European Digital Regulation: Toward Integrated, Proportionate, and Cross-Border Compliance

The European Union relies primarily on two types of legal instruments.

Regulations, such as the GDPR, DORA, or the AI Act, are directly applicable in Member States. They establish a common framework that applies without the need for national transposition legislation. Their implementation may, however, require national measures, particularly to determine competent authorities, organize inspections, or specify the enforcement regime.

Directives, such as NIS2 and the CER Directive, must be transposed into the law of each Member State. They set a common objective but allow for Member States to determine which sectors and entities are significant or critical, depending on the structure of the country’s economy.

This distinction is crucial for organizations. A regulation establishes a legal framework that is directly applicable across Europe, whereas a directive requires careful attention to national transposition laws and the guidance provided by the competent authorities.

The NIS2 Directive particularly well illustrates the implementation challenges faced by international groups. It broadens the scope of affected organizations and specifically distinguishes between essential entities and significant entities.

This classification is not determined solely by an organization’s industry sector or perceived criticality. It depends on several factors: the nature of the services provided, the relevant sector or subsector, the size of the entity, applicable national criteria, and, in some cases, designation by the competent authority.

Within multinational corporations operating in multiple countries, one subsidiary may thus be subject to a different regulatory regime in one country, than another subsidiary engaged in a similar activity in another country. Similarly, a holding company or parent company does not automatically fall under the same status as its operating entities. The analysis must therefore be conducted at the level of each legal entity, taking into account its actual activities, services, and geographic location.

This situation is not unique to European directives. Multinationals, particularly those in the banking sector, are subject to extraterritorial regulations such as FATCA, the Cloud Act, and DFS 500 (U.S. legislation).

This situation requires reconciling two requirements: establishing a consistent group-wide framework while retaining the ability to account for specific local regulatory requirements.

Our belief:

In this increasingly extensive and complex regulatory environment, one proposed approach would be to distinguish between directives and regulations that could be described as sector-specific and other regulations that could be described as project-specific.

The distinction between sector-specific regulations and project-specific regulations provides a useful initial framework for analysis, but it is not sufficient to fully capture the reality of European obligations.

Some regulations primarily target specific entities or sectors. This is particularly the case with NIS2, the CER Directive, and DORA. These regulations focus on business continuity, resilience, risk management, information system security, and the oversight of certain organizations.

Other regulations have a more cross-cutting scope. The GDPR applies to the processing of personal data, whether carried out as part of a project, a business process, a customer relationship, a human resources activity, or a relationship with a supplier. Similarly, the AI Act may apply to products, internally developed artificial intelligence systems, solutions purchased from suppliers, and deployment projects.

A relevant approach therefore involves analyzing the obligations along several complementary lines:

• the legal entities and industry sectors involved;
• the activities, products, and services provided;
• the data collected, used, or transferred;
• the information systems and technologies used;
• business projects and processes;
• critical suppliers, subcontractors, and service providers;
• the countries in which the group operates.

The proliferation of European regulations must not lead to the creation of independent and redundant systems. The goal must be to build integrated compliance, based on a mapping of risks and applicable obligations.

This approach involves, in particular, tailoring security and compliance measures to the criticality of activities, potential impacts, available resources, and regulatory requirements.

It also involves streamlining processes. The integration of security, data protection, risk management, and compliance into projects must begin as early as the design phases. Third-party management must also be strengthened: contractual arrangements, security assessments, business continuity requirements, monitoring of subcontractors, and management of critical dependencies are becoming central components of compliance.

Finally, this governance cannot be the sole responsibility of cybersecurity departments. It must involve business units, as well as the legal, compliance, risk, procurement, information systems, data protection, and executive management teams. Regulatory compliance thus becomes a corporate governance issue, on a par with managing financial or operational risks.

European digital law is evolving toward a more demanding model, in which data protection, cybersecurity, operational resilience, supplier management, and technology governance are closely intertwined.

For organizations, the challenge is no longer simply to identify the applicable regulations. It is to translate them into a coherent, proportionate operational framework tailored to the reality of each entity, business activity, project, and geographic region. This integrated approach is essential for effectively meeting European requirements while avoiding fragmented compliance, which is costly and difficult to manage.

(1) Digital Single Market for Europe, European Commission

(2) ENISA Threat Landscape 2026, ENISA, Sept. 2026

By Ludovic Van Egroo, Director Cyber Consulting & Tech Services