thesis: a restore-test record is the assessment of point (c), and a measure without one is half a measure. Implementing Regulation (EU) 2024/2690 sets technical requirements under Article 21(5) for, among others, DNS, cloud computing, data centre and managed service providers (4, European Commission, 2024); an operator whose providers fall in these categories, as SamDrift's DNS service and Alster's night operations do, can ask them for the evidence these requirements produce.

Article 23 requires notification of any incident with a significant impact on the provision of services, defined as one that has caused or is capable of causing severe operational disruption or financial loss, or considerable material or non-material damage to other persons (23(3)). The early warning is due within 24 hours of awareness, the incident notification within 72 hours, an intermediate report on request and the final report not later than one month after the notification (23(4)); notification does not of itself increase liability (23(1)). Article 24 permits member states to require certified ICT products, services and processes; no such requirement reaches operations tooling in the texts read, and the article belongs on the watch list.

National forms: Sweden and Germany

The Swedish act names the same measures. 2 kap. 3 § requires suitable and proportionate measures on an all-hazards basis, with at least ten points including incident handling and continuity and crisis management; 2 kap. 4 § requires the persons in the management to undergo security training; and 2 kap. 5 to 8 §§ set the early notification within 24 hours of awareness, the incident notification within 72 hours, a progress report on request and a final report within a month (29, Sveriges riksdag & Regeringskansliet, 2025). Reports go to the CSIRT unit, the Försvarets radioanstalt (ordinance 6 § and 31 §) (30, Sveriges riksdag & Regeringskansliet, 2025). The act does not restate NIS 2 Article 20(1) on liability, and the book does not claim that it does; the Region's approving body is the regional executive committee that asked the question of AIDR-0900. In Germany the BSI-Gesetz carries the equivalents in §§ 30, 32 and 38 (measures including business continuity, reports within 24 and 72 hours, management duties and training), and Hansa's German entities are outside them by § 28(6) (31, Bundesrepublik Deutschland, 2025).

The CER Directive

The CER Directive obliges member states to ensure that critical entities assess risk within nine months of notification and at least every four years (Article 12(1)), take technical, security and organisational measures (Article 13(1)), keep a resilience plan (Article 13(2)), and notify incidents that significantly disrupt essential services, initially within 24 hours of awareness and with a detailed report within a month (Article 15(1)) (17, European Union, 2022). The measures include those to "recover from incidents, duly considering business continuity measures and the identification of alternative supply chains" (Article 13(1)(d)). NIS 2 applies to identified critical entities regardless of size (NIS 2 Article 2(3)).

For operations, an identified organisation's resilience plan is a customer of the resilience register of Chapter 19, and the 24-hour initial notification is one more clock on the clock sheet. The Region's exposure, recorded in its profile, is not its own identification but the dependency of its health and social-care coordination on a neighbouring region's university hospital, and the neighbour's CER obligations are a reason to ask for its recovery objectives. That the Region could be identified later is speculation, and obligations would open ten months after notification (Article 6(3)).

The AI Act: Articles 4, 12, 14, 26, 72 and 73

The AI Act reaches operations twice: as a regime for the AI systems the organisation operates (Chapters 13 and 14), and as a possible regime for the operator's own agents. The articles are read from Regulation (EU) 2024/1689 as amended by the Digital Omnibus on AI (1, European Union, 2024) (11, European Union, 2026).

