Sovereign AI ready for European Union.

Risk-based regulation of AI systems and general-purpose AI models in the EU/EEA. Prohibited practices (Art. 5), high-risk requirements (Title III + Annex III), transparency obligations (Art. 50), and GPAI provisions (Title VIII Chapter V). Applies to providers, deployers, importers, distributors and authorised representatives.

EU regulation governing the processing of personal data of natural persons in the Union and the cross-border movement of such data. Applies to controllers and processors established in the EU and, under Art. 3(2), to those outside the EU that offer goods/services to or monitor data subjects in the EU. Covers principles (Art. 5), lawful basis (Art. 6+9), data-subject rights (Ch. III), controller/processor duties (Ch. IV), security (Art. 32), breach notification (Art. 33-34), DPIA (Art. 35), DPO (Art. 37-39), international transfers (Ch. V) and supervisory authority cooperation.

EU regulation establishing uniform requirements for the security of network and information systems supporting business processes of financial entities in the Union, and for the digital operational resilience of those entities. Covers ICT risk management (Chapter II), ICT-related incident reporting (Chapter III), digital operational resilience testing including TLPT (Chapter IV), ICT third-party risk (Chapter V), information-sharing arrangements (Chapter VI) and oversight of critical ICT third-party service providers (Chapter V Section II).

EU Directive on measures for a high common level of cybersecurity. Applies to medium and large essential and important entities operating in critical sectors (Annexes I + II): energy, transport, banking, financial market infrastructure, health, drinking water, waste water, digital infrastructure, ICT service management, public administration, space, postal services, waste management, manufacturing of critical products, food, digital providers, and research. Requires cybersecurity risk-management measures (Art. 21), incident reporting on a 24h early warning + 72h notification + 1-month final report cadence (Art. 23), supply-chain security and management-body accountability for non-compliance (Art. 20).

EU horizontal cybersecurity regulation for products with digital elements (hardware + software that can be connected to a device or network). Establishes essential cybersecurity requirements (Annex I), vulnerability handling obligations, conformity-assessment procedures (Annex VIII), CE marking, and 24-hour / 72-hour / 14-day vulnerability + incident reporting. Applies to manufacturers + importers + distributors placing products with digital elements on the EU market. Special categories: important products with digital elements (Annex III) and critical products with digital elements (Annex IV) require stricter conformity assessment routes.