Cybersecurity legal-AI skills in 🇪🇺 European Union

15 legal AI skills for cybersecurity in European Union.

DORA — Digital Operational Resilience Act Skill

MITEuropean UnionCybersecurity

Expert DORA (Regulation (EU) 2022/2554 — Digital Operational Resilience Act) compliance advisor for EU financial entities. Use this skill whenever a user asks about DORA compliance, ICT risk management frameworks, ICT incident classification or reporting, threat-led penetration testing (TLPT), ICT third-party risk management, Register of Information, contractual provisions with ICT providers, ICT concentration risk, oversight of critical ICT third-party service providers (CTPPs), or any DORA RTS/ITS obligation. Also trigger for: "DORA gap analysis", "DORA readiness", "Art. 6 ICT risk framework", "Art. 17 incident reporting", "Art. 26 TLPT", "Art. 28 third-party policy", "Art. 30 contractual provisions", "Register of Information CIR 2024/2956", "critical TPSP designation", "DORA vs NIS2", "DORA simplified framework", or EBA/ESMA/EIOPA digital resilience guidance.

DORA Expert

MITEuropean UnionCybersecurity

DORA expert for EU financial entities. Deep knowledge of Digital Operational Resilience Act including 5 pillars, ICT risk management, incident reporting, resilience testing, third-party oversight, and information sharing for financial sector digital resilience.

DORA-IKT-Vertragsprüfung

Apache-2.0European UnionCybersecurity

Für DORA-IKT-Vertragsprüfung: ordnet Norm, Beweislast und Gegenargument; Ergebnis: Tatbestands- oder Anspruchsmatrix.

EU Cyber Resilience Act (CRA) Skill

MITEuropean UnionCybersecurity

Expert EU Cyber Resilience Act (CRA) advisor for Regulation (EU) 2024/2847 — mandatory cybersecurity and vulnerability handling requirements for all products with digital elements (PDEs) sold in the EU. Use this skill for gap analysis, product classification (Default / Class I / Class II), conformity assessment route selection, CE marking, SBOM requirements, vulnerability and incident reporting to ENISA/CSIRTs, support period obligations, and manufacturer/importer/distributor duties. Trigger for EU CRA, Cyber Resilience Act, PDE compliance, Annex I requirements, SBOM EU, CE marking cybersecurity, or connected product security EU.

EU NIS2 Compliance

MITEuropean UnionCybersecurity

Implement NIS2 Directive (2022/2555) cybersecurity obligations for essential and important entities — risk management, incident reporting, supply chain security.

EU NIS2 Directive Expert

MITEuropean UnionCybersecurity

EU NIS2 Directive (Directive (EU) 2022/2555) expert. Reference-depth knowledge of essential vs important entity classification, Article 20 governance, the Article 21 ten cybersecurity risk-management measures, the Article 23 24h/72h/1mo incident-reporting timeline, and supervision/enforcement under Articles 32-34. SCF-backed gap assessment via the crosswalk.

Incident Response

MITEuropean UnionCybersecurity

One incident, several regulators, different clocks — build the runbook that computes GDPR, NIS2, CRA and DORA deadlines from a single awareness timestamp

NIS2 Compliance Triage EN - scope and obligations navigator (Directive (EU) 2022/2555)

MITEuropean UnionCybersecurity

NIS2 scope and obligations triage (Directive (EU) 2022/2555) in English - a scope navigator: is the entity in scope at all (Annex I and II sectors, size-cap rule, size-independent exceptions), essential vs important entity, map of the 10 risk-management measures under Art. 21(2), incident reporting clock under Art. 23 (24h -> 72h -> 1 month), management body duties under Art. 20, penalty ceilings. NIS2 is a directive: obligations bite through NATIONAL transposition, and transpositions differ per member state - so the skill puts the transposition question first and marks it for checking against the national source before anything is relied on. It has no connector of its own and does not confirm transposition status. Output: a NIS2 card for human decision. Use when: "does NIS2 apply to us", "essential or important entity", "the 10 measures of Art. 21", "NIS2 incident reporting", "management board cybersecurity duties", "NIS2 fines", "national transposition of NIS2".

NIS2 Directive Compliance Advisor

MITEuropean UnionCybersecurity

EU NIS2 Directive (Directive (EU) 2022/2555) compliance advisor for essential and important entities: entity classification, Art. 21 risk management measures, Art. 23 incident reporting timelines (24h/72h/1 month), Art. 20 governance obligations, supply chain security (Art. 21(2)(d); coordinated risk assessments Art. 22), gap assessments, policy drafting, ISO 27001 alignment, and penalty exposure analysis. Also covers Commission Implementing Regulation (EU) 2024/2690, the technical/methodological sub-requirements for Art. 21(2) and the significant-incident thresholds binding on DNS/cloud/data-centre/MSP/MSSP/trust-service and other digital entities. Use for NIS2 readiness, transposition questions, ENISA technical implementation guidance, significant-incident thresholds, supervisory differences between essential and important entities, and cross-border coordination.

NIS2 Radar

MITEuropean UnionCybersecurity

Détermine si une entité est concernée par la directive NIS2 en croisant son code NAF, son effectif et son CA avec la table de périmètre NIS2. Utiliser quand l'utilisateur demande si une entreprise est soumise à NIS2.

NIS2 Readiness

MITEuropean UnionCybersecurity

Decide whether NIS2 catches the entity under national law, then work the ten Art. 21(2) measures and the 24h/72h/one-month reporting path

TPRM — Third-Party Risk Management Skill

MITEuropean UnionCybersecurity

Expert third-party risk management (TPRM) advisor — a vendor risk analyst for the full lifecycle: risk-based vendor tiering, tailored due-diligence questionnaires (SIG-style or mapped to ISO 27001, SOC 2, DORA, NIS2, HIPAA), SOC 2 Type II report review (exceptions, carve-outs, CUECs, bridge letters), DPA and sub-processor review under GDPR Art. 28, contract security addenda (DORA Art. 30 provisions), ongoing monitoring programmes, and vendor offboarding. Use this skill whenever a user mentions vendor risk, supplier due diligence, third-party assessments, security questionnaires, reviewing a vendor's SOC 2 report, vendor tiering, fourth parties or sub-processors, supply chain security requirements, DORA ICT third-party rules, business associate agreements, or exit/termination of a vendor. Also trigger for 'a customer sent us a questionnaire' and 'how do I assess this vendor' style requests.

User Input

MITEuropean UnionCybersecurity

[COMMUNITY] Assess NIS2 Directive compliance obligations for EU member state operators of essential services and important entities

User Input

MITEuropean UnionCybersecurity

[COMMUNITY] Assess DORA (Digital Operational Resilience Act, EU 2022/2554) compliance for financial sector entities operating in the EU

User Input

MITEuropean UnionCybersecurity

[COMMUNITY] Assess EU Cyber Resilience Act (CRA, Regulation 2024/2847) compliance obligations for products with digital elements placed on the EU market