Directives

Internal compliance framework and policies for the AI Act, NIS2, and GDPR.

---

Directives contents

Directive	Description
Governance & Responsibilities	Governance structure and roles
AI Governance	Governance of AI systems
Data Protection	GDPR and personal data protection
Security Governance	NIS2 and cybersecurity
Incident Management	Incident response
Audit & Monitoring	Audit and monitoring
Technological Sovereignty	Data and technological sovereignty

---

Executive Summary

This directive defines how the organization responsibly uses, develops, and deploys artificial intelligence and processes personal data in compliance with EU legislation:

• AI Act (EU 2024/1689): Risk-based regulation of AI systems
• NIS2 (Cybersecurity Act): Information security
• GDPR (EU 2016/679): Personal data protection

Our policy: To provide stakeholders (customers, employees, regulators) with assurance that AI and data are managed ethically, securely, and in compliance with the law.

---

Governance overview

Governance Cadence

Frequency	Meeting	Participants
Monthly	Compliance sync	CTO, CISO, DPO
Quarterly	Board review	C-level, Board
Annually	External audit	All + Auditor

---

Document version

Version	Date	Changes
1.0	1 January 2026	Initial release

Next review: Q1 2027

---

Next steps

1. Governance & Responsibilities
2. AI Governance
3. Data Protection
4. Security Governance