Article What it asks Functions Artefact and evidence
4 (AI literacy), as replaced by the Omnibus Providers and deployers take measures to support the development of AI literacy of staff and others who operate and use AI on their behalf; no guarantee of a level for any individual O5 Competence records CMP-* (Chapter 26)
12 (Record-keeping) High-risk systems technically allow automatic recording of events over their lifetime, so as to identify risk situations, facilitate post-market monitoring and allow monitoring under Article 26(5) O1 The deployer's check that the events it needs are produced
14 (Human oversight) Effective oversight by natural persons; they can understand capacities and limits, remain aware of automation bias, interpret output, decide not to use or to override it, and intervene or interrupt through a stop button (14(4)) O2, O4 Oversight roles in the delegation profile; the stop path
26 (Deployer obligations) Use as instructed; assign oversight to persons with competence, training, authority and support (26(2)); monitor and inform the provider (26(5)); keep logs for at least six months (26(6)); inform workers' representatives and affected workers before use at the workplace (26(7)); register, for public authorities (26(8)) O1, O3, O5 Release manifest; oversight roles; log retention; information to representatives
72 (Post-market monitoring) The provider's system collects data on performance, which may be provided by deployers O1, O5 The interface through which operations data flows to the provider
73 (Serious incidents) The provider reports serious incidents; 15 days from awareness at the latest, 2 days for a widespread infringement or a serious incident under Article 3(49)(b), 10 days after a death (73(2) to (4)) O2 Clock sheet; provider route in the contract

The dates changed. The Omnibus provides that Chapter III, Sections 1 to 3, which contain Articles 12, 14 and 26, applies from 2 December 2027 to systems high-risk under Article 6(2) and Annex III, and from 2 August 2028 to those under Article 6(1) and Annex I. It replaces Article 111(2): high-risk systems placed on the market before the date are caught only if their design is significantly changed, while providers and deployers of high-risk systems intended for use by public authorities are to take the necessary steps to comply by 2 August 2030 (11, European Union, 2026). For the Region, whose benefits-triage service SVC-NR-001 is such a system, counsel must say whether it counts as placed on the market before the date, and operations must say whether a given change is a significant change in design; Chapter 13 put the second question into the change record. The dates are expected, following from a decided instrument.

Article 4 changed in wording and in weight. The Omnibus replaces the duty to ensure a sufficient level of literacy "to their best extent" with a duty to take measures to support its development, without a guarantee of any specific level for any individual (11, European Union, 2026). Persons with "the necessary competence, training and authority" are still required for oversight where Article 26(2) applies, so the evidence of competence moves from Article 4 to Article 26(2) and, for the management body, to DORA Article 5(4) and NIS 2 Article 20(2).

The operator's own agents

An operations agent is not a high-risk AI system by being an operations agent, and Annex III has two entries to test it against, with the answer recorded. Point 2 covers AI systems intended as safety components in the management and operation of critical digital infrastructure, road traffic, or the supply of water, gas, heating or electricity; the Omnibus clarifies that a safety component fulfils a safety function where its intended purpose is to prevent or mitigate risks to the health and safety of persons or property (11, European Union, 2026). An agent whose intended purpose is to restore the availability of a claims system does not, on that wording alone, have that purpose, and the classification turns on the intended purpose that the provider, often the organisation itself, determines. Point 4(b) covers AI systems intended to make decisions affecting the terms of work-related relationships or their promotion or termination, to allocate tasks based on individual behaviour or personal traits, or to monitor and evaluate the performance and behaviour of persons in such relationships (1, European Union, 2024). The book's own conclusion, not a legal finding, is that each delegation profile states the agent's intended purpose and the classification result, and that the design keeps the loop away from point 4(b): on-call allocation and per-person measures stay at Level 0 Advisory or Level 1 Assisted, and Level 4 is never used for an action that decides about a named person's access to work.

The GDPR and the Data Act

The GDPR

Article 32(1) requires measures appropriate to the risk, including the ability to ensure the ongoing availability and resilience of processing systems and services (point (b)), the ability to restore availability of and access to personal data in a timely manner after a physical or technical incident (point (c)), and a process for regularly testing and evaluating the effectiveness of the measures (point (d)) (6, European Union, 2016). Point (c) is a restore objective in the law of personal data, and a restore-test record is its evidence for every service that holds personal data. Article 33 requires notification of a breach to the supervisory authority without undue delay and, where feasible, within 72 hours of awareness, unless a risk is unlikely (33(1)); a processor notifies the controller without undue delay (33(2)), so the processor clause belongs in every operations contract; and the controller documents every breach (33(5)). Article 34 requires communication to data subjects when the risk is high.

