Guides
EU compliance law, read from the official text.
For compliance and engineering leads: what the acts actually say, with a citation for every claim.
The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.
-
GDPR · · 7 min
What does GDPR Article 22 forbid? Automated decisions and the AI Act
GDPR Article 22 gives people the right not to be subject to a decision based solely on automated processing that produces legal effects or similarly significant effects on them. Such a decision is allowed only in three cases, contract, law or explicit consent, and in two of them the controller must at least offer human intervention, a chance to be heard and a way to contest the decision.
-
Cyber Resilience Act · · 8 min
Cyber Resilience Act: the reporting duty that already applies
The Cyber Resilience Act applies in full from 11 December 2027, but its reporting duty in Article 14 has applied since 11 September 2026. From that date a manufacturer must send an early warning of any actively exploited vulnerability or severe incident within 24 hours of becoming aware of it, a fuller notification within 72 hours, and a final report after that.
-
GDPR · · 6 min
What goes in a record of processing activities? GDPR Article 30
A record of processing activities (RoPA) is the written inventory GDPR Article 30 requires, and it holds seven items for a controller and four for a processor. Organisations with fewer than 250 staff are exempt only when none of three conditions in Article 30(5) applies, and one of them, processing that is not occasional, covers most routine work.
-
DORA · · 8 min
DORA register of information: what Article 28 requires
Under DORA Article 28(3), every financial entity keeps a register of information covering all its contractual arrangements for ICT services from third-party providers, at entity level and at sub-consolidated and consolidated levels, and marks which of them support critical or important functions. It reports on new arrangements at least once a year and hands over the full register when its competent authority asks.
-
EU AI Act · · 8 min
Is your AI system high-risk? EU AI Act Article 6 and Annex III, read in full
An AI system is high-risk under the EU AI Act by one of two routes in Article 6. It is a safety component of a product regulated under Annex I that needs third-party conformity assessment. Or it is a use in one of the eight Annex III areas. An Annex III system escapes the class only through the Article 6(3) exception, never if it profiles people.
-
GDPR · · 7 min
What must a data processing agreement contain? GDPR Article 28(3)
A data processing agreement is mandatory whenever a processor handles personal data for a controller. GDPR Article 28(3) sets its minimum content. It must describe the processing and then bind the processor to eight points. They run from acting only on documented instructions to deleting or returning the data and opening itself to audits.
-
NIS2 · · 8 min
NIS2 compliance: who must comply, essential vs important entities
NIS2 asks two questions in order. Does the entity's type appear in Annex I or II? Is it at least medium-sized, or does it meet a size-independent trigger in Article 2(2)? Article 3 then sorts in-scope entities into essential and important ones. Both take the same ten risk-management measures and report incidents on the same 24-hour, 72-hour and one-month clock.
-
GDPR · · 7 min
When is a DPIA required? GDPR Article 35 and its three cases
A DPIA is required before any processing that is likely to result in a high risk to people's rights and freedoms. GDPR Article 35(3) names three cases where that is always so. They are automated evaluation behind decisions with legal or similarly significant effects, large-scale special-category or criminal-offence data, and large-scale systematic monitoring of a publicly accessible area.
-
DORA · · 8 min
DORA compliance: the five pillars and the articles behind each
DORA does not use the word "pillars"; that is industry shorthand for the areas Article 1 lists, grouped into five workstreams. They are ICT risk management, incident reporting, resilience testing, ICT third-party risk and information sharing, and all five have bound financial entities since 17 January 2025.
-
EU AI Act · · 7 min
EU AI Act compliance: the obligations by role, article by article
The EU AI Act splits obligations by role, not by industry. A provider that builds or badges a high-risk system carries Article 16's list; a deployer that merely runs one carries Article 26's, which is shorter.
¶ 1Next on the guides
Written, and dated.
None is scheduled right now.
¶ 2Put it to work
Use it today.
Recorded jobs
Watch Rekvira draft a classification memo, a DORA third-party review or a customer questionnaire from the official text, step by step.
Playbooks
Research paths your assistant can run on its own: which passages to read and which citations to check.
Start with a free account.
One email to sign in, no API key, and free during the beta.
https://mcp.rekvira.com/mcp