EU AI Act, NIS2 and the Data Act: a guide for AI operators

If you run GPUs, data centres or an inference service in Europe, three laws now set much of your compliance agenda: the AI Act, the NIS2 Directive and the Data Act. They were written by different teams for different purposes. For an operator, though, they ask for the same three things: know what your systems are doing, be able to show it, and do not trap your customers.

This guide gives the dates as they stand in October 2026, after the Digital Omnibus on AI changed the AI Act's timetable. It also covers the obligations that actually reach infrastructure operators and the evidence that is cheapest to produce from the start. It is not legal advice. Your role under each law depends on facts only you and your counsel can assess.

The AI Act timetable changed in July 2026

The AI Act (Regulation (EU) 2024/1689) entered into force on 1 August 2024. Its prohibitions and its AI literacy provision have applied since 2 February 2025. Governance rules and the obligations for providers of general-purpose AI (GPAI) models have applied since 2 August 2025, according to the European Commission's timeline.

The Digital Omnibus on AI, Regulation (EU) 2026/1744, entered into force on 27 July 2026 and moved the high-risk dates:

The GPAI dates come from the Commission's guidelines page for GPAI providers. One date did not move: transparency obligations under Article 50 have applied since August 2026.

What the AI Act asks of infrastructure

The AI Act assigns duties by role: provider, deployer, importer, distributor. Selling GPU hours does not by itself make you the provider of an AI system. Your role changes when you do more than sell capacity. If you serve a model under your own name, wrap it in a product, or substantially modify it, you may become a provider of an AI system or a GPAI model, with the duties that follow.

Two duties reach most inference services in practice. The first is Article 50 transparency. People must be told when they are interacting with an AI system, and providers of systems that generate synthetic audio, image, video or text must mark outputs in a machine-readable format so they can be detected as AI-generated. The second is the GPAI chain. Model providers must give documentation to the downstream providers who build on their models. If you serve open-weight models, the licence and documentation you receive from the model builder are part of your records, not an afterthought.

The practical move is to make provenance part of every response: a signed record of which model, weights and machine produced it.

NIS2 already applies, and data centres are in scope

NIS2 (Directive (EU) 2022/2555) had a transposition deadline of 17 October 2024 and repealed the original NIS Directive from 18 October 2024, as the Commission's NIS2 page sets out. It covers 18 sectors, generally for medium and large entities. Digital infrastructure is one of them, and for data centre service providers, cloud computing service providers and several other digital entities, the Commission set the security requirements in Implementing Regulation (EU) 2024/2690 of 17 October 2024. ENISA's technical implementation guidance, published in June 2025, gives indicative evidence for each requirement. It is not binding, but national authorities are expected to take it into account.

Three provisions matter most day to day:

• Incident reporting (Article 23). For a significant incident, an early warning goes to the CSIRT or competent authority within 24 hours of becoming aware of it. An incident notification with an initial assessment follows within 72 hours, and a final report no later than one month after that notification.
• Management accountability. Management bodies approve cybersecurity risk-management measures and can be held liable for failures.
• Fines (Article 34). Member States must provide for maximum fines of at least EUR 10 million or 2% of worldwide annual turnover for essential entities, and at least EUR 7 million or 1.4% for important entities, whichever is higher.

NIS2 is also changing. On 20 January 2026 the Commission proposed targeted amendments aimed at clarity and simpler compliance. Track that file, but do not plan on it relieving the obligations above.

The 24-hour clock is the operational test. You cannot send an early warning about something you cannot see. Failure detection, signed logs and a clear record of which tenant workloads ran on which machines are what make the deadline achievable.

The Data Act reaches cloud and AI services

The Data Act (Regulation (EU) 2023/2854) entered into force on 11 January 2024 and has applied since 12 September 2025, per the Commission. For AI infrastructure, its switching chapter is the part to read closely. "Data processing services" covers IaaS, PaaS and SaaS, which in practice includes most hosted inference and GPU cloud.

Customers must be able to switch to another provider or to their own infrastructure. Until 12 January 2027, providers may charge reduced switching fees that cover only the costs directly linked to switching. From that date, switching charges are abolished, as the Belgian regulator BIPT summarises. Two further dates follow. From 12 September 2026, connected products and related services placed on the market must make the data they generate accessible to users by design. From 12 September 2027, the unfair-terms rules extend to certain older contracts, according to McCann FitzGerald. A wider data omnibus that would adjust some switching rules for smaller operators is still under negotiation.

For inference, standard API shapes are what make switching a configuration change rather than a migration project.

The evidence to build in now

Across the three laws, the same short list of records answers most questions a regulator, auditor or enterprise customer will ask:

1. What ran. Model identity, a hash of the weights served, the engine version and the licence terms.
2. Where it ran. The jurisdiction of the serving machine, declared by the operator and bound to the machine's identity.
3. Who ran it. A machine identity that cannot be copied off the hardware, so that a log entry points to one physical node.
4. What came out. A hash of each output and a machine-readable marker that it is AI-generated.
5. What failed, and when. Health signals with timestamps, so the 24-hour NIS2 clock starts from evidence rather than from a customer complaint.
6. How to leave. Documented export paths and standard APIs, so Data Act switching requests are routine.

What this means for EU policy makers and operators

For policy makers, the July 2026 changes buy time on high-risk systems but not on transparency, GPAI or cybersecurity. Supervision will go faster if regulators can ask for cryptographic evidence, such as signed receipts, attested measurements and content hashes, rather than relying on narrative attestations.

For operators, the timetable is now clear enough to plan against. NIS2 security measures and reporting are due now. Article 50 marking is due now for new systems and from 2 December 2026 for existing ones. Data Act switching charges end on 12 January 2027. Treat each as a requirement for your serving path, not only for your policy documents.

Where Tenzro fits

Tenzro is an open network where machines sell AI work. It is live in preview, and governance decides the steps to testnet and mainnet. Several of the records above are built into how it serves:

• Signed receipts. Each locally served answer carries a receipt signed by a session key certified by the serving machine's hardware identity key. It covers the catalogued model hash and engine, the machine identity, an input commitment, an output hash and the billed units. Anyone can verify it without contacting the provider.
• Jurisdiction pinning. A caller can require that a request be served only by nodes whose operator declared a matching country or bloc, for example "DE,EU". Matching fails closed, and the response can carry a signed jurisdiction receipt. The declaration is a claim, bound to a hardware attestation on confidential-computing nodes. It is not a cryptographic proof of location, and the docs say so.
• Synthetic-content marking. Inference outputs carry a provenance manifest modelled on C2PA, keyed by the content hash and resolvable over RPC. Outputs imitating real subjects carry a distinct deepfake assertion.
• Hardware identity. Machine identity keys are sealed to a TPM, Secure Enclave or similar root and are never written to disk as plaintext.
• Failure signals. Serving nodes send a signed heartbeat every two seconds, and a provider is marked down after six seconds of silence.
• Standard interfaces. The network is reachable through an OpenAI-compatible endpoint.

None of this is a compliance certification. These are records that make the work of compliance shorter, and you remain responsible for how you use them.