Article 22 gives the data subject the right not to be subject to a decision based solely on automated processing that produces legal effects or similarly significantly affects the person (22(1)), with safeguards that include human intervention and the right to contest (22(2) and (3)). After customers, the data subjects who matter most to operations are staff, and decisions that could fall under Article 22 are those about a person's work: an automatic on-call allocation with consequences, a flag that leads to a disciplinary step, a withdrawal of access. The Level 4 prohibition is the book's way of staying outside the question. Article 88 lets member states provide by law or collective agreement for specific rules on employees' data, including monitoring systems at the workplace (88(2)), which is where the works agreements of both organisations sit.

The Data Act, Chapter VI

Chapter VI of the Data Act, on switching between data processing services, applies from 12 September 2025 and gives the customer of a cloud-type service rights that serve the exit strategies of DORA Article 28(8) (16, European Union, 2023). Providers must not impose obstacles to termination, to contracting another provider, to porting exportable data and digital assets or to functional equivalence (Article 23). The contract must allow switching within a maximum transitional period of 30 calendar days after a notice period of at most two months, support the customer's exit strategy, specify the exportable data and give a retrieval period of at least 30 calendar days (Article 25(2)(a), (b), (d), (e) and (g)). Switching charges are reduced until 12 January 2027 and not permitted from that date (Article 29(1) and (2)).

Two points matter to operations. The 30-day transition and retrieval periods are contract terms that an exit test can measure, and an exit never run is an asserted claim in the sense of Chapters 4 and 19. The end of switching charges on 12 January 2027 is expected, a decided date. Whether a service is a data processing service is a question for the Act's definitions, which the book does not apply to any named provider; Chapter 24 returns to exit.

The Cyber Solidarity Act at the edge

Regulation (EU) 2025/38 sits at the edge of the loop because its instruments act through authorities and not through the operator (222, European Union, 2025). National Cyber Hubs, designated by participating member states, collect and analyse information on threats and incidents and may cooperate with essential and important entities (Article 4). The Cybersecurity Emergency Mechanism supports voluntary coordinated preparedness testing in sectors of high criticality (Article 12). The EU Cybersecurity Reserve consists of response services from trusted managed security service providers, but its users are member states' crisis management authorities and CSIRTs, CERT-EU and authorities of associated third countries (Article 14(1) to (3)), and an entity does not request it directly. A recovery plan therefore does not count on the Reserve, the national CSIRT is the route to it, and the records of Chapter 12 are kept in a state that can be shared. That hubs will become a source of operational threat information is expected, because the Regulation provides for them; the book has not verified which member states have designated one.

Staff rights: on-call and monitoring

Three bodies of law protect the people who run the loop, and operations designs must meet them before the first rota is published or the first tool is switched on. Chapter 25 treats the evidence on on-call and wellbeing.

Working time. The Working Time Directive defines working time as any period during which the worker is working, at the employer's disposal and carrying out the activity or duties, in accordance with national laws and practice, and a rest period as any period that is not working time (Article 2(1) and (2)); it gives 11 consecutive hours of daily rest (Article 3), a weekly rest (Article 5) and an average weekly working time of at most 48 hours (Article 6) (18, European Union, 2003). In Matzak the Court of Justice held that stand-by time spent at home with the duty to respond to calls within 8 minutes, very significantly restricting other activities, must be regarded as working time; it distinguished stand-by that requires only that the worker be contactable, where only time linked to the actual provision of services counts, and left the application to the referring court (19, CJEU, 2018). The response target, the place of response and the restrictions on other activities are therefore parameters that decide how the time is classified, and a rota's page target is a legal parameter as well as a service parameter. Rest after a night call-out is the subject of KBV-IT-2024-OPS-01 at Hansa Mutual.

Information and consultation. Before a high-risk AI system is put into use at the workplace, an employer deployer informs workers' representatives and the affected workers (AI Act Article 26(7)) (1, European Union, 2024).

