Tracking EU Digital Regulation: Where to Watch for AI Act, NIS2, and DORA Updates

Three pieces of EU digital regulation draw sustained search interest: the AI Act, the NIS2 Directive, and the Digital Operational Resilience Act (DORA). All three share a characteristic that makes them hard to follow: the headline legal text is only the beginning. Much of what organizations actually need to do is set out later — in guidelines, delegated and implementing acts, technical standards, codes of practice, Q&As, and, for directives, national laws.

This article doesn’t try to summarize every obligation, because the details keep evolving. Instead, it maps where official updates are published, so you can monitor the sources directly.

Always confirm the current status of any rule against the official sources below. Timelines and implementing measures in this area have been subject to change and proposals for amendment.

The EU AI Act

What it is: Regulation (EU) 2024/1689, the EU’s horizontal regulation on artificial intelligence. It entered into force on 1 August 2024 and applies in stages. The original text set the prohibitions on certain AI practices to apply from 2 February 2025, obligations for general-purpose AI models from 2 August 2025, and most remaining provisions from 2 August 2026, with some high-risk categories later. In November 2025 the European Commission proposed a “Digital Omnibus” package that would adjust parts of this timeline, particularly for high-risk systems. Check the current legislative status before relying on any date.

Where updates appear:

• EUR-Lex — the official text, corrigenda, and any amending acts.
• The European Commission’s AI Act pages and the AI Office — guidelines (for example, on prohibited practices and on the definition of an AI system), the general-purpose AI code of practice, templates, and FAQs.
• Delegated and implementing acts — published in the Official Journal and announced on Commission pages.
• Harmonised standards — developed by CEN and CENELEC at the Commission’s request. Standards progress is tracked on standardization body pages.
• National authorities — each member state designates market surveillance and notifying authorities. Their websites will carry national guidance and contact points.
• Legislative procedure pages — for amendment proposals such as the Digital Omnibus, the European Parliament’s Legislative Observatory and Council press releases show progress.

NIS2 Directive

What it is: Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union. Member states had to transpose it into national law by 17 October 2024. As a directive, its obligations reach organizations through national legislation, and transposition timing and details differ by country.

Where updates appear:

• National legislation and government portals — the transposing law, implementing decrees, and registration requirements in each member state where you operate.
• National competent authorities and CSIRTs — registration portals, guidance, and incident reporting procedures.
• The European Commission — implementing acts, such as the technical and methodological requirements for certain digital infrastructure entities, and transposition status information.
• ENISA — technical guidance and reports.
• The NIS Cooperation Group — published guidance documents.

For multinational organizations, the national layer is the hard part: you may need to monitor several national authorities, each publishing in its own language and format.

DORA

What it is: Regulation (EU) 2022/2554 on digital operational resilience for the financial sector. It has applied since 17 January 2025. Much of the detail is in regulatory and implementing technical standards (RTS and ITS) developed by the European Supervisory Authorities.

Where updates appear:

• EUR-Lex — the regulation and the delegated and implementing regulations adopting the technical standards.
• The European Supervisory Authorities (EBA, EIOPA, ESMA) — draft standards, final reports, guidelines, Q&As, and joint publications, including those on the oversight of critical ICT third-party service providers.
• National competent authorities — financial supervisors’ guidance, reporting templates, and submission procedures.

A monitoring plan you can copy

1. List your obligations by regime: which of the three apply to you, and in which countries.
2. Pick the exact pages for each source above: publication lists, guidance libraries, consultation pages, Q&A pages, and news pages. Go one level deeper than the homepage.
3. Add key documents: guidance PDFs and templates you rely on, so revisions are caught.
4. Monitor continuously and route alerts to the owner of each regime.
5. Log every relevant change in a register with date, source, summary, and action. See Regulatory Change Management.
6. Review quarterly whether your source list is still complete. New bodies and pages appear as implementation progresses.

Why direct monitoring beats waiting for newsletters

Law firm alerts and industry newsletters provide valuable interpretation, but they are selective and arrive after publication. Monitoring official sources directly means you see a new guideline, Q&A, or national decree when it is published. Then you can read expert commentary with the source already in hand.

Where PageWatcher fits

PageWatcher.app can watch the publication pages, Q&A lists, and PDF documents of EU institutions, supervisory authorities, and national regulators. It detects changes and summarizes them with AI, so a new guideline or a revised document doesn’t go unnoticed. See also What Is Regulatory Intelligence?