Regulation as Constraint: DORA, NIS 2, CER, the AI Act, the GDPR and the Data Act

All courses / AI Operations / Module 5 / Chapter 23

Learning objectives

After the lesson the participant can:

Identify which instruments apply to an organisation and which displace others, as the chapter sets out for the two examples
Map a duty from an instrument to the operations function, the control and the evidence artefact that meets it
Explain why the autonomy budget is a design choice and not a legal requirement
Draft a regulation-to-control mapping row with text date, owner, verifier, evidence and status

Key concepts

Regulation as outcomes: The instruments do not describe an operations loop. They state what must be shown: services that continue, incidents recorded and reported within hours, tested recovery, providers that can be left, and a management body that answers for it.
DORA displaces NIS 2 for financial entities: DORA binds Hansa Mutual's EU entities as an insurance undertaking and, as lex specialis, displaces NIS 2 for them; the chapter cites NIS 2 Article 4(1) and the German and Swedish national provisions. DORA does not apply to Nordvik Region.
Mapping record: A file in version control, the RCM record, with one row per duty: the instrument and article, the duty in the words of the text, the function, the control, the evidence, a named owner and verifier, a text date and a status. A failed test appears as a failed row.
One control serves many instruments: The book's own conclusion that a mapping which starts from the control and its evidence, with an owner and an age, answers a supervisor better than a list of articles, because the same restore test or incident record meets several duties.
Staff rights before the tool: Working-time rules, information and consultation, and co-determination decide how rotas, tools that log engineers' commands and metrics about engineers may be introduced. Agreements govern a class of change and are concluded before the tool is switched on.

Interactive exercises

Do them here and get feedback at once. Choose a card and then where it belongs, or drag it.

Interactive exercise 1 · Match

DORA articles on ICT risk management

Match each DORA article with what it asks in summary, as the chapter's table states. This is an organisational reading and not legal advice.

Interactive exercise 2 · Sort

Which regime reaches which organisation

Sort each regime by the organisation it applies to in the chapter's scope table, at the start of the book.

Teaching plan

15 min	The teacher explains how to read the mapping and presents the scope table for Hansa Mutual and Nordvik Region, framed throughout as organisational implications and not legal advice.
25 min	Guided reading of the DORA table for Articles 5 to 12 and the NIS 2 Article 21(2) table: for each row participants name the function and the artefact from earlier modules.
15 min	Input on the AI Act articles that reach operations, the GDPR and the Data Act, and the table of operations measures that trigger staff rights.
35 min	Exercise: participants turn three articles into controls with owners and evidence.
15 min	Debrief on the table across the degrees of delegation: what the instruments add to the ceiling of each action class.

Discussion

The instruments set no levels of autonomy for operations actions. What, then, would you show a supervisor who asks why an agent was allowed to restart a critical service on its own?
A mapping row for a tested-recovery duty reads failed. Why is it better to show that row to a supervisor than to leave the row out until the re-test passes?
Which operations measure in your organisation would trigger consultation or co-determination, and has the agreement been concluded before the tool was switched on?

Written exercise

Exercise · 35 minutes

From article to control, owner and evidence

Choose three duties from the chapter's tables that apply to your organisation or to one of the two examples, for instance DORA Article 9(4)(e) on change management, NIS 2 Article 21(2)(c) on business continuity and AI Act Article 26(2) on human oversight. For each, read the live text and record the date you read it. Write the duty in the words of the text, the operations function, the control you already have, the evidence artefact with its date and result, a named owner and a verifier who is independent of the owner, and the status. Where the evidence is missing or failed, say so in the row.

Deliverable: Three mapping rows with text date, duty, function, control, dated evidence, owner, independent verifier and an honest status.

Your work

Self-test

Choose an answer to see whether it is right, or open the answer below each question.

What does the chapter conclude about the legal status of the autonomy budget of Chapter 4?
Show the answer
B. It is a design that makes the required outcomes demonstrable when an agent acts, not a legal requirement
The instruments do not set levels of autonomy for operations actions, with the exceptions of AI Act Article 14 and GDPR Article 22. The budget is the book's design for showing the outcomes the instruments ask for.
Which point of NIS 2 Article 21(2) does the chapter say matters most for the book's thesis, and why?
Show the answer
D. Point (f), because assessing the effectiveness of measures is what a restore-test record does
Point (f) asks for policies and procedures to assess the effectiveness of the measures. A restore-test record is that assessment for point (c), which is the thesis that resilience is a claim needing evidence.
How do both organisations treat an agent that would allocate on-call duty or score people?
Show the answer
A. It is kept at Level 0 or 1, with agreement or negotiation first
The staff-rights table cites AI Act Annex III point 4(b) with Article 26(7) and GDPR Article 22 for this measure. Hansa Mutual keeps it at Level 0 or 1 with agreement first, and Nordvik Region with negotiation first.