Co-determination. In Germany, § 87(1) of the Betriebsverfassungsgesetz gives the works council a right of co-determination, where no statutory or collective rule exists, over, among other matters, the start and end of daily working time and its distribution over the weekdays (no. 2), temporary shortening or extension of the usual working time (no. 3), technical devices designed to monitor the behaviour or performance of employees (no. 6) and health protection (no. 7); failing agreement, a conciliation board decides (§ 87(2)) (26, Germany, n.d.). Whether a standby duty falls under no. 2 or no. 3 is a point of German case law that this book has not verified, and the profile's reference to no. 2 is kept as the working assumption. The Federal Labour Court reads "designed to" in no. 6 objectively: a device is designed to monitor when it is objectively suited to collect or record information about the behaviour or performance of employees, and the employer's intention to monitor does not matter (decision of 16 July 2024, 1 ABR 16/23, paragraph 25) (311, Bundesarbeitsgericht, 2024). No. 6 therefore matters for AI operations tools, because a tool that logs engineers' commands and queries is objectively suited to record their behaviour (AI Boss, Chapter 13, F86), and KBV-IT-2024-OPS-03 makes agreement a condition of use. In Sweden the employer must negotiate on its own initiative with the union bound by a collective agreement before deciding on an important change in its activity or in employment conditions (MBL 11 §), save that for compelling reasons it may decide and execute first, and must negotiate on request on other matters concerning a member (12 §) (32, Sveriges riksdag & Regeringskansliet, 1976). MBL-NR-IT-2027-01 records how the Region applies this to operations tooling.

Operations measure Rule that is triggered Hansa Mutual Nordvik Region
On-call rota and standby Working Time Directive Articles 3, 5, 6; co-determination KBV-IT-2024-OPS-01; BetrVG § 87(1) no. 2 (working assumption) Rotas negotiated and changed with notice under MBL-NR-IT-2027-01; MBL 11 §
Tool that logs engineers' queries or commands Co-determination on monitoring; GDPR Article 88 KBV-IT-2024-OPS-03; BetrVG § 87(1) no. 6 Negotiation before the tool is switched on (MBL-NR-IT-2027-01)
Metrics about engineers Co-determination; GDPR Articles 5 and 88 Metrics per team and service, group of five at least (KBV-IT-2024-OPS-02) Never reported by name (MBL-NR-IT-2027-01)
An agent that allocates on-call or scores people AI Act Annex III point 4(b) and Article 26(7); GDPR Article 22 Kept at Level 0 or 1; agreement first Kept at Level 0 or 1; negotiation first

An agreement governs a class of change, such as "an operations agent whose actions are logged under the delegation profile", and not a product version, so a model update does not reopen it and a new class of tool does (AI Boss, Chapter 23, F86) (301, Nordqvist, 2026).

Worked example: a regulation-to-control mapping

The mapping record is the artefact of this chapter: a file in version control beside the delegation profiles, owned by the second line at Hansa Mutual, with one row per control and the instruments it serves. The example is illustrative and fictional. It follows the question of AIDR-0950 and records, for one service, what the group would show a supervisor. The evidence ages are the register's, not the law's.

mapping_record: RCM-HM-OPS-2028-01
date: 2028-11-28
decision_record: AIDR-0973
owner: {role: head_of_operational_resilience, line: second, independent_of: operations}
operations_owner: Tobias Richter
text_read_on: 2028-11-28            # re-verify every 6 months and on amendment
next_review: 2029-05-28
service: {id: SVC-HM-001, tier: 1, cif: true}
rows:
  - control: "Restore from immutable backup into a segregated target"
    serves: ["DORA 11(6)(a)", "DORA 12(2)", "DORA 12(3)", "DORA 24(6)", "GDPR 32(1)(c)"]
    functions: [O4]
    evidence: {record: RST-HM-2027-004, result: failed, date: 2027-06-15, status: claim_withdrawn}
    age_limit_days: 180            # book default; the legal floor is 12 months
    next_action: "re-test; independent attester; probe OBS-HM-0001"
  - control: "Change record with provenance, tests, approval and independent verification"
    serves: ["DORA 9(4)(e)", "DORA 8(3)", "NIS 2 21(2)(e)"]
    functions: [O3]
    evidence: {record: "CHG-HM-6000 series, sampled 25 per quarter", result: open}
    age_limit_days: 90
  - control: "Delegation profile with ceilings, budget and stop path"
    serves: ["DORA 5(2)", "DORA 9(4)", "AI Act 14(4)(e) by analogy"]
    functions: [O3, O4]
    evidence: {record: DLG-HM-OPS-001, result: proposed, date: 2028-10-24}
    age_limit_days: 90
  - control: "Incident record with six classification fields and one clock per regime"
    serves: ["DORA 17(3)(b)", "DORA 18(1)", "DORA 19(4)", "GDPR 33(1)", "AI Act 73(2)"]
    functions: [O2]
    evidence: {record: PIR-HM-2027-0961, result: reviewed, date: 2027-11-16}
    age_limit_days: 365
  - control: "Register of information with operations tools and exit tests"
    serves: ["DORA 28(3)", "DORA 28(8)", "DORA 30(3)(b)", "Data Act 25(2)"]
    functions: [O1, O4, O5]
    evidence: {record: "register 2028-Q3; Lumenscope exit test not run", result: not_tested}
    age_limit_days: 365
  - control: "Agreement before any tool logs engineers' commands"
    serves: ["BetrVG 87(1) no. 6", "GDPR 88", "AI Act 26(7)"]
    functions: [O5]
    evidence: {record: KBV-IT-2024-OPS-03, result: in_force, date: 2028-01-01}
    age_limit_days: 365

The record shows the discipline in three ways. A failed test appears as a failed row, and the legal text it serves does not turn it into a pass. A row with no test says untested, which counts in the denominator, and names the next action. And one control serves several instruments, so the restore test is written once and cited by DORA, the GDPR and, for the Region, NIS 2.

The table gives the same mapping by function for both organisations, at the level of the main articles.

Function DORA (Hansa Mutual) NIS 2 (Nordvik Region, Swedish act) AI Act, GDPR and others (both)
O1 Observe Articles 8, 10 21(2)(f); 2 kap. 3 § AI Act 12, 26(5), 72; GDPR 32(1)(b)
O2 Diagnose Articles 11, 13(2), 17 to 19 23(4); 2 kap. 5 to 8 §§ AI Act 14, 73; GDPR 33 and 34; CER 15 where identified
O3 Change Articles 9(4)(e), 6(4) 21(2)(d) and (e); 2 kap. 3 § AI Act 26(1) and (2); Annex III point 4(b); works agreements
O4 Restore Articles 11(6), 12, 28(8) 21(2)(c); 2 kap. 3 § GDPR 32(1)(c); Data Act 23 to 26; CER 13(1)(d) where identified
O5 Sustain Articles 5(4), 7, 13, 30 20(2); 2 kap. 4 § AI Act 4 and 26(2); Working Time Directive; BetrVG § 87; MBL 11 §

Practical guide: turning an article into a control with an owner and evidence

Purpose. To convert a duty in an instrument into a control, an owner and an evidence artefact that a supervisor or an auditor can inspect, and to keep it current.

Roles. The head of operational resilience or, at the Region, the head of the IT management office, who owns the mapping; the service owner; the CISO; the privacy officer; counsel; the employee representative where a measure touches staff.

Steps.

  1. Read the live text and record the date: EUR-Lex for Union law, the official gazette or the government's legal database for national law, with the article number as the instrument writes it. A secondary summary is not a source for a row.
  2. Write the duty in one sentence in the words of the text, including its verbs, and say whom it addresses: the management body, the entity, the provider or the processor.
  3. Choose the functions, by their exact names, and the services concerned.
  4. Choose the control from the artefacts that exist (a change record, a delegation profile, a restore test, an observer manifest, a contract clause); write a new one only when none does, with a record identifier.
  5. Name the evidence, who produces it and an age limit. Defaults: 90 days for a control exercised continuously, 180 days for a restore test, 365 days for a legal yearly clock, shorter where the law or the supervisor says so; adapt them to the management body's risk appetite.
  6. Name the owner as a role and a person, and a verifier independent of the owner and the runner (DORA Articles 6(4) and 24(4); the observer principle).
  7. If the article sets a clock, add it to the service's clock sheet (Chapter 14) with start, limit and the person who may close it.
  8. If the control touches staff, send it to the employee representatives before it is switched on and record the agreement that covers its class.
  9. Set the review: every six months and on any amendment, delegated act or guidance on the watch list, which now holds the AI Act timetable, the Commission's guidance on Article 73 and on the post-market monitoring plan, the delegated and implementing acts under DORA, and the Swedish and German implementing rules.

Definition of done. Every row has a text date within six months, a named owner and verifier, an evidence record with an age and a status (verified, expired, implemented but unverified, failed, asserted or untested), and rows that serve a clock appear on the clock sheet. The management body, or the authority it has named, approves the record, and the approval is recorded.

Outlook, labelled

Observable. DORA has applied since 17 January 2025; NIS 2 is transposed in the two states used here, the Swedish act in force since 15 January 2026 and the German law since 6 December 2025; the Data Act has applied since 12 September 2025; and the Digital Omnibus on AI was published on 24 July 2026 (11, European Union, 2026). Expected. Chapter III, Sections 1 to 3 of the AI Act apply to Annex III systems from 2 December 2027, with public-authority systems placed on the market earlier to comply by 2 August 2030; switching charges end on 12 January 2027 (16, European Union, 2023); the Commission is to publish guidance on the post-market monitoring plan by 2 September 2027 (11, European Union, 2026); final guidance on Article 73 reporting follows a consultation that closed on 7 November 2025 (Chapter 14). Speculation. That a supervisor will ask for delegation profiles, autonomy budgets and observer manifests as such is plausible and unsupported by present evidence. The author's own projections are kept to Chapters 27 and 31.

Across the degrees of delegation

The instruments set no levels, and they do bear on what an agent may do to each class of action. The table lists, per action class of Chapter 4, the instruments that constrain it and what they add to the default ceiling.

Action class Instruments that bear on it What they add to the ceiling
read GDPR Articles 5, 32 and 88; works agreements Redaction of personal data in logs; no per-person views without agreement
annotate DORA Article 11(8); AI Act Article 26(6) Annotations are records, kept where the agent cannot alter them
notify DORA Article 19(5); NIS 2 Article 23; GDPR Articles 33 and 34 External notices are drafted by an agent and sent by a named person who is accountable for the clock
scale, restart DORA Articles 7 and 9; NIS 2 Article 21(2)(c) Evidence of verification by an independent probe; no new legal constraint
reconfigure, deploy DORA Article 9(4)(e); NIS 2 Article 21(2)(e); AI Act Article 26(1) Record, test, assessment, approval and verification; AI-system changes checked for significant change
roll back, fail over DORA Articles 11 and 12; CER Article 13(1)(d) A tested way back; switchovers in the yearly test; an incident commander decides
delete, restore-overwrite DORA Article 12(3); GDPR Article 32(1)(c) Restoration on segregated systems; Level 1 and a named person
any action that decides about a named person's access to work GDPR Article 22; AI Act Annex III point 4(b); co-determination Level 4 never; agreement first

Nordvik Region and Hansa Mutual

Nordvik Region records, in AIDR-0923 dated 2028-11-21, that it applies the Swedish Cybersäkerhetslag to all its Tier 1 services as an essential operator, that the head of the IT management office owns the mapping record, that Henrik Dahl is accountable to the regional executive committee that asked the question of AIDR-0900, and that the data protection officer and the chair of the union's joint committee review the staff rows before approval. The baseline incident INC-NR-2027-0298 (2027-11-08), in which a SamDrift DNS fault made SVC-NR-002 and SVC-NR-004 unreachable from outside for 70 minutes, would have opened the clock sheet, with a recorded decision whether it met the act's definition of a significant incident (2 kap. 5 §). The continuity rows lack evidence: the portal failover RST-NR-2027-002 failed (5 hours 20 minutes against 2 hours) and no re-test had been run at the start of the book, so the row for NIS 2 Article 21(2)(c) reads failed and the claim stays withdrawn until a re-test passes. The Region has no DORA register and no Mode 5 agent; its leverage is the SamDrift contract and the runbooks it owns. It must watch the AI Act timetable for SVC-NR-001, a possible CER identification, and MBL 11 § before any tool that logs engineers' commands is used.

