GRC and Compliance Software in Europe: Requirements by Country

Last updated: 19 October 2026

Quick answer: GRC software for Europe has to handle two layers at once: EU-wide laws such as GDPR, NIS2, DORA, the EU AI Act and the Cyber Resilience Act, and the national laws, authorities and supervisors that implement and enforce them in each country. The right tool maps one set of controls to several frameworks, keeps separate records for each legal entity and country, and gives you clear answers on where your compliance data is hosted.

Most European organisations do not deal with “EU compliance” in the abstract. They deal with a specific data protection authority, a specific financial supervisor, a national cybersecurity agency and a national law that transposes or supplements the EU text. A group with subsidiaries in five countries may face five versions of the same obligation.

That is why spreadsheets break down quickly in Europe. The same NIS2 incident might have to be reported to two authorities in different formats, and a GDPR processing record may need to reflect national rules on employee data or the age of consent. Tracking all of this by hand, across languages and entities, makes it hard to show accountability when a regulator asks.

This guide sets out the EU-wide layer, explains why national implementation matters, lists the main authorities in 15 European countries, and covers what to look for in GRC and compliance software that has to work across borders.

Which EU laws apply across Europe?

Five EU instruments form the common baseline for cybersecurity and data protection compliance: GDPR, NIS2, DORA, the EU AI Act and the Cyber Resilience Act. Regulations apply directly; directives such as NIS2 only take effect through national law.

GDPR

The General Data Protection Regulation is the foundation. Its core operational duties include records of processing activities (Article 30), security of processing (Article 32), breach notification to the supervisory authority within 72 hours where feasible (Article 33), data protection impact assessments (Article 35) and responses to data subject requests, normally within one month. The highest tier of fines reaches €20 million or 4% of worldwide annual turnover, whichever is higher.

NIS2

The NIS2 Directive sets cybersecurity risk-management measures (Article 21), management body accountability (Article 20) and a staged incident reporting cascade: an early warning within 24 hours, an incident notification within 72 hours and a final report within one month (Article 23). Maximum fines are at least €10 million or 2% of worldwide turnover for essential entities and €7 million or 1.4% for important entities. Because NIS2 is a directive, the actual obligations, registration portals and authorities come from national law.

DORA

The Digital Operational Resilience Act applies directly to financial entities. It covers ICT risk management, ICT-related incident classification and reporting, digital operational resilience testing, ICT third-party risk and the register of information on ICT contractual arrangements. For entities in scope of both, DORA operates as sector-specific law alongside NIS2; our comparison of NIS2 and DORA sets out where they overlap.

EU AI Act

The AI Act uses a risk-based approach. Prohibited practices and the AI literacy duty have applied since 2 February 2025, and obligations for general-purpose AI models since 2 August 2025. As adopted, most remaining provisions, including those for high-risk systems listed in Annex III, apply from 2 August 2026, and high-risk systems that are safety components of products covered by Annex I from 2 August 2027. The Commission has proposed adjusting the high-risk timetable as part of its digital simplification package, so check the current consolidated text before fixing internal deadlines.

Cyber Resilience Act

The CRA places security-by-design and vulnerability handling duties on products with digital elements, from connected devices to software. Manufacturers must report actively exploited vulnerabilities and severe incidents from 11 September 2026, and most other obligations apply from 11 December 2027. For many software companies, the CRA is the first EU cybersecurity law that applies to the product rather than the organisation.

Why does national implementation matter?

Even where EU law applies directly, national law decides who enforces it, how, and with which additional rules. In practice this affects at least four things.

• Different authorities. Each country has its own data protection authority, one or more financial supervisors and a national cybersecurity authority or CSIRT. Germany alone has a federal data protection commissioner and separate state authorities.
• Supplementary national laws. GDPR leaves room for Member States to legislate on topics such as employee data, the age of consent for information society services, DPO designation and processing for journalistic or research purposes. Most countries have a national data protection act that fills these gaps.
• Uneven NIS2 transposition. NIS2 was due to be transposed by 17 October 2024, but many Member States were late. In May 2025 the Commission sent reasoned opinions to 19 Member States, and in July 2026 it referred Ireland, Spain, France and the Netherlands to the Court of Justice. Our NIS2 transposition tracker summarises the status by country.
• Local supervisory expectations. Financial supervisors often publish their own guidance, circulars or reporting templates on top of DORA and EBA guidelines, and they inspect against them.

For cross-border processing of personal data, GDPR’s one-stop-shop mechanism means a lead supervisory authority, usually in the country of the main establishment, coordinates with other concerned authorities. That does not remove local obligations, such as national employment rules or sector regulators, in the other countries where you operate.

