| name | eu-regulatory-router |
| description | Identify which EU regulations (AI Act, NIS2, DORA, GDPR) apply to your system based on sector, data types, and entity size, then route to the right compliance skill. |
| version | 1.0.0 |
| last-updated | 2026-04-17 |
| model_tested | claude-sonnet-4-6 |
| category | compliance |
| platforms | ["claude-code","codex","gemini-cli","cursor","copilot","windsurf","cline"] |
| language | en |
| geo_relevance | ["eu","fr"] |
| priority | critical |
| dependencies | {"mcp":[],"skills":["eu-ai-act-compliance","eu-nis2-compliance","eu-dora-compliance","gdpr-data-protection"],"apis":[],"data":[]} |
| update_sources | [{"url":"https://artificialintelligenceact.eu","check_frequency":"quarterly","last_checked":"2026-04-21"}] |
| license | MIT |
EU Regulatory Router
DISCLAIMER: This skill provides guidance only. It does not constitute legal advice. Regulatory applicability depends on specific circumstances that require qualified legal assessment.
When to Use
- Starting a new project and unsure which EU regulations apply
- Assessing regulatory exposure for an existing system
- Preparing for compliance audits
- When multiple regulations might overlap
Decision Tree
Question 1: Does your system process personal data?
- YES → GDPR applies. Use
gdpr-data-protection.
- NO → Skip GDPR. Continue.
Question 2: Does your system use AI/ML models?
- YES → AI Act likely applies. Use
eu-ai-act-compliance to classify risk.
- NO → Skip AI Act. Continue.
Question 3: Is your organization in a NIS2 sector?
Essential: Energy, transport, banking, health, water, digital infrastructure, ICT management, public admin, space.
Important: Postal, waste, chemicals, food, manufacturing, digital providers, research.
- YES + medium/large entity → NIS2 applies. Use
eu-nis2-compliance.
- NO → Skip NIS2. Continue.
Question 4: Is your organization a financial entity?
Banking, investment, insurance, pension, crypto, infrastructure.
- YES → DORA applies. Use
eu-dora-compliance.
- NO → Skip DORA.
Overlap Scenarios
| Scenario | Regulations | Priority |
|---|
| Fintech with AI chatbot | GDPR + AI Act + DORA | All three. DORA for resilience, AI Act for chatbot, GDPR for data. |
| Hospital with AI diagnostics | GDPR + AI Act + NIS2 | AI Act HIGH-RISK (health). NIS2 for cybersecurity. GDPR for patient data. |
| SaaS for SMEs (non-financial) | GDPR | Usually GDPR only. NIS2 if digital infrastructure. |
| Cloud provider | GDPR + NIS2 | NIS2 as digital infrastructure. GDPR as processor. |
| E-commerce with recommendations | GDPR + AI Act (limited risk) | GDPR for customer data. AI Act transparency for recommendations. |
Regulatory Collision Warning
When an AI security incident occurs at a financial institution, it can trigger ALL FOUR regulations simultaneously:
- DORA: ICT incident reporting (4h + 72h + 1 month)
- NIS2: Significant incident reporting (24h + 72h + 1 month)
- AI Act: If AI system involved, conformity breach
- GDPR: If personal data affected, data breach notification (72h)
Coordinate reporting timelines — the strictest deadline governs.
What This Skill Does NOT Do
- Does not provide legal certainty on regulatory applicability
- Does not handle national transposition differences
- Does not cover sector-specific regulations (e.g., MiCA for crypto beyond DORA)
- Does not replace legal counsel assessment