Hansa Mutual records, in AIDR-0973 dated 2028-11-28, that the mapping record RCM-HM-OPS-2028-01 is owned by the head of operational resilience, independent of operations, that Tobias Richter owns the controls, and that extending the IT-operations agent beyond restart, certificate renewal and horizontal scaling waits for rows with verified evidence, which answers AIDR-0950 in the terms a supervisor would use. DORA is the regime. The register of information lists Lumenscope, Alster Managed Services, Cloud A and Cloud B, and the Lumenscope ingestion failure of 2027 (INC-HM-2027-0572, 3 hours 10 minutes with 14 services unobserved) makes Article 30(3)(b) and the exit test concrete. The claims-core restore test RST-HM-2027-004 failed on time and its row reads failed, with the legal yearly clock of Articles 11(6)(a) and 24(6) beside the group's 180-day clock. The staff rows take a German, a Dutch, a Swedish and a Polish form, and the Swedish subsidiary's exemption (1 kap. 11 §) does not remove its duty to negotiate with its unions. Nordvik Region owes the duties of an essential operator and has little evidence yet; Hansa Mutual owes more duties, to a financial supervisor, with more evidence and more seams.

Summary

European regulation constrains operations through outcomes: continuity, tested recovery, recorded and reported incidents, managed providers, competent oversight and agreed measures for staff. This chapter mapped the instruments to the five operations functions at the level of the article. DORA binds Hansa Mutual and displaces NIS 2 for its German and Swedish financial entities (BSIG § 28(6); Cybersäkerhetslag 1 kap. 11 §). NIS 2 binds Nordvik Region in the Swedish setting as an essential operator (1 kap. 9 §). The CER Directive, the AI Act with its amended timetable, the GDPR, the Data Act and the Cyber Solidarity Act add duties in their own terms, and the rules on working time and co-determination decide how the rota and the tools that watch the people who run it may be introduced.

Two conclusions are the book's own. The instruments do not set levels of autonomy for operations actions, with the exceptions of Article 14 of the AI Act and Article 22 of the GDPR, so the autonomy budget of Chapter 4 is a design that makes the outcomes demonstrable when an agent acts, and not a legal requirement. And one control serves many instruments, so a mapping that starts from the control and the evidence, with an owner and an age, answers a supervisor better than a list of articles.

The functions concerned are all five: O1 Observe through DORA Articles 8 and 10 and AI Act Article 12; O2 Diagnose through the clocks of NIS 2 Article 23, DORA Articles 17 to 19, AI Act Article 73 and GDPR Article 33; O3 Change through DORA Article 9(4)(e); O4 Restore through DORA Articles 11 and 12, NIS 2 Article 21(2)(c) and GDPR Article 32(1)(c); and O5 Sustain through training, third-party management and the rules on staff. The next chapter, Chapter 24, takes the third-party articles across boundaries: contracts, outages, registers of information and exit.