What are the compliance requirements by country?

The table lists the data protection authority, the main financial supervisor or supervisors, and notable national points for 15 European countries. It is a starting point for scoping, not a complete legal inventory. National cybersecurity laws implementing NIS2 are changing quickly, so we have only listed them where the position is settled.

Cyprus: Cyprus follows the same EU baseline, with Law 125(I)/2018 supplementing GDPR, the Commissioner for Personal Data Protection as data protection authority, and CySEC and the Central Bank of Cyprus as the main financial supervisors. See our guide to GDPR in Cyprus and Law 125(I) for detail.

What should you know about specific countries?

A few countries deserve extra attention because of their regulatory structure or the volume of organisations headquartered there.

Germany: federal and state layers

Germany combines GDPR and the BDSG with a long-standing critical infrastructure regime under the BSI Act, strengthened by IT-Sicherheitsgesetz 2.0 in 2021. Most private companies are supervised by the data protection authority of their federal state, such as the BayLDA in Bavaria, rather than by the BfDI. Auditors expect clear Nachweisbarkeit (evidence of compliance): a maintained record of processing activities, DPIAs where required and documented incident reporting. Our article on NIS2 and BDSG compliance in Germany covers the national picture.

Belgium: an early NIS2 adopter

Belgium was among the first Member States to transpose NIS2. Its law lets entities use the CyFun framework or ISO 27001 certification as a route to demonstrating conformity, which makes control mapping especially useful. See our guide to the Belgian NIS2 law and CyFun.

Ireland: one-stop-shop and payments

Because many multinational technology firms have their EU headquarters in Ireland, the DPC handles a large share of cross-border GDPR cases. Payment businesses also often need PCI DSS, an industry standard enforced through card scheme contracts rather than law. Read our overview of the Irish National Cyber Security Bill for the NIS2 position.

Malta and Luxembourg: financial hubs

Both countries host large numbers of licensed financial entities that passport services across the EU. DORA, outsourcing and ICT third-party oversight dominate the agenda, alongside AML supervision in Malta. Our Malta NIS2 guide covers registration and scoping.

Norway and Switzerland: outside the EU

Norway applies GDPR through the EEA Agreement, but other EU acts arrive on a separate timetable. Switzerland has its own data protection law, the nFADP, which is close to GDPR but differs in details such as terminology and sanctions, which target individuals rather than companies. The EU recognises Switzerland as providing adequate protection, so personal data can flow from the EU without extra transfer tools. Swiss ICT providers serving EU banks or insurers will still feel DORA through their customers’ contracts.

What should you look for in GRC software for multi-country compliance?

Look for multi-framework mapping, a multi-entity structure, support for several languages and authorities, and clear answers on hosting and data residency. A single-country tool that works well for one entity can become a constraint once you add subsidiaries or new regulations.

Multi-framework control mapping

The same control often satisfies several requirements. Access management, for example, supports GDPR Article 32, NIS2 Article 21, DORA ICT risk management and ISO 27001 Annex A. Good software lets you implement and evidence a control once, then show coverage against each framework. Check that the catalogue includes the frameworks you actually need, such as GDPR, NIS2, DORA, ISO 27001, ISO 27701, ISO 42001 and PCI DSS, and that you can add national frameworks or custom requirements. Enactia’s list of supported frameworks and regulations is one example of what to compare against.

Multi-entity and multi-country structure

• Separate records of processing, risk registers and assessments for each legal entity, with a group-level view.
• The ability to tag obligations, incidents and registrations by country and authority.
• Role-based access so local DPOs, CISOs and compliance officers see their own entities.
• Incident workflows that support different reporting deadlines and recipients, for example a GDPR 72-hour notification and a NIS2 24-hour early warning for the same event.

Languages and local teams

Policies, training records and data subject communications often need to exist in local languages. Ask whether the interface and generated reports support the languages your teams use, and whether you can keep multilingual versions of policies under one version history.

Third-party and supply chain risk

NIS2 Article 21 and DORA both require you to manage ICT supply chain risk, and GDPR requires due diligence on processors. Look for a vendor and third-party management module that stores agreements, certifications and assessment answers, and tracks where vendors transfer personal data. Financial entities should check that it can support the DORA register of information.

