NIS2, DORA and EU AI Act technical readiness on AWS

An independent read of what your AWS estate can actually evidence, and what it cannot yet.

Request a scoping call Open the free AI Act checklist

Fee: from €3,000
Timeline: 2–3 weeks
Format: Async, read-only access

Three regimes, one AWS estate

EU SMBs and scale-ups on AWS that deploy AI systems, and carry AI Act deployer duties
Financial entities and their ICT suppliers, in scope for DORA
Organisations in scope for NIS2

The technical controls behind these regimes overlap heavily, so buying two assessments together usually costs less than buying them apart.

Fixed scope, fixed price

This is a technical readiness assessment of your cloud environment. It is not legal advice and does not certify compliance. Engage qualified counsel for legal interpretation.

AI Act deployer readiness

€3,500

3 weeks

Scope: Inventory of AI systems on AWS, risk-tier classification, a gap list against deployer obligations (Art. 26 and the Art. 50 transparency duties), and your logging and monitoring evidence.
You get: A 15–25 page report, a prioritised backlog, and a two-hour evening walkthrough.

DORA technical evidence pack

€6,000

3 weeks

Scope: Your AWS controls mapped to the DORA ICT-risk, resilience and third-party requirements, plus a plan for collecting the evidence.
You get: A control matrix (xlsx), a gap report, and a walkthrough.

NIS2 technical baseline

€3,000

2–3 weeks

Scope: Your AWS security baseline against the NIS2 Art. 21 measures, with an evidence checklist.
You get: A gap report, a backlog, and a walkthrough.

Excl. VAT. EU businesses with a valid VAT number are invoiced reverse-charge. Invoiced on delivery, 14-day payment terms, after a signed one-page scope.

Three steps, asynchronous

Step 1 of 3
Scoping call
A 45-minute evening call, then read-only access to your account or an architecture export.
Step 2 of 3
Async assessment
Two to three weeks of work on my own time, with written questions as they come up.
Step 3 of 3
Report and walkthrough
You get the report, then we walk through it together in one evening session.

Start with the free checklist

A one-page self-check against the AI Act duties that land on AWS teams. It tells you roughly where you stand before you pay anyone anything.

Open the free AI Act checklist

What I don't take on

I do not work with my employer, with any company in its group, or with their competitors, suppliers and business partners.
I use no employer information, tools, equipment or materials, and I work only outside my working hours. All benchmarks come from public sources and your own data.

Request a scoping call

Booking form not loading? Open it in a new tab or email me directly.

Readiness questions

Is this legal advice?

No. This is a technical assessment of your cloud environment against the technical measures these regimes ask for. It does not certify compliance. Your counsel interprets the law; I tell you what your infrastructure can evidence.

What access do you need?

Read-only access to the relevant AWS accounts, or an architecture export if you would rather not grant access. Access is agreed in writing before any work starts.

Can you cover more than one regime at once?

Yes, and it is usually cheaper than buying two assessments. The AWS controls behind NIS2 and DORA overlap heavily. Ask on the scoping call and I will price the combination.