Sources

  1. European Parliament and Council of the European Union. Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). Official Journal of the European Union, 12 July 2024. (1, European Union, 2024)
  2. European Parliament and Council of the European Union. Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA). Official Journal of the European Union, 27 December 2022. (2, European Union, 2022)
  3. European Parliament and Council of the European Union. Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS 2 Directive). Official Journal of the European Union, 27 December 2022. (3, European Union, 2022)
  4. European Commission. Commission Implementing Regulation (EU) 2024/2690 laying down rules for the application of Directive (EU) 2022/2555 as regards technical and methodological requirements of cybersecurity risk-management measures. Official Journal of the European Union, 18 October 2024. (4, European Commission, 2024)
  5. European Parliament and Council of the European Union. Regulation (EU) 2016/679 (General Data Protection Regulation). Official Journal of the European Union, 4 May 2016. (6, European Union, 2016)
  6. European Parliament and Council of the European Union. Regulation (EU) 2025/38 (Cyber Solidarity Act). Official Journal of the European Union, January 2025. (222, European Union, 2025)
  7. Nordqvist, G. (2026). AI Governance: Governing Artificial Intelligence in European Enterprises and Public Authorities. The Transformed Architecture, Book 2. (296, Nordqvist, 2026)
  8. Nordqvist, G. (2026). AI Platform and Security: Building and Securing AI Platforms in European Enterprises and Public Authorities. The Transformed Architecture, Book 3. (297, Nordqvist, 2026)
  9. Nordqvist, G. (2026). The Transformed Security Architect: Role, Craft and Career in the Age of AI in European Enterprises and Public Authorities. The Transformed Architecture, Book 6. (300, Nordqvist, 2026)
  10. Nordqvist, G. (2026). AI Boss: When Artificial Intelligence Manages People in European Enterprises and Public Authorities. The Transformed Architecture, Book 7. (301, Nordqvist, 2026)
  11. Nordqvist, G. (2026). AI Blue: How Artificial Intelligence Transforms the Blue Team in European Enterprises and Public Authorities. The Transformed Architecture, Book 8. (302, Nordqvist, 2026)
  12. Nordqvist, G. (2026). AI Purple: How Red and Blue Learn Together When AI Joins the Loop in European Enterprises and Public Authorities. The Transformed Architecture, Book 9. (304, Nordqvist, 2026)
  13. European Parliament and Council of the European Union. Directive (EU) 2022/2557 on the resilience of critical entities (CER Directive). Official Journal of the European Union, 27 December 2022. (17, European Union, 2022)
  14. European Parliament and Council of the European Union. Directive 2003/88/EC concerning certain aspects of the organisation of working time. Official Journal of the European Union L 299, 18 November 2003. (18, European Union, 2003)
  15. Court of Justice of the European Union (2018). Judgment of 21 February 2018, Ville de Nivelles v Rudy Matzak, Case C-518/15. (19, CJEU, 2018)
  16. Sveriges riksdag, Regeringskansliet. Cybersäkerhetslag (2025:1506). Svensk författningssamling, 11 December 2025. (29, Sveriges riksdag & Regeringskansliet, 2025)
  17. Sveriges riksdag, Regeringskansliet. Cybersäkerhetsförordning (2025:1507). Svensk författningssamling, 11 December 2025. (30, Sveriges riksdag & Regeringskansliet, 2025)
  18. Bundesrepublik Deutschland (2025). Gesetz zur Umsetzung der NIS-2-Richtlinie, vom 2. Dezember 2025. Bundesgesetzblatt Teil I 2025 Nr. 301. (31, Bundesrepublik Deutschland, 2025)
  19. Bundesrepublik Deutschland. Betriebsverfassungsgesetz (BetrVG), § 87 Mitbestimmungsrechte. Gesetze im Internet. (26, Germany, n.d.)
  20. Sveriges riksdag, Regeringskansliet. Lag (1976:580) om medbestämmande i arbetslivet, 10 to 12 §§. Svensk författningssamling. (32, Sveriges riksdag & Regeringskansliet, 1976)
  21. European Parliament and Council of the European Union. Regulation (EU) 2023/2854 (Data Act), Chapter VI. Official Journal of the European Union, 22 December 2023. (16, European Union, 2023)
  22. European Parliament and Council of the European Union. Regulation (EU) 2026/1744 (Digital Omnibus on AI). Official Journal of the European Union, 24 July 2026. (11, European Union, 2026)
  23. European Commission. Commission Implementing Regulation (EU) 2024/2956 (standard templates for the register of information). Official Journal of the European Union, 2 December 2024. (20, European Commission, 2024)
  24. European Commission. Commission Delegated Regulation (EU) 2025/1190 (threat-led penetration testing). Official Journal of the European Union, 18 June 2025. (14, European Commission, 2025)
  25. European Commission. Commission Delegated Regulation (EU) 2025/301 (content and time limits for reporting major ICT-related incidents). Official Journal of the European Union, 20 February 2025. (12, European Commission, 2025)
  26. Bundesarbeitsgericht. Beschluss vom 16. Juli 2024, 1 ABR 16/23 (Headset-System). (311, Bundesarbeitsgericht, 2024)