Orientation for management
Start with the decisions you need to make: applicability, ownership, evidence and next steps. These guides explain the framework and the legal context; they do not certify an organisation’s compliance.
Read in this order
- Framework philosophy
- Management brief
- Scope and applicability
- Dates and implementation sequence
- Digital Omnibus on AI
| Regulation | What determines applicability | Practical output |
|---|---|---|
| AI Act | System/model definition, role, intended purpose, EU nexus and Article 2 exclusions; Article 6 and Annexes I/III for high risk | Inventory, reasoned classification and obligations for each role |
| NIS2 / Czech law | Specific service, entity type, size including enterprise relationships, and special exceptions; Czech higher/lower regime rules | Record of regulated service assessment, regime and deadlines |
| GDPR | Material and territorial scope in Articles 2–3, processing operation and controller/processor role; not people’s citizenship | Purposes, legal bases, processing records and rights procedures |
| Data Act | User, data holder/recipient, manufacturer, related service or data processing service provider role; relevant chapter and exclusions | Data rights map, access process and contractual/technical switching plan |
| DORA | Listed Article 2 financial entities and exceptions; the special oversight framework for critical ICT providers follows Article 31 designation; ordinary ICT contracts carry duties without that designation | ICT framework, contract register, reporting and testing plan for the applicable regime |
Content reviewed: 6 September 2026. Primary sources: AI Act, Digital Omnibus on AI, NIS2, NÚKIB: registrace a lhůty, GDPR, DORA, Data Act.