Already have SOC 2, ISO 27001, or NIST AI RMF? See exactly what GDPR, the EU AI Act, NIS2, DORA, HIPAA and CCPA/CPRA add on top — theme by theme, with article citations, and with the date each obligation actually bites. Updated 2026-09-12.
The deltas below move. The EU AI Act high-risk regime slipped to December 2027; California’s ADMT rules bite in January 2027 and its cybersecurity-audit certifications from April 2028; NIS2 is still arriving country by country, with Austria’s act in force this October. CybereyeQ tracks those changes and mails the ones that alter an obligation.
Subscribe to the CybereyeQ briefing →
For an offline copy of any pairing, use Print / Save as PDF above — the page is print-styled and prints only the delta cards.