Regulatory inflation in Europe: what does it mean for IAM teams?

TL;DR: GDPR, eIDAS 2.0, DORA, NIS2, the AI Act and AMLR are converging into a dense European compliance wave that raises board-level accountability, expands identity and trust obligations, and makes siloed compliance structurally more expensive than integrated compliance, according to Namirial. Compliance can no longer assume static legal boundaries or separate workstreams.

Editorial analysis by NHI Mgmt Group, based on content published by Namirial: “eIDAS 2.0, DORA, AI Act: what changes for your business in terms of regulatory compliance”.

By the numbers:

• Non-compliance costs on average 2.71 times more than compliance, at $14.82 million versus $5.47 million per year, according to the Ponemon Institute cited by Namirial.
• DORA is applicable from 17 January 2025 for the financial sector and its ICT providers, according to Namirial.
• The AI Act entered into force in August 2024, with progressive application through 2027 and maybe 2028, according to Namirial.

Key questions

Q: How should organisations manage overlapping European compliance requirements?

A: They should stop treating each framework as a separate programme and instead build one governance layer that maps controls, evidence and ownership across all applicable obligations.

Q: Why do overlapping identity regulations create so much operational risk?

A: They create risk because compliance teams often solve each rule in isolation, which leads to duplicated controls, inconsistent assurance levels, and conflicting owners.

Q: What breaks when compliance is handled in silos?

A: Siloed compliance produces duplicate controls, blind spots between teams, and late-stage fixes that are harder and more expensive to implement.

Practitioner guidance

• Consolidate regulatory ownership Create one cross-functional governance model for GDPR, eIDAS 2.0, DORA, NIS2, the AI Act and AMLR so evidence, accountability and deadlines are managed together.
• Map identity journeys to trust dependencies Document where digital onboarding, signature validity, identity verification and audit trails rely on qualified trust services, external providers or cross-border legal recognition.
• Build compliance into workflow design Embed traceability, retention, human review and jurisdictional controls directly into customer and employee processes rather than treating them as post-launch fixes.

Bottom line: European compliance pressure is no longer confined to a single function, because identity, resilience and AI governance now intersect in the same operating model.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →