eu-regulatory-router

name	eu-regulatory-router
description	Identify which EU regulations (AI Act, NIS2, DORA, GDPR) apply to your system based on sector, data types, and entity size, then route to the right compliance skill.
version	1.0.0
last-updated	2026-04-17
model_tested	claude-sonnet-4-6
category	compliance
platforms	["claude-code","codex","gemini-cli","cursor","copilot","windsurf","cline"]
language	en
geo_relevance	["eu","fr"]
priority	critical
dependencies	{"mcp":[],"skills":["eu-ai-act-compliance","eu-nis2-compliance","eu-dora-compliance","gdpr-data-protection"],"apis":[],"data":[]}
update_sources	[{"url":"https://artificialintelligenceact.eu","check_frequency":"quarterly","last_checked":"2026-04-21"}]
license	MIT

EU Regulatory Router

DISCLAIMER: This skill provides guidance only. It does not constitute legal advice. Regulatory applicability depends on specific circumstances that require qualified legal assessment.

When to Use

• Starting a new project and unsure which EU regulations apply
• Assessing regulatory exposure for an existing system
• Preparing for compliance audits
• When multiple regulations might overlap

Decision Tree

Question 1: Does your system process personal data?

• YES → GDPR applies. Use gdpr-data-protection.
• NO → Skip GDPR. Continue.

Question 2: Does your system use AI/ML models?

• YES → AI Act likely applies. Use eu-ai-act-compliance to classify risk.
• NO → Skip AI Act. Continue.

Question 3: Is your organization in a NIS2 sector?

Essential: Energy, transport, banking, health, water, digital infrastructure, ICT management, public admin, space. Important: Postal, waste, chemicals, food, manufacturing, digital providers, research.

• YES + medium/large entity → NIS2 applies. Use eu-nis2-compliance.
• NO → Skip NIS2. Continue.

Question 4: Is your organization a financial entity?

Banking, investment, insurance, pension, crypto, infrastructure.

• YES → DORA applies. Use eu-dora-compliance.
• NO → Skip DORA.

Overlap Scenarios

Scenario	Regulations	Priority
Fintech with AI chatbot	GDPR + AI Act + DORA	All three. DORA for resilience, AI Act for chatbot, GDPR for data.
Hospital with AI diagnostics	GDPR + AI Act + NIS2	AI Act HIGH-RISK (health). NIS2 for cybersecurity. GDPR for patient data.
SaaS for SMEs (non-financial)	GDPR	Usually GDPR only. NIS2 if digital infrastructure.
Cloud provider	GDPR + NIS2	NIS2 as digital infrastructure. GDPR as processor.
E-commerce with recommendations	GDPR + AI Act (limited risk)	GDPR for customer data. AI Act transparency for recommendations.

Regulatory Collision Warning

When an AI security incident occurs at a financial institution, it can trigger ALL FOUR regulations simultaneously:

• DORA: ICT incident reporting (4h + 72h + 1 month)
• NIS2: Significant incident reporting (24h + 72h + 1 month)
• AI Act: If AI system involved, conformity breach
• GDPR: If personal data affected, data breach notification (72h)

Coordinate reporting timelines — the strictest deadline governs.

What This Skill Does NOT Do

• Does not provide legal certainty on regulatory applicability
• Does not handle national transposition differences
• Does not cover sector-specific regulations (e.g., MiCA for crypto beyond DORA)
• Does not replace legal counsel assessment