Framework map · Use-case mapping · 4-week sprint methodology
NIS2 has been in force since October 2024, DORA since January 2025, the EU AI Act rolls out in phases through 2027, and the EU Data Act adds further obligations from September 2025 onward. On top of that, ISO 27001 has become the de-facto trust layer in B2B sales. This 60-minute webinar gives an honest map of the major compliance regimes for the DACH mid-market — who needs what, in which order, and how we translate that into our productized 4-week sprint methodology together with our GRC partners Vanta and Kertos.
We frame the three dominant compliance regimes against your business reality: sales, sector obligation, and AI product. Per regime: scope, honest use case, typical trigger in the mid-market.
Voluntary, but de-facto mandatory in enterprise sales and supply chains. When the sprint pays off: recurring vendor security questionnaires, before pitches to enterprise customers, and ahead of institutional funding rounds.
In force since October 2024. Covers "essential" and "important" entities from 50 employees across 18 sectors. Personal liability of management — risk management, incident reporting, supply-chain security.
AI Act in phases: prohibited practices since February 2025, general-purpose AI from August 2026, high-risk systems from August 2027. Data Act: data access and portability obligations from September 2025. Relevant to anyone shipping AI components or connected devices.
Sources for the legal framing: BSI (NIS2 implementation act), ENISA (NIS2 technical guidance), European Commission (AI Act, Data Act). We provide orientation — not legal advice. Concrete mandates are aligned with our partner law firms.
The detailed agenda is shared in the confirmation email before the session. Planned sections:
Founder, Woodlands Advisory GmbH
SAP Global Security Advisory Lead
Attendance is limited to verified decision-makers across executive, IT, compliance and finance functions. We confirm requests within 24 hours with the Google Meet joining link.
Many clients combine multiple services – for maximum impact.
Whether you face a transaction, need a certification or want to professionalise your security strategy – Woodlands delivers results in weeks, not months.
20 minutes. Confidential. No obligation.
