EU Regulatory Estate

If you are in scope for DORA or NIS2, the AI Act is not a separate programme. It is the next set of obligations landing on the same systems, the same suppliers and the same governance body.

DORA & NIS2 Readiness Workbook — operational resilience, ICT third-party risk, the register of information, incident classification and reporting, testing, and the management-body accountability both regimes impose.

EU AI Act Compliance Clock — role and risk per AI system, the date that binds each one, the Article 50 duties live since 2 August 2026, the deployer duties register, the provider conformity roadmap and the US state overlay.

Why the pair. DORA Article 5 and NIS2 Article 20 make the management body liable and require training; AI Act Articles 14 and 26 add human oversight and deployer duties on top of the same people. Your critical ICT third parties under DORA are, increasingly, the AI vendors you must classify under the Act. And an incident in an AI system that supports a critical function is reportable under DORA or NIS2 and potentially under the Act's serious-incident duty — different triggers, different recipients, same event. Assessed separately, these produce two registers that disagree about the same suppliers.

20% off, not the usual 25%. The DORA/NIS2 workbook is several times the price of the Clock, and at 25% this pack would cost one dollar less than that workbook alone at the vCISO tier — a bundle that undercuts its own largest component. 20% is the largest discount that keeps the arithmetic honest at all three tiers, and it still takes $69 to $179 off.