The EU regulatory stack has quietly become unmanageable through human effort alone. Between the EU AI Act, DORA, NIS2, GDPR, and ISO 27001, mid-market organisations now face overlapping obligations across five major frameworks, each with its own enforcement timeline, technical standards, and supervisory expectations. Understanding why manual processes are failing, and what the alternative looks like, is no longer optional.
The scale of the problem
Five years ago, a typical mid-market financial services firm in Ireland needed to manage GDPR and perhaps MiFID II. The compliance team, often one or two people, could maintain records of processing activities, update privacy notices annually, and respond to data subject access requests within the statutory window. It was manageable.
Today that same firm faces GDPR, DORA which has been live since January 2025, NIS2 which is being enforced across member states, the EU AI Act with obligations now phased through to 2028, and increasingly ISO 27001 as a baseline expectation from clients and partners. Each framework introduces its own documentation requirements, risk assessment methodologies, incident reporting timelines, and board-level accountability obligations.
The combined obligation set across these five frameworks runs into hundreds of individual requirements, and many of them overlap without being identical. The GDPR data protection impact assessment and the EU AI Act fundamental rights impact assessment cover similar ground but are separate instruments. The DORA ICT risk management framework and the NIS2 cybersecurity risk management obligations share principles but diverge on specifics. Managing those overlaps by hand, tracking which control satisfies which obligation under which framework, is where most organisations break down.
Why spreadsheets and annual audits no longer work
The traditional model runs like this. Engage a consultancy for a scoping exercise, receive a gap assessment report some months later, build the documentation internally from its recommendations, then audit annually to check nothing has drifted. That model assumes regulations stay static between audits and that your organisation stays static between audits. Neither assumption holds.
Regulation is evolving continuously. The EU AI Act is supported by a growing body of implementing and delegated acts, harmonised standards, and guidance from the AI Office, ENISA, and national competent authorities, and it has already been amended by Regulation (EU) 2026/1744. The DORA regulatory and implementing technical standards have been published in phases. NIS2 transposition varies by member state. A compliance programme written six months ago as a static document is already behind.
Your organisation is changing too. New AI systems get deployed, new processing activities begin, new third-party ICT providers are onboarded, new employees need awareness training. Each of those can trigger obligations across several frameworks at once. A new AI system used for credit scoring engages the EU AI Act as a potential Annex III high-risk use, GDPR through Article 22 on automated decision-making, and DORA through the ICT risk management of the underlying infrastructure. A spreadsheet cannot keep pace with that.
The three options that fall short
Most mid-market organisations facing this see three paths, and none of them addresses the underlying problem.
Traditional consultancy delivers expert analysis, but on an hourly cost base and a timeline measured in months rather than weeks. The output is a report, and from the day it lands it begins to decay, because nobody updates it when a new technical standard is published or a new system goes live.
Enterprise GRC platforms carry licensing, implementation, configuration, and the internal headcount needed to run them. For a two-person compliance function that is rarely practical. The platform ends up underused and the team goes back to spreadsheets.
Do it yourself with AI tools is the newest option and the most tempting. General purpose models will draft privacy notices, risk assessments, and compliance documentation that reads as though it is nearly finished. What they cannot do is be accountable to a regulator, judge how the Central Bank of Ireland is applying proportionality under DORA this quarter, or sign a declaration of conformity. And when new guidance lands six months later, nobody goes back to update what the model wrote.
The fourth option, AI with expert oversight
Neither AI alone nor experts alone is the right answer. AI makes the work faster and more affordable. Expert oversight makes the output defensible under scrutiny. Continuous management keeps the programme current as both the regulation and the organisation move.
That is the model Morclear operates through CORA™. Automation handles the volume, meaning first drafts, obligation mapping across frameworks, overlap detection, change flagging, and board-ready reporting. Regulatory oversight handles the judgement, meaning interpreting enforcement signals, assessing proportionality, reviewing output for accuracy, and taking accountability for what is delivered.
In practice that begins with a gap assessment at €999 delivered in two weeks, scales into a Programme Build from €15,000*, and then runs continuously under Managed Compliance from €2,000 per month* rather than stopping at audit. When new technical standards are published, the programme is updated. When a new system is deployed, its impact is assessed against every applicable framework.
*Fees confirmed after a free scoping call.
What continuous compliance actually means
Continuous compliance is a structural shift rather than a marketing term. Instead of producing a report once a year and hoping nothing moved, it means monitoring obligations as they change, detecting drift between the programme and current expectations, updating documentation as requirements evolve, and being able to report status to the board on demand rather than at the next quarterly review.
For organisations with limited internal compliance resource this is the only sustainable model. You cannot hire enough people to track five overlapping frameworks and the supervisory output around them by hand, you cannot re-engage a consultancy every time an implementing act is published, and you cannot rely on a model alone because no regulator will accept that a tool produced the answer.
Where the timeline stands
DORA has been live since January 2025, so financial entities that are not yet compliant are already exposed. NIS2 transposition is underway across member states, and essential and important entities should already have cybersecurity risk management measures in place.
The EU AI Act is no longer a single date. Following Regulation (EU) 2026/1744, the Article 5 prohibitions have been enforceable since February 2025, the Article 50 transparency obligations became applicable on 2 August 2026 and were not deferred, systems already on the market before that date come into scope for content marking on 2 December 2026, Annex III standalone high-risk systems apply from 2 December 2027, and Annex I embedded high-risk systems from 2 August 2028.
Split obligations are harder to manage than a single deadline, because the parts that are already in force attract no headlines. On penalties, the AI Act provides for up to €35 million or 7% of total worldwide annual turnover for the Article 5 prohibited practices, up to €15 million or 3% for most other obligations including those on high-risk systems, and up to €7.5 million or 1.5% for supplying incorrect or misleading information to authorities.
What to do now
If your programme still runs on spreadsheets, annual audits, and point-in-time reports, the most useful step available today is to establish your current exposure. The free AI Act assessment takes ten minutes and returns a scored view of where your obligations sit, with no commitment attached.
From there a CORA™ Gap Assessment at €999, delivered in two weeks, maps your obligations across every applicable framework and produces a prioritised remediation roadmap. That single document sets out what needs to be done and in what order before you commit to anything further.
A compliance professional with AI beats AI without a compliance professional. The question is no longer whether to automate the work, it is whether to do it while the timeline still allows methodical preparation or later, when the only option left is emergency remediation.
Primary Regulatory Sources
Morclear resources are independently produced. They do not constitute legal, regulatory, financial, or professional advice.