01« A major customer sent us a forty-page security questionnaire. »
Decision
What level of evidence to provide, against which framework.
Deliverable
Evidence file and gap-closure plan, reusable for the next customers.
A few weeks
Risk & Compliance
Anticipate what binds you, before it is imposed on you.
NIS2 not yet transposed in France, a distinct Swiss regime, an AI Act with redrawn deadlines, customers already demanding evidence. Compliance is no longer a matter for lawyers: it is a management trade-off.
What we observe
≈ 15,000
entities expected within the NIS2 scope in France, against a few hundred today
European Commission; estimate
24 h
deadline to report a cyberattack to the Swiss NCSC for critical infrastructure, since 1 April 2025
NCSC, ncsc.admin.ch
35 M€ · 7%
AI Act fine ceiling for prohibited practices; 15 M€ or 3% for most other obligations
Regulation (EU) 2024/1689, art. 99
France. NIS2 is set to raise the number of regulated entities from a few hundred to around 15,000, across 18 sectors, from 50 employees or 10 M€. The transposition law has not been passed; the Commission referred France to the Court of Justice on 8 July 2026. Waiting for the law is a bet, not a plan.
Switzerland. NIS2 does not apply directly. Since 1 April 2025, operators of critical infrastructure must report any cyberattack to the NCSC within 24 hours, with a fine of up to CHF 100,000 since 1 October 2025. Six months after entry into force, 164 reports had been recorded. Outside critical infrastructure there is no legal obligation, but your EU customers may impose one by contract.
AI. Article 50 of the AI Act has applied since 2 August 2026. The high-risk obligations of Annex III are postponed to 2 December 2027 by Regulation (EU) 2026/1744. Fines reach 35 M€ or 7% of worldwide turnover for prohibited practices, 15 M€ or 3% for most other obligations.
What this changes
Three calendars, three jurisdictions. The right question is not “are we compliant?” but “what are we bound to, towards whom, by when?”.
What you get
01
A clear view of what applies, what is required by contract and what can wait.
02
Evidence you hand to a customer without rebuilding it.
03
A named owner for every obligation.
Six situations
Where you stand. How we step in.
01
02« We do not know whether we are in scope. »
Decision
What applies to us, what will be imposed on us, what can wait.
Deliverable
Three-Track Exposure Map.
Short engagement
03« Our teams use AI without rules. »
Decision
Which tools, with which data, under whose responsibility.
Deliverable
Usage policy, system inventory, classification under the AI Act.
Short engagement
04« We have had an incident. »
Decision
Whom to inform (authority, customers, insurer), within what deadlines.
Deliverable
Documented incident file and improvement plan, with incident-response experts from the network.
On request
05« An investor or an acquirer is going to audit us. »
Decision
What to regularise beforehand, what to own.
Deliverable
Compliance file ready for the data room.
A few weeks
06« We sell into the EU from Switzerland (or the reverse). »
Decision
Representative, DPO, data transfers.
Deliverable
Jurisdiction matrix (FADP / GDPR) and associated obligations.
Short engagement
Our services
- 01Map your regulatory exposure
- 02Build the evidence file your customers can rely on
- 03Govern the use of AI
- 04Document incident management
- 05Steer remediation
- 06Train the management committee on its responsibilities
Our framework
The Three-Track Exposure Map
Each text is placed on one of three tracks, with its deadline, its internal owner and the gap observed.
Mandatory
What the law imposes on you today, according to your role: essential or important entity, AI deployer or provider, data controller.
Contractual
What your customers, insurers and investors require, even without a law.
To watch
Known deadline, not applicable to date.
Deliverable
A one-page summary, detailed annexes per text.
By size
SME · 10 to 50 M€
Rarely a full-time CISO or DPO. We aim for a base of defensible controls, not a complete management system, and draw on outsourced functions from the network.
Mid-cap · from 50 M€
A risk function exists, several frameworks overlap. We consolidate them into a single plan and prepare the internal audit.
By sector
Finance & Capital
DORA, applicable since 17 January 2025: critical ICT third parties, resilience testing, register of providers. In Switzerland, FINMA requirements on operational risks and resilience (circular 2023/1).
Health & Life Sciences
HDS in France, MDR/IVDR, EHDS. AI embedded in a medical device: Annex I high risk, deadline 2 August 2028.
Industry, Energy & Infrastructure
NIS2 (energy, water, transport, manufacturing); in Switzerland, NCSC reporting within 24 h; IT/OT segmentation.
Commerce, Services & Customer Experience
GDPR and FADP (loyalty, profiling); Article 50 (conversational agents, generated content); CV-screening tools: high risk, Annex III, 2 December 2027.
Tech, Innovation & Public Sector
Your NIS2 and DORA customers ask you for evidence; Cyber Resilience Act (reporting obligations from September 2026, product requirements in December 2027); software vendors used in critical infrastructure: check whether the Swiss ISA applies to you.
Typical scenario · illustrative
Swiss software vendor with 25 M€ revenue, energy customers in Germany and France. Its largest customer demands supply-chain security evidence before renewal. Within three weeks: scope clarified (mandatory for the customer, contractual for the vendor), eight gaps ranked, evidence reusable for the three other customers.
What an AI tool will not do for you
An assistant summarises NIS2. It will not carry your file in front of your customer, will not choose which gaps you accept, will not answer for the quality of the evidence. Aegryn commits a named expert, accountable for their scope.
Our support does not replace legal advice; we work with partner law firms.
Implement
Implementing what was decided, through to acceptance.
- 01
Roll out the compliance plan: policies, procedures and registers.
- 02
Put in place the controls and the evidence file that stands up with clients.
- 03
Train teams and executive committees on the new requirements.
- 04
Lead remediation until the gaps are closed.
Confidential scoping call
Thirty minutes with a named expert from our network, accountable for their scope. No commitment at this stage; terms follow the scoping call.
Assess your exposureNewsletter · Built to Last
Market analysis, company lifecycles, lessons from the field. One letter, no prospecting.