Data, security and AI obligations: the decisions this practice answers
This hub sits above four decisions: what an organisation must do with personal and non-personal data, how it secures network and information systems, and what obligations attach to an AI system it builds or deploys. It also covers how a dataset is protected as an asset. Each decision has its own page. This page states which page answers which question, and where the current legal position stands.
What sits behind this: the current framework
Three instruments frame most of the decisions below. Regulation (EU) 2024/1689 (AI Act) sets obligations for providers and deployers of AI systems; it applies from 2 August 2026, and its scope remains subject to amendment, so this page states the position as of the review date at the end. Directive (EU) 2022/2555 (NIS2) sets a common baseline for network and information security across the Union; Member States apply it from 18 October 2024. Directive 96/9/EC protects a database as a right separate from copyright, where the compilation reflects a substantial investment.
What changes in practice
The practical effect depends on which of the four areas applies to your organisation. A data question changes what an organisation may collect, keep and transfer, and how it proves a disclosure was lawful. A security question changes what has to be reported, to whom, and inside what window, once an incident is confirmed. An AI question changes what documentation and human oversight a system needs before deployment. A database question changes who owns the compiled asset once contractors, a team, or both, have built it.
What to do first
- Identify which of the four areas the question sits in: data handling, security, AI, or database rights.
- Locate the point in your process where the obligation is triggered: collection, incident, deployment, or compilation.
- Assign an internal owner for that decision before a regulator or counterparty raises it.
- Route the specific question to the page that answers it, using the table below.
- Keep the date of any source you relied on next to the fact itself.
Who decides
A national supervisory authority handles data-protection and AI matters. A separate national body handles NIS2 incident reporting. Which authority applies, and the window for a first response, depends on the Member State and on the specific obligation in question. This hub does not name that authority for a specific case; the page for the specific situation does.
Where the question typically forks
If your organisation only processes data as a controller for its own business, most of the obligation sits with data handling, and, where AI drives a decision about a person, with the AI obligations above it. If your organisation builds or sells a system that others deploy, the obligation shifts toward the AI Act's provider duties and toward the security baseline set by NIS2. If the asset in question is a dataset that a team or a contractor compiled, the question is ownership under Directive 96/9/EC, not a data-protection question at all.
Which page answers which question
| Your question | Where it is answered |
|---|---|
| You need to licence, transfer or structure rights around data | Licensing, transfers and IP structures in practice |
| A dispute or infringement claim touches a patent | Patent protection, disputes and recovery overview step by step |
| The relationship sits in a vendor or outsourcing agreement | Technology contracts and outsourcing in detail |
| The asset is a token rather than personal or business data | Token issuance and trading overview and the evidence |
How the file is structured
We open a file the same way for every matter in this practice. A short intake maps which of the four areas the question touches, and whether more than one applies at once — a security incident involving an AI system, for instance, usually raises both together. The file then tracks the applicable obligation, the trigger date, and the internal owner named at the start. Matters differ in scope and jurisdiction, so the file does not carry a template outcome; it is built from the facts an organisation brings us.
What decides the cost
Cost on this practice depends on how many systems, jurisdictions and third parties sit inside the question, and on whether a regulator or counterparty has already made contact. It does not depend on the topic alone; a single-jurisdiction data question and a multi-jurisdiction AI deployment are priced on different scales. A partner responds to a first message within minutes during business hours. A price follows within one business day, once the scope above is confirmed.
Related publications
A first regulator request often arrives before an organisation has finished mapping its obligations. When a supervisory authority sends a first request: what to do first is covered on a dedicated page.
What this page does not cover
This hub does not set out procedure for a specific Member State, and it does not state a fee, a filing deadline, or a case number. Those facts belong to the page for the specific situation, once the jurisdiction and the obligation are known. It also does not answer whether a given tool qualifies as an AI system under a specific product; that assessment needs the file, not the hub.
Frequently asked questions
What does this change in practice?
It changes which internal owner is responsible, which authority can ask questions, and which deadline starts running. The specific change depends on which of the four areas above applies to your situation.
Which deadline applies?
The deadline depends on the obligation and the Member State. NIS2 sets incident-reporting windows; the AI Act sets phased application dates; a database claim runs on ordinary limitation rules. We confirm the specific date once we see the trigger event and the jurisdiction.
What do you need from us to start?
A short description of the system, dataset or incident, the jurisdictions involved, and any communication already received from a regulator or a counterparty. We map the rest during intake.
Verified
Reviewed: October 2025. Sources named in this page: Regulation (EU) 2024/1689 (AI Act), official text, eur-lex.europa.eu; Directive (EU) 2022/2555 (NIS2), European Commission, digital-strategy.ec.europa.eu; Directive 96/9/EC, official text, eur-lex.europa.eu.