Eleven questions about your organisation, data, technology and clients. The map shows what definitely applies, what probably applies and what is only recommended, across 13 data protection, cybersecurity and information security frameworks: GDPR and cookies, NIS2, DORA, Cyber Resilience Act, AI Act, Data Act, ISO 27001, ISO 27701, ISO 42001, ISO 22301, TISAX and PCI DSS, with the reason, the authority, the deadlines and the first three steps. It is generated in your browser and leaves with you as a document.
Enable JavaScript to use the diagnostic. Or write to us and we will build the map together.
For each of the 13 frameworks, in two groups (legislation; standards and contractual requirements), a status (applies, probably, recommended, soon or does not apply now), the reason derived from your answers, the authority and the deadline. For the applicable frameworks, the concrete obligations: the record and the DPO under the GDPR, cookie consent under Law no. 506/2004, registration with DNSC and the Article 21 measures under NIS2, the ICT risk framework under DORA, vulnerability reporting under the Cyber Resilience Act, literacy, transparency and high-risk systems under the AI Act, data access and switching between providers under the Data Act, then what ISO 27001, ISO 27701, ISO 42001, ISO 22301, TISAX and PCI DSS add. At the end, the first three steps, chosen by what is missing and what concerns you, plus the list of what you already have.
The deadlines were checked on 23 October 2026. When they change, we update the diagnostic; the date of the check appears in the note at the end of the document.
The map does not replace a compliance analysis, but it tells you where to look and in what order. Start with the first three steps, use the tools linked from the result (the DPO questionnaire, the DPIA questionnaire, the privacy notice checker, the AI policy generator, the continuity plan generator) and keep the document as the starting point for the discussion with a consultant or with management.
On two criteria from Government Emergency Ordinance no. 155/2024: the field of activity (Annexes 1 and 2) and the size (at least 50 employees or over €10 million turnover). Large entities in Annex 1 are essential, the others are important; some digital services and central public administration are covered regardless of size. The final classification is made by DNSC on the basis of the notification, and the 30-day deadline set by Order no. 1/2025 expired in September 2025, so whoever has not registered does so now.
Yes, in its minimal form: the AI literacy obligation (Article 4) has applied since 2 February 2025 to any organisation using AI systems, and transparency for chatbots and generated content (Article 50) from 2 August 2026. The heavy obligations, for the high-risk systems in Annex III (recruitment, credit, education, access to services), were postponed by Regulation (EU) 2026/1744 to 2 December 2027, and those for systems embedded in regulated products to 2 August 2028.
Because it is the simplest proof that the organisation keeps its security under control: it covers most of the measures required by NIS2 and DORA, it is increasingly requested by clients and in tenders, and it answers security questionnaires in one go. The diagnostic marks it as recommended only when the answers show one of these situations.
No. It is guidance generated automatically from the answers, under the legal deadlines in force in October 2026, which you can print, copy or download as Word. The exact classification depends on details that eleven questions cannot verify; the map tells you where to look and in what order, and a consultant turns it into a work plan.
We verify the classification under each framework, run the gap analysis and set the order and budget of the implementation.