EU Compliance Directives & National Transpositions

eu-compliance-directives

Curated index of official EU and national (member state) compliance sources, including directives, transposition laws, and regulatory guidance. ACTIVATE when answering questions about EU regulations or national implementations (NIS2, GDPR, DORA, AI Act, Cyberbeveiligingswet, etc.) — especially di...

eyesecurity/skills·0installs11stars

SKILL.md

Full skill instructions

EU Compliance Directives & National Transpositions

Don't hardcode compliance facts that change. Look them up. EU directives become national law differently in each member state — always check both levels.

Key concept: directives vs regulations

Type	What it means	Example
Regulation	Directly applicable in all member states. No transposition needed.	GDPR, DORA, AI Act
Directive	Must be transposed into national law. Each country may implement differently.	NIS2 → Cyberbeveiligingswet (NL), NIS2UmsuCG (DE), etc.

When a user asks about a directive, always consider both the EU-level text AND the national transposition. They can differ on scope, penalties, and sector definitions.

Source index

EU-level sources

ECSO NIS2 Transposition Tracker

URL: https://ecs-org.eu/activities/nis2-transposition-tracker/
Maintainer: European Cyber Security Organisation
Reliability: HIGH
Use for: Per-country transposition status, timeline, national legislation links
Limitations: May lag behind official notifications by days

EC Digital Strategy

URL: https://digital-strategy.ec.europa.eu/en/policies/nis-transposition
Maintainer: European Commission
Reliability: HIGH
Use for: Official notification status per member state
Limitations: Less detail than ECSO tracker

EUR-Lex

URL: https://eur-lex.europa.eu
Maintainer: Publications Office of the EU
Reliability: HIGH (authoritative)
Key URLs:
- NIS2: https://eur-lex.europa.eu/eli/dir/2022/2555
- GDPR: https://eur-lex.europa.eu/eli/reg/2016/679
- DORA: https://eur-lex.europa.eu/eli/reg/2022/2554
- AI Act: https://eur-lex.europa.eu/eli/reg/2024/1689
Use for: Full legislative text, recitals, annexes, transposition notices

ENISA Technical Guidance

URL: https://www.enisa.europa.eu/publications
Maintainer: EU Agency for Cybersecurity
Reliability: HIGH
Use for: Practical implementation guidance for NIS2 Art. 21, risk management, incident reporting
Limitations: Guidance, not binding

ENISA NIS2 Technical Implementation Guidance (June 2025, v1.0)

URL: https://www.enisa.europa.eu/publications/nis2-technical-implementation-guidance
PDF: https://www.enisa.europa.eu/sites/default/files/2025-06/ENISA_Technical_implementation_guidance_on_cybersecurity_risk_management_measures_version_1.0.pdf
Reliability: HIGH
Use for: Per-requirement guidance and auditor-accepted evidence examples for all 13 NIS2 Art. 21(2) domains
Scope: Legally binds ICT-type entities only (DNS, TLDs, cloud, data centres, CDN, MSPs/MSSPs, online platforms, trust services). Useful reference for all NIS2 entities

EU ICT Supply Chain Security Toolbox (NIS Cooperation Group, Jan 2026)

URL: https://digital-strategy.ec.europa.eu/en/library/toolbox-improve-ict-supply-chain-security
Maintainer: NIS Cooperation Group (Member States + Commission + ENISA)
Reliability: HIGH
Use for: 11 ICT supply chain risk scenarios + 7 recommendations (R01-R07) supporting NIS2 Art. 21(2)(d)

EDPB Guidelines (GDPR)

URL: https://edpb.europa.eu/our-work-tools/general-guidance/guidelines-recommendations-best-practices_en
Maintainer: European Data Protection Board
Reliability: HIGH
Use for: GDPR interpretation, cross-border enforcement, binding decisions
Supervisory authorities: https://edpb.europa.eu/about-edpb/about-edpb/members_en

EU AI Office

URL: https://digital-strategy.ec.europa.eu/en/policies/ai-office
Maintainer: European Commission
Reliability: HIGH
Use for: AI Act implementation timeline, codes of practice, high-risk classification
Phased entry: Feb 2025 (prohibited) → Aug 2025 (GPAI) → Aug 2026 (high-risk Annex III) → Aug 2027 (Annex I)

ESA Guidance (DORA)

Maintainer: EBA, EIOPA, ESMA (jointly)
Use for: DORA regulatory technical standards (RTS), implementing technical standards (ITS)
In force: January 2025

National sources

Netherlands

Source	URL	Use for
Cyberbeveiligingswet (Cbw)	wetten.overheid.nl	NIS2 transposition — Dutch national law
NCSC-NL	ncsc.nl	Guidance, self-assessment, incident reporting
Autoriteit Persoonsgegevens	autoriteitpersoonsgegevens.nl	GDPR supervision, breach reporting

Germany

Source	URL	Use for
NIS2UmsuCG	bsi.bund.de	NIS2 transposition — German national law
BSI IT-Grundschutz	bsi.bund.de	Baseline protection catalogue, KRITIS
OpenKRITIS	openkritis.de	Community resource for KRITIS implementation

Belgium

Source	URL	Use for
CCB CyFun	ccb.belgium.be	Belgian Cybersecurity Framework, NIS2 mapping
Centre for Cybersecurity Belgium	ccb.belgium.be	National authority, guidance

Bird & Bird NIS2 Tracker (multi-country)

URL: https://www.twobirds.com/en/insights/2023/global/nis2-tracker
Reliability: MEDIUM (commercial, law firm)
Use for: Quick visual overview of transposition status across all EU countries

