Regulatory Impact — EU AI Act × DORA × CSRD

What's inside

18 chapters:

1. Executive summary
2. Part I — One compliance surface: three regimes, one SAP estate, dates that are now fixed
3. Part II — The compliance-cost model: 200-800 person-days, built bottom-up and cross-checked against the Commission
4. Part III — DORA × SAP banking analytics: the resilience evidence a bank will ask the deployment to produce
5. Part IV — CSRD × SAP Sustainability: 80 % fewer reporters, the same data pipeline
6. Part V — The AI Governance Architect: the scarce signature on every file in Part II
7. Part VI — GDPR Article 22 × AI Act Article 14: one control, two regulators, €7.1B of precedent
8. Part VII — Sovereign cloud and the data plane: two questions, not one
9. Part VIII — Where the spend lands: verticals, engagement cadence and the 2026-2030 window
10. Part IX — Risk register and decision gates: what to decide in 2026
11. Part X — Provider, deployer or both? The AI Act value-chain test for a Joule agent that calls a third-party model
12. Part XI — The penalty ladder: what each regime lets a regulator charge, and what that does to the cost model
13. Part XII — The exit clock: EU Data Act switching rights, DORA exit strategies and a Datasphere or Business Data Cloud contract
14. Part XIII — NIS2 on the analytics estate: three incident clocks, a supply-chain clause and a managing director who is personally liable
15. Part XIV — AI literacy and transparency: the two AI Act duties that are already enforceable, from 2026-08-02
16. Part XV — The UK overlay: automated-decision reform, a critical-third-parties regime and a regulator that will not write AI rules
17. Part XVI — Switzerland: no AI statute, a data-protection law that already applies, and seven FINMA findings
18. Methodology, sources, glossary and disclaimer

Study card

Edition

v2.1 (2026-10-10: SAP Connect 2026 absorbed in Part X — AI Agent Hub now generally available, Signavio Agent Mining announced, agent-memory exportability as a record-keeping test; 2026-10-06: Parts X–XVI added — Provider, deployer or both? The AI Act value-chain test for a Joule agent that calls a third-party model

Audience

AI Governance + Head of Compliance + CDO offices + Privacy Officers

Coverage

AI Act high-risk classification · Article 9-49 documentation effort · DORA × SAP banking analytics · CSRD × SAP Sustainability · AI Governance Architect role · GDPR Article 22 + AI-decision overlay · sovereign cloud

Geography

EU + UK priority · Switzerland adjacent · MEA secondary

Refresh cadence

quarterly keyed to AI Office enforcement actions + DORA oversight milestones + ESRS updates

