Know which security rules apply to you, and get ready
NIS2, GDPR, DORA, ISO 27001, a customer's security clauses: QoBot works out what applies to your company and why, then turns it into a plan your team can follow, step by step.
Northwind Logistics' activity is probably outside NIS2's sectors, but two of your largest customers are in scope and will pass requirements down. GDPR applies to your driver and customer data. First steps:
- Paul (CFO): confirm the group's headcount and turnover · ~10 minYour turn
- Inès (IT): turn on MFA for remote access · guide ready · ~30 minYour turn
- You: approve the information security policy v1 · ~15 minNeeds you
Getting ready for your obligations: who does what
What QoBot does
- Asks about your activity, size, group, countries and customers, then says what likely applies and why.
- Writes each result as a reading to confirm, with what would change it.
- Runs the gap analysis from what you already have, and writes the policies.
- Builds the plan in order, each action with an owner, an effort and a date.
- Prepares the note management approves, and follows up each week.
What your team does
- Answer the facts: activities, headcount, group structure, customers.
- Management approves the plan and the policies.
- Your team applies the actions with QoBot's step-by-step guides.
- Your lawyer or auditor confirms borderline cases.
Which rules might apply
| Rule | What it is | Who it concerns |
|---|---|---|
| NIS2 | EU law on cybersecurity risk management and incident reporting | Medium and large organisations in 18 listed sectors, some smaller ones |
| GDPR | EU law on personal data, including its security (article 32) and breach notification (articles 33 and 34) | Almost every organisation that handles personal data |
| DORA | EU law on digital resilience, applicable since 17 January 2025 | Banks, insurers, investment firms and other financial entities |
| ISO 27001 | Voluntary international standard, certified by an independent body | Anyone whose customers or tenders ask for it |
| SOC 2 | US attestation report on your security controls, issued by a CPA firm | Companies selling services to US customers |
| TISAX | Automotive industry assessment against the VDA ISA catalogue, run by ENX | Suppliers of carmakers and of their suppliers |
| Cyber Essentials | UK government-backed certification of five technical controls | Suppliers on UK government and NHS contracts |
| Customer clauses | Security requirements written into your contracts | Suppliers of demanding customers, often because of NIS2 |
How QoBot works it out
QoBot asks the questions that decide the answer, one at a time: what you do (the activity, not the label), where you’re established, how big you are with your group, which customers you serve. It writes the result as a reading with its reasons, the official texts it relies on, and what would change it. For NIS2 in France, it points you to ANSSI’s eligibility test for an official second opinion.
QoBot never presents a reading as a legal determination. Borderline cases go to your lawyer; QoBot prepares the file.
From obligation to plan
Once you know what applies, the work looks the same: a gap analysis from what you already have, the missing policies written from what’s true today, and a plan ordered by risk reduction per effort. Each action has an owner (you, your IT person, your provider), an effort, an indicative cost marked as an estimate, and a way to check it’s done.
Management approves the plan. Under NIS2, that approval and the managers’ own training are obligations in themselves (article 20), so QoBot prepares a short note for them.
Honest limits
QoBot is not a lawyer, an auditor or a certification body. It doesn’t certify compliance and it won’t give you a national deadline that doesn’t exist yet. It gets you ready, documents what’s in place, and tells you what an authority or an auditor would look for.
FAQ
Is NIS2 mandatory today?
It depends on your country: NIS2 binds organisations through national law. As of 20 October 2026, 24 of the 27 EU countries have their NIS2 law in force; France, Ireland and Spain don't yet. The UK isn't in NIS2 and has its own rules. Our NIS2 page has the status per country and a 3-question check.
Will QoBot make us compliant?
QoBot gets you ready: it explains what applies, writes the documents, plans the work and tracks what's done. Compliance is judged by an authority or an auditor, and an ISO 27001 certificate is issued by a certification body.
We're too small for NIS2. Why bother?
Your in-scope customers must manage the security of their suppliers, so their questionnaires and contracts reach you anyway. GDPR applies at any size as soon as you handle personal data.
Which countries does QoBot know?
The EU texts, the NIS2 status of every EU country, and the main UK schemes (Cyber Essentials, the NIS Regulations). For a national detail we haven't verified yet, QoBot says so and points you to that country's authority.
Sources
- Directive (EU) 2022/2555 (NIS2)EUR-Lex · scope (art. 2, 3), measures (art. 21), reporting (art. 23)Official text
- Regulation (EU) 2016/679 (GDPR)EUR-Lex · security of processing (art. 32), breach notification (art. 33, 34)Official text
- Regulation (EU) 2022/2554 (DORA)EUR-Lex · digital operational resilience for the financial sectorOfficial text
- ISO/IEC 27001:2022ISO · information security management systemsOfficial text
- ANSSI NIS2 portal (France)Eligibility test and voluntary pre-registrationOfficial page
This page explains the rules in plain words. It isn't legal advice: for a borderline case, ask a lawyer. Report an error