EU_compliance_MCP — pre-indexed regulation database

Install: npx @ansvar/eu-regulations-mcp or add as MCP server
Source: https://github.com/Ansvar-Systems/EU_compliance_MCP
Reliability: HIGH (sourced from EUR-Lex)
Coverage: 49 EU regulations, 2,500+ articles, 1,200+ definitions, full-text search
Use for: Instant article/recital retrieval, cross-regulation comparison, control mappings
When available: Prefer over web lookups for article text — faster and offline-capable

Agent lookup workflow

For EU-level questions (regulations, general obligations)

EUR-Lex — authoritative legislative text
ENISA / EDPB / ESA — practical guidance per regulation
EU_compliance_MCP — if available, use for instant article lookup and cross-regulation comparison
Always include a freshness warning — compliance status changes

For national implementation questions (transposition, local differences)

ECSO tracker — which countries have transposed, links to national laws
National source — check the specific country's authority (NCSC-NL, BSI, CCB, etc.)
Cross-reference EUR-Lex — compare directive text with national implementation
Flag differences — explicitly tell the user where national law adds to or differs from the EU directive

For comparative questions ("how does X differ from Y")

Identify both sources (EU directive + national law, or two national laws)
Use EUR-Lex for the EU baseline
Use national sources for local specifics
Present a clear comparison: what's the same, what differs, what's stricter

Agent instructions

Never state transposition status or legal facts from memory — always direct the user to check the source.
Use the lookup workflow above to guide which source to check first.
Include the source URL and a freshness warning in every response.
If a user needs country-specific detail, check the ECSO tracker and the relevant national authority.
For practical "how to comply" questions, point to ENISA guidance (NIS2), EDPB guidelines (GDPR), or ESA standards (DORA).
For legal text, point to EUR-Lex.
When comparing EU directive vs national law, always flag where the national implementation is stricter or broader than the directive minimum.
If the user's org profile includes a jurisdiction, prioritise sources for that country.

Install skill

Copy and run in your terminal

npx -y skills add https://github.com/eyesecurity/skills --skill eu-compliance-directives

View on GitHub

plugins/complisec/skills/eu-compliance-directives/SKILL.md

org-profile
ACTIVATE when the user wants to create or update their organisation's compliance profile, or invokes /org-profile setup. Runs a questionnaire to capture identity, critical assets, data residency, risk appetite, suppliers, and legal obligations — outputs a compact profile for enforcement.
0 installs
compliance-hub
ACTIVATE when the user asks about centralising compliance records, log collection, audit trail persistence, log retention, SIEM integration, or agent observability. Central collection point for all complisec output: audit logs, incident records, change records, and vendor assessments. Configures ...
0 installs
incident-management
ACTIVATE when a security incident, data breach, outage, or suspicious event is reported, discussed, or detected. Guides structured incident documentation through the full lifecycle: detection → triage → response → notification → recovery → lessons learned. Ensures NIS2 24/72h/30d notification dea...
0 installs
audit-logging
ACTIVATE on ANY request that involves writing, generating, reviewing, modifying, or outputting source code in any programming language — Python, JavaScript, TypeScript, Go, Java, Rust, C#, SQL, Terraform, or any other. This includes functions, endpoints, scripts, migrations, infrastructure-as-cod...
0 installs

More skills from eyesecurity

eyesecurity/skills

vendor-risk

ACTIVATE when integrating a new service, API, SaaS tool, SDK, npm/pip/maven package, Docker image, or any third-party dependency — or when discussing suppliers, vendors, processor agreements, or supply chain security. Also activate on imports from unknown packages or adding external webhooks/endp...

11 0

View

eyesecurity/skills

change-management

ACTIVATE when making changes that affect critical assets: deployments, database migrations, schema changes, Terraform/IaC modifications, access control or IAM changes, firewall rules, TLS certificates, environment variables on production, or dependency upgrades. Ensures every change is documented...

11 0

View

eyesecurity/skills

risk-assessment-writer

ACTIVATE when the user asks to write, create, draft, or generate a risk assessment, risk entry, risk evaluation, or threat/vulnerability description — or when the user describes a threat, vulnerability, weakness, new business activity, or scenario they want risk-assessed. Covers information secur...

11 0

View

eyesecurity/skills

complisec

EU compliance enforcement for AI agents — NIS2, GDPR, ISO 27001. ACTIVATE on EVERY prompt. Reads .compliance/profile.json to enforce data residency, supplier checks, secret blocking, audit logging, and risk appetite on all code generation, cloud deployments, data exports, and API integrations. In...

11 0

View

eyesecurity/skills

nis2-gap-analysis

ACTIVATE when the user asks about NIS2, Cyberbeveiligingswet (Cbw), NIS2 applicability, NIS2 gap analysis, or NIS2 compliance assessment. Interview-driven gap analysis with 5-level maturity scoring field-tested by security consultants.

11 0

View

eyesecurity/skills

data-sensitivity

ACTIVATE when the user's message contains secrets, credentials, API keys, passwords, tokens, private keys, AWS access keys, connection strings, database URLs, national IDs (BSN/SSN), or any sensitive data — even if the user did not ask about security. Also activate when asked to classify data, sc...

11 0

View

eyesecurity/skills

security-compliance-tools

ACTIVATE when the user asks about compliance tooling, risk assessment methods, critical assets (crown jewels), or how to assess their organisation's security posture for EU regulations (NIS2, GDPR, ISO 27001). Curated index of tools and methodologies that support EU compliance — not generic AppSe...

11 0

View