Eu compliance directives
Skill eyesecurity/skills/plugins/complisec/skills/eu-compliance-directives
EU compliance enforcement for AI agents. Org-profile-driven guardrails for NIS2, GDPR & ISO 27001 — blocks secrets, flags critical asset impact, enforces data residency, verifies suppliers, tracks incidents with automated deadlines.
npx -y skills add eyesecurity/skills --skill eu-compliance-directivesAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
One thing to look at
- 7 stars7 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
What its author says it does
Copied from the file, not written here
Curated index of official EU and national (member state) compliance sources, including directives, transposition laws, and regulatory guidance. ACTIVATE when answering questions about EU regulations or national implementations (NIS2, GDPR, DORA, AI Act, Cyberbeveiligingswet, etc.) — especially differences between EU directives and local laws, applicability, enforcement, timelines, or legal obligations. Also activate for conceptual or comparative questions ("what changed", "how does NL differ from the EU directive"). Always verify current legal status and ground answers in authoritative sources instead of relying on general knowledge.
SKILL.md
8.2 KB, as published. Nobody here has run it
EU Compliance Directives & National Transpositions
Don't hardcode compliance facts that change. Look them up. EU directives become national law differently in each member state — always check both levels.
Key concept: directives vs regulations
| Type | What it means | Example |
|---|---|---|
| Regulation | Directly applicable in all member states. No transposition needed. | GDPR, DORA, AI Act |
| Directive | Must be transposed into national law. Each country may implement differently. | NIS2 → Cyberbeveiligingswet (NL), NIS2UmsuCG (DE), etc. |
When a user asks about a directive, always consider both the EU-level text AND the national transposition. They can differ on scope, penalties, and sector definitions.
Source index
EU-level sources
ECSO NIS2 Transposition Tracker
- URL: https://ecs-org.eu/activities/nis2-transposition-tracker/
- Maintainer: European Cyber Security Organisation
- Reliability: HIGH
- Use for: Per-country transposition status, timeline, national legislation links
- Limitations: May lag behind official notifications by days
EC Digital Strategy
- URL: https://digital-strategy.ec.europa.eu/en/policies/nis-transposition
- Maintainer: European Commission
- Reliability: HIGH
- Use for: Official notification status per member state
- Limitations: Less detail than ECSO tracker
EUR-Lex
- URL: https://eur-lex.europa.eu
- Maintainer: Publications Office of the EU
- Reliability: HIGH (authoritative)
- Key URLs:
- Use for: Full legislative text, recitals, annexes, transposition notices
ENISA Technical Guidance
- URL: https://www.enisa.europa.eu/publications
- Maintainer: EU Agency for Cybersecurity
- Reliability: HIGH
- Use for: Practical implementation guidance for NIS2 Art. 21, risk management, incident reporting
- Limitations: Guidance, not binding
ENISA NIS2 Technical Implementation Guidance (June 2025, v1.0)
- URL: https://www.enisa.europa.eu/publications/nis2-technical-implementation-guidance
- PDF: https://www.enisa.europa.eu/sites/default/files/2025-06/ENISA_Technical_implementation_guidance_on_cybersecurity_risk_management_measures_version_1.0.pdf
- Reliability: HIGH
- Use for: Per-requirement guidance and auditor-accepted evidence examples for all 13 NIS2 Art. 21(2) domains
- Scope: Legally binds ICT-type entities only (DNS, TLDs, cloud, data centres, CDN, MSPs/MSSPs, online platforms, trust services). Useful reference for all NIS2 entities
EU ICT Supply Chain Security Toolbox (NIS Cooperation Group, Jan 2026)
- URL: https://digital-strategy.ec.europa.eu/en/library/toolbox-improve-ict-supply-chain-security
- Maintainer: NIS Cooperation Group (Member States + Commission + ENISA)
- Reliability: HIGH
- Use for: 11 ICT supply chain risk scenarios + 7 recommendations (R01-R07) supporting NIS2 Art. 21(2)(d)
EDPB Guidelines (GDPR)
