27 years delivering regulated outcomes under scrutiny — NIS, NIS2, CAF, Ofgem, DORA. Not doctrine alone: assessed, evidence-packed, and regulator-ready.
Across 60 jurisdictions, spanning cybersecurity, data protection, AI governance, digital markets, and financial resilience. Every framework aligned to delivery capability, evidence production, and regulator expectation.
The regulatory foundation: NIS/NIS2, NCSC CAF, Ofgem OES. Each delivered end-to-end with evidence packs, assessment roadmaps, and regulator-ready submissions across £500B+ in managed assets.
UK SI 2018/506 + EU 2022/2555. Delivered OES compliance programmes across energy, finance, and digital infrastructure. End-to-end gap assessments, CAF alignment, evidence production, and Board-level reporting.
Full CAF A–D assessments across all four objectives. Produced IGP scoring, evidence packs, and remediation roadmaps aligned to NCSC expectations. Direct experience with regulator-ready submissions.
Ofgem-specific NIS compliance for Operational Technology environments in energy. Delivered evidence packs for review cycles. Mapped ICS/SCADA controls to CAF objectives with supporting artefacts.
Cross-mapped ISO 27001 and NIST control frameworks against CAF objectives to eliminate duplicate effort. Produced control equivalence matrices used in regulator correspondence.
Comprehensive EU coverage: DORA (financial resilience, now enforced), NIS2 (critical infrastructure transition), EU AI Act (risk-based classification), CRA (supply-chain security). Personal director liability, €10M+ fines, Board oversight requirements.
Digital Operational Resilience Act for financial sector. 4-hour incident reporting for major incidents. Register of Information Q1 2026, on-site ICT risk inspections underway. Board-level ICT risk framework requirements.
Expanded NIS scope to essential services and critical digital infrastructure. €10M or 2% global turnover fines. First audits 30 Jun 2026. Art. 20: personal liability for directors on cyber negligence.
Risk-based classification: Prohibited, High-Risk, Limited Risk, Minimal Risk. Penalties up to 7% global annual turnover. Mandatory conformity assessments, documentation, and human oversight for high-risk systems.
Security by design for products with digital elements. Automatic security updates, vulnerability handling, and responsible disclosure. Enforcement via National Market Surveillance authorities.
Extends ENISA mandate to managed security services certification. ICT supply-chain security focus. €341M budget allocation 2028–2034. Expands security product certification schemes.
€36M Cybersecurity Reserve fund. EU-wide SOC network activation. ENISA Single Reporting Platform by Sept 2026. Cross-border incident response and intelligence sharing.
EU Digital Identity Wallets across all Member States. Secure trustworthy digital identity infrastructure for cross-border services. Pilot programmes expanding. Interoperability mandates.
International standard for AI governance systems. Establishes controls for developing, implementing, and managing AI across organizational functions. Aligned with EU AI Act risk frameworks.
GDPR (enforcement exceeds €7.1B), ePrivacy, DMA/DSA for digital platforms. Data protection by design, algorithmic transparency, gatekeeper regulation, user consent frameworks. Irish DPC as EU lead authority.
Data protection by design and by default. 72-hour breach notification. DPIAs for high-risk processing. Fines up to 4% global turnover. Irish DPC enforcement: €4.04B. 2026 coordinated transparency focus.
Regulates cookies, electronic marketing, email spam, privacy of electronic communications. Consent requirements, opt-in/opt-out mechanisms. Cookie banner compliance and tracking controls.
Designates digital gatekeepers (Meta, Alphabet, Apple, etc.). Mandates interoperability, prohibits self-preferencing, prevents combining user data without consent. Compliance documentation requirements.
Strict risk assessment and independent audits for VLOPs (45M+ EU users). Faster illegal content removal, algorithmic transparency, user appeals. Systemic risk mitigation requirements.
Post-Brexit independent regulatory framework: NIS 2018, UK GDPR, FCA Operational Resilience, Cyber Security & Resilience Bill 2025. Digital Security Act, PSTI for products, Telecoms Act. ICO enforcement authority with enhanced powers.