Data residency and hosting questions to ask

Your GRC platform will hold sensitive information: incident details, vulnerability findings, vendor assessments and personal data in DSARs. Before you buy, ask each vendor:

1. In which country, and with which cloud provider, will our data be hosted?
2. Can we choose the hosting region, or deploy in a dedicated or private environment?
3. Which sub-processors have access to our data, and from which countries?
4. Is any data transferred outside the EU/EEA, and if so, under which transfer mechanism?
5. Which security certifications or attestations does the vendor hold, and can we see the reports?
6. How are backups, logs and support access handled, and where are they located?
7. Can we export all our data in a usable format if we leave?

Compare the answers against your own regulators’ expectations. Financial entities, for instance, will need the contract to cover the DORA requirements for ICT third-party arrangements.

Fit for your team size

Enterprise suites such as OneTrust or Archer tend to suit large organisations with dedicated administrators. Mid-sized organisations and groups with lean compliance teams usually benefit more from a modular platform that is quick to configure. Enactia, for example, combines enterprise risk management, records of processing, DPIAs, data subject requests, incident and breach management, policy, asset and vendor management in one platform, and you can use the full platform or individual modules.

How do you implement GRC software across European entities?

Start with scope, then structure, then controls. Roll out in phases rather than trying to cover every country and framework at once.

1. Map entities and jurisdictions. List every legal entity, where it is established, what it does and which authorities supervise it. Use the table above as a template.
2. Build an obligations register. For each entity, record which EU and national laws apply: GDPR and the national data protection act, NIS2 status and registration, DORA if it is a financial entity, AI Act roles and CRA if you make digital products.
3. Choose a control baseline. Many organisations use ISO 27001 for security and ISO 27701 for privacy, then map NIS2, DORA and national requirements onto it.
4. Configure the platform. Set up entities, owners, risk methodology and frameworks. Import existing records of processing, risk registers and policies rather than starting again.
5. Run a baseline assessment. Assess each entity against its frameworks, record gaps and assign remediation tasks with owners and deadlines.
6. Set up incident and breach workflows. Record which authority receives which report and within which deadline for each country, and test the workflow with a tabletop exercise.
7. Bring in vendors. Send third-party assessments, collect evidence and link vendors to the processing activities and assets they support.
8. Report to management. NIS2 and DORA place accountability on the management body. Give it regular dashboards showing risk, open findings and compliance status by entity.
9. Review and update. Track changes in national law, especially NIS2 transposition and AI Act timelines, and update obligations and controls when they change.

In practice: start with the entity facing the nearest deadline or the most active supervisor, prove the structure works, then extend it to the rest of the group.

Frequently asked questions

What is GRC software?
GRC (governance, risk and compliance) software brings risk registers, compliance assessments, policies, incidents, vendor management and evidence into one system. For European organisations it typically covers data protection under GDPR and cybersecurity under NIS2, DORA and standards such as ISO 27001.

Does GDPR apply the same way in every European country?
The core rules are the same across the EU and EEA, but each country has a national law that fills the areas GDPR leaves to Member States, such as employee data and the age of consent. Each country also has its own data protection authority. Switzerland is outside the EU and EEA and applies its own nFADP.

Does NIS2 apply in Norway and Switzerland?
Not directly. Norway is in the EEA, so NIS2 applies only once it is incorporated into the EEA Agreement and Norwegian law. Switzerland is outside both, but has its own cyberattack reporting duty for critical infrastructure, in force since 1 April 2025.

Can one GRC platform cover several countries and frameworks?
Yes, if it supports multiple legal entities and maps controls to several frameworks. Check that you can keep separate records per entity, tag obligations by country and authority, and report at group and local level.

Where should my compliance data be hosted?
There is no single legal answer, but many European organisations prefer EU or EEA hosting to simplify GDPR transfer questions and meet supervisor expectations. Ask vendors where data, backups and support access are located and which sub-processors are involved.

When do the EU AI Act and Cyber Resilience Act apply?
The AI Act has applied in stages since February 2025, with most remaining provisions due from 2 August 2026 under the adopted text, though the Commission has proposed changes to the high-risk timetable. The CRA’s reporting duties apply from 11 September 2026 and its main obligations from 11 December 2027.

Managing European compliance in one place

European compliance is a common EU baseline delivered through national authorities, laws and timelines. The organisations that cope best record which rules apply to each entity, map controls once across frameworks, and keep evidence ready for whichever regulator asks. Enactia’s AI-powered GRC platform supports GDPR, NIS2, DORA, ISO 27001 and other frameworks in one place for DPOs, CISOs and risk teams.

To discuss your multi-country requirements, contact us or book a demo or start your 14-day free trial.

This article is for general information and is not legal advice.