- URL: https://edpb.europa.eu/our-work-tools/general-guidance/guidelines-recommendations-best-practices_en
- Maintainer: European Data Protection Board
- Reliability: HIGH
- Use for: GDPR interpretation, cross-border enforcement, binding decisions
- Supervisory authorities: https://edpb.europa.eu/about-edpb/about-edpb/members_en
EU AI Office
- URL: https://digital-strategy.ec.europa.eu/en/policies/ai-office
- Maintainer: European Commission
- Reliability: HIGH
- Use for: AI Act implementation timeline, codes of practice, high-risk classification
- Phased entry: Feb 2025 (prohibited) → Aug 2025 (GPAI) → Aug 2026 (high-risk Annex III) → Aug 2027 (Annex I)
ESA Guidance (DORA)
- Maintainer: EBA, EIOPA, ESMA (jointly)
- Use for: DORA regulatory technical standards (RTS), implementing technical standards (ITS)
- In force: January 2025
National sources
Netherlands
| Source | URL | Use for |
|---|---|---|
| Cyberbeveiligingswet (Cbw) | wetten.overheid.nl | NIS2 transposition — Dutch national law |
| NCSC-NL | ncsc.nl | Guidance, self-assessment, incident reporting |
| Autoriteit Persoonsgegevens | autoriteitpersoonsgegevens.nl | GDPR supervision, breach reporting |
Germany
| Source | URL | Use for |
|---|---|---|
| NIS2UmsuCG | bsi.bund.de | NIS2 transposition — German national law |
| BSI IT-Grundschutz | bsi.bund.de | Baseline protection catalogue, KRITIS |
| OpenKRITIS | openkritis.de | Community resource for KRITIS implementation |
Belgium
| Source | URL | Use for |
|---|---|---|
| CCB CyFun | ccb.belgium.be | Belgian Cybersecurity Framework, NIS2 mapping |
| Centre for Cybersecurity Belgium | ccb.belgium.be | National authority, guidance |
Bird & Bird NIS2 Tracker (multi-country)
- URL: https://www.twobirds.com/en/insights/2023/global/nis2-tracker
- Reliability: MEDIUM (commercial, law firm)
- Use for: Quick visual overview of transposition status across all EU countries
EU_compliance_MCP — pre-indexed regulation database
- Install:
npx @ansvar/eu-regulations-mcpor add as MCP server - Source: https://github.com/Ansvar-Systems/EU_compliance_MCP
- Reliability: HIGH (sourced from EUR-Lex)
- Coverage: 49 EU regulations, 2,500+ articles, 1,200+ definitions, full-text search
- Use for: Instant article/recital retrieval, cross-regulation comparison, control mappings
- When available: Prefer over web lookups for article text — faster and offline-capable
Agent lookup workflow
For EU-level questions (regulations, general obligations)
- EUR-Lex — authoritative legislative text
- ENISA / EDPB / ESA — practical guidance per regulation
- EU_compliance_MCP — if available, use for instant article lookup and cross-regulation comparison
- Always include a freshness warning — compliance status changes
For national implementation questions (transposition, local differences)
- ECSO tracker — which countries have transposed, links to national laws
- National source — check the specific country's authority (NCSC-NL, BSI, CCB, etc.)
- Cross-reference EUR-Lex — compare directive text with national implementation
- Flag differences — explicitly tell the user where national law adds to or differs from the EU directive
For comparative questions ("how does X differ from Y")
- Identify both sources (EU directive + national law, or two national laws)
- Use EUR-Lex for the EU baseline
- Use national sources for local specifics
- Present a clear comparison: what's the same, what differs, what's stricter
Agent instructions
- Never state transposition status or legal facts from memory — always direct the user to check the source.
- Use the lookup workflow above to guide which source to check first.
- Include the source URL and a freshness warning in every response.
- If a user needs country-specific detail, check the ECSO tracker and the relevant national authority.
- For practical "how to comply" questions, point to ENISA guidance (NIS2), EDPB guidelines (GDPR), or ESA standards (DORA).
- For legal text, point to EUR-Lex.
- When comparing EU directive vs national law, always flag where the national implementation is stricter or broader than the directive minimum.
- If the user's org profile includes a jurisdiction, prioritise sources for that country.