NIS2, DORA and AI Act advisory for SMEs in Brescia and Italy

Establish which requirements concern the business

The service is intended for business owners, management teams, IT leaders, risk functions and procurement teams that need to clarify a regulatory or contractual request before committing resources. For SMEs in Brescia’s industrial supply chains, as for Italian businesses supplying regulated organizations, exposure depends on the activities performed, the processes supported and the company’s actual role in the supply chain.

The preliminary assessment separates directly applicable duties from requirements conveyed through contracts and measures that the business chooses to adopt for operational continuity. Questions requiring legal interpretation are identified for the client’s qualified advisers, while the review records the sources, assumptions and information that still need to be obtained.

NIS2, DORA and the AI Act have different scopes

NIS2: scope, management responsibilities and supply chains

NIS2, implemented in Italy through Legislative Decree 138/2024, requires an assessment of activities, sectors and size criteria, including linked enterprises and exceptions: a small business may fall within scope in specific circumstances, while supply-chain membership alone does not establish this. For entities within scope, documentary work concerns risk governance, management involvement, supplier security and incident reporting preparedness. Priorities and deadlines are established from ACN communications and the measures applicable to the individual entity, rather than assuming that every business follows the same schedule.

References: NIS1, NIS2, NIS3, NIS4.

DORA: financial entities and ICT suppliers

DORA has applied since January 17, 2025 to financial entities within its scope, subject to specific exclusions and proportionality provisions. An SME supplying ICT services to a financial customer may instead need to document services, subcontractors, continuity arrangements and information required by its contract. The review helps prepare this evidence and questions for counsel, distinguishing customer requirements from the regulated entity’s duties and the oversight regime for designated critical providers; the supplier’s NIS2 status does not replace DORA contractual requirements.

References: DORA1, DORA2, DORA5, DORA8.

AI Act: use cases, roles and the applicable timeline

Under the AI Act, the assessment depends on the company’s role and the system’s purpose and characteristics: purchasing an assistant does not automatically introduce a high-risk system. Advisory work may map use cases, delegated authority, oversight, AI literacy initiatives and relevant transparency arrangements. As of November 3, 2026, general provisions and relevant transparency duties already apply; the Commission’s timeline distinguishes the main application date for Annex III high-risk systems, December 2, 2027, from that for systems linked to Annex I products, August 2, 2028. Specific transitional provisions, including those concerning content marking, require assessment for the actual system.

References: AI3, AI4, AI7, AI8.

GDPR and the Cyber Resilience Act: connected requirements

Personal data and incident management

Where personal data is involved, breach management needs to be coordinated with the GDPR: an ICT incident is not always a personal data breach, and notification assessments must retain their distinct criteria, roles and channels. The work may organize facts, timelines and documents for the controller, the DPO where appointed, and the responsible advisers.

References: GDPR1.

Software, devices and products with digital elements

For SMEs manufacturing products with digital elements, the Cyber Resilience Act creates a different pathway from that of businesses simply using software: relevant manufacturers’ reporting duties for actively exploited vulnerabilities and severe incidents affecting product security have applied since September 11, 2026, while the main obligations apply from December 11, 2027. Documentary preparation may establish responsibilities, reporting channels and component dependencies, with technical checks and conformity assessments assigned to the competent parties.

References: CRA1, CRA2.

Connect documentation to decisions

The analysis starts with the services and processes that the business needs to keep available, establishing who governs the associated risks, which suppliers support them and which documents describe the controls. Policies, contracts, inventories, escalation procedures and records are examined within the agreed scope, separating what a document states from what the available evidence can support.

Where operations depend on cloud services, a maintenance provider’s remote access or an AI agent using company tools, the review considers how that dependency could transmit an interruption, delay a decision or leave the reconstruction of an incident incomplete. Regulatory readiness becomes operationally useful when each gap is associated with an owner, a verification step and an expected outcome.

The cyber geopolitical assessment also considers service locations, relevant jurisdictions, supplier concentration and documented alternatives where these may affect continuity, access to data or the reversibility of a decision. Managing the same supplier across several regimes allows relevant inventories and evidence to be reused, while keeping the assessment of thresholds, deadlines and responsibilities separate.

What the business receives

An engagement may include a preliminary applicability matrix recording activities, sources and questions requiring validation; an overview of documentary and organizational gaps; a map of critical dependencies and customer requirements; and an action plan assigning priorities, owners and evidence to produce. Deliverables are specified in the proposal so that the client can see which decisions the work is intended to support.

Incident preparedness may cover reporting handoffs, information availability and escalation responsibilities; AI work may map use cases, delegated authority, oversight and context-specific training needs. Technical system testing, forensic acquisition and the implementation of controls require a separate scope agreed with the responsible functions or professionals.

A customer request does not determine the legal scope

Consider an illustrative case in which an SME receives a digital resilience questionnaire from a financial-sector customer while introducing an AI assistant into its own processes. The first assessment concerns the role of the supplied services and the contractual request; the second concerns the actual AI use cases, the data involved and the decisions that the system may influence. Keeping these assessments separate prevents a commercial response from becoming an unsupported conclusion about the applicability of legislation.

The intended result is a basis on which management can respond with verifiable information, identify gaps and assign the necessary work, while legal assessments and technical verification remain with the responsible specialists. This example describes a method and does not represent an existing client or a past result.

Define an engagement proportionate to the SME

For an initial discussion, provide the sector, approximate size, type of service or product, the request received and any deadline, without sending confidential documents. The objective, participants, materials, deliverables and timing are then agreed so that the advisory work can support management and the relevant IT, security, legal and privacy functions.

The service comprises analysis, review and organizational preparation within the agreed engagement; it does not issue a compliance certification or replace the legal assessment or technical controls that the case requires. Any involvement of other specialists and any additional activities are specified in the proposal.

Discuss your requirements →