Financial firms identify important business services, set impact tolerances, test against severe-but-plausible scenarios. Board accountability for resilience. Attestations to FCA/PRA on control effectiveness.
UK GDPR with post-Brexit modifications. DPA 2018 supplements GDPR for law enforcement processing. 72-hour breach reporting to ICO. Appropriate technical/organisational security measures.
Operators of essential services (energy, health, transport, water) and digital service providers. Security requirements, incident reporting to sector CAs. Alignment with upcoming Cyber Security & Resilience Bill.
Expands NIS scope to more digital services and supply chains. Tightens incident reporting timelines. Increases fines. Introduced 12 Nov 2025. Replaces/amends NIS 2018.
Security requirements for consumer-connectable products. Bans default passwords, mandates vulnerability disclosure, minimum security update periods. Fines up to £10M or 4% global turnover.
Stricter security duties on public telecom providers. Supply chain security for network equipment and services. Critical equipment controls (vendor assessments, equipment bans, change controls).
Criminal offences: unauthorised computer access, modification, making/supplying misuse tools. Incident response policies, forensics coordination. Board awareness of criminal liability exposure.
Reforms data protection to simplify research and AI use cases. Clarifies international data transfer mechanisms post-Brexit. Interoperability requirements for data holders.
Material cyber incident disclosure within 4 business days. Annual reporting on cyber risk management. Board-level oversight requirements. Affects all publicly traded companies globally.
Ireland as EU lead authority: DPC (GDPR enforcement), NCSC (cybersecurity), AI Office of Ireland (Oifig IS), Coimisiún na Meán (online harms). Personal director liability, €35M AI fines, €20M online safety fines. Dynamic regulatory environment.
Enhanced DPC focus on Dark Patterns in UI/UX. Mandatory Right to be Forgotten for children's data. DPC as primary EU enforcement authority under One-Stop-Shop mechanism. Coordinated EU investigations.
Places NCSC Ireland on statutory basis. Personal liability for Board members re cyber negligence. NIS2 transposition. Critical infrastructure and essential services designation.
General Scheme published Feb 2026. AI Office of Ireland (Oifig IS) coordinating enforcement across Central Bank, DPC, etc. AI fines up to €35M or 7% global turnover. Risk-based framework mirroring EU Act.
Governs harmful content on social media and video platforms. Fines up to €20M or 10% turnover. Rapid removal requirements, algorithmic transparency, user redress mechanisms.
Regulates online marketplaces, illegal content hosting, advertising transparency. Community guidelines enforcement. Algorithmic risk assessments for VLOPs operating in Ireland.
Post-Brexit regulatory divergence across cybersecurity, data protection, and AI governance. Different implementation timelines, enforcement authorities, and fine structures. Cross-border firms require dual-compliance programmes.
| Framework / Aspect | UK Approach | EU Approach | Key Divergence |
|---|---|---|---|
| NIS / NIS2 | UK NIS 2018 (SI 506) Sector CAs (Ofcom, Ofgem) | EU NIS2 (13/27 transposed) National Competent Authorities | NIS2 expanded scope vs UK standalone regulation |
| Data Protection Fine Structure | 4% global turnover (UK GDPR) No coordination mechanism | 4% global turnover (GDPR) One-Stop-Shop coordination (DPC lead) | EU coordinated enforcement vs UK isolated |
| AI Governance | No dedicated AI regulation yet Sector-specific oversight | EU AI Act (2 Aug 2026) Risk-based mandatory framework €35M fines (7% turnover) | EU AI Act binding vs UK deregulatory approach |
| Product Security | PSTI (2022) — vulnerabilities, updates £10M or 4% global turnover fines | CRA (Dec 2027) — security by design Mandatory automatic updates Phased enforcement | UK early implementation vs EU phased (2027) |
| Cyber Risk for Financials | FCA Operational Resilience 31 Mar 2025 compliance | DORA (17 Jan 2025 in force) 4-hour incident reporting | UK resilience focus vs EU incident reporting |
| Director Liability | Computer Misuse Act 1990 Criminal exposure (Computer Misuse) | NIS2 Art. 20 (personal liability) Ireland National Cyber Bill Statutory duty of care | EU explicit personal liability vs UK criminal law |
| Incident Reporting Timelines | NIS 2018: Sector-specific timelines GDPR: 72 hours to ICO | DORA: 4 hours for major incidents GDPR: 72 hours to DPA | EU tighter critical incident timelines (4h) |
| Digital Markets Regulation | No equivalent (proposed Online Safety Bill) | DMA (in force) — Gatekeeper regulation DSA (in force) — Content, VLOP oversight | EU hardline gatekeeper controls vs UK softer approach |
| International Data Transfers | Data Use & Access Act 2025 Post-Brexit data flow flexibility | GDPR adequacy assessments SCCs / BCRs required | UK pragmatic post-Brexit vs EU strict adequacy |
Regulatory Divergence Impact: Organisations operating cross-border (UK + EU/Ireland) require parallel compliance programmes. EU regulations often move faster (NIS2, AI Act, CRA) with stricter fines and tighter timelines. UK takes more flexible, sector-specific approach. Dual-headquarter firms and financial services with UK/EU presence should integrate evidence production across both frameworks to avoid duplication.
A1–A4 Coverage
Evidence Produced:
B1–B6 Coverage
Evidence Produced:
C1–C2 Coverage
Evidence Produced:
D1–D3 Coverage
Evidence Produced:
Delivered regulatory artefacts — CAF self-assessments, evidence packs, remediation plans — within fixed regulatory submission windows. Coordinated multi-workstream delivery against NIS2's 24-hour and 72-hour incident reporting obligations.
Managed parallel compliance programmes across NIS, DORA, and ISO 27001 in simultaneous engagement cycles. Built prioritisation frameworks to sequence deliverables without regulatory exposure. Zero missed submission deadlines across 8+ regulated programmes.
Assembled and directed SME networks to produce evidence under time constraints — turning technical operations data into regulator-ready documentation. Built evidence libraries mapped to specific CAF objectives and control references.
10+
Tabletop Exercises
D1/D2
CAF Objective Uplift
<4h
Detection-to-Escalation
NIS2 Art.23
Reporting Process Validated
Defined assessment scope against regulatory boundaries. Established evidence requirements, stakeholder responsibilities, and timelines before engagement commencement.
Conducted end-to-end assessments independently — no reliance on large consultancy teams. Directly interviewed technical and operational SMEs. Produced findings without intermediary layers.
Built evidence packs from first principles. Applied IGP scoring methodology. Documented objective ratings with full supporting rationale aligned to NCSC guidance.
Authored final assessment reports in regulator-ready format. Structured findings for Board, CISO, and regulatory consumption simultaneously.
Developed prioritised remediation plans mapped to CAF objectives and NIS obligations. Sequenced activity by regulatory exposure, resource constraint, and delivery dependency.
Maintained remediation progress against regulatory milestones. Built governance cadence for Board reporting, including control status dashboards and risk register updates.
Designed and maintained cyber risk registers aligned to enterprise risk frameworks (ISO 31000, NIST RMF). Calibrated risk ratings against regulatory impact thresholds. Produced risk reporting packs for Board and CISO consumption aligned to NIS and DORA obligations.
Designed cyber governance forums including ISRM Committees, Cyber Risk Committees, and Executive Oversight panels. Produced governance charters, terms of reference, meeting cadence, and reporting templates. Ensured regulatory visibility at Board level.
Managed second-line assurance activity across control environments. Delivered control testing schedules, findings registers, and closure evidence. Produced assurance outputs for regulatory submissions, internal audit, and third-party review.
Sector
Energy (Operational Technology Environment)
Regulatory Context
UK NIS Regulations + Ofgem OES obligations
CAF assessments, NIS/NIS2 compliance programmes, Ofgem OES engagement, and incident response uplift — delivered end-to-end.
21 OT/ICS doctrine papers (May 2026) cross-mapped against the regulatory frameworks they engage. Each framework links to the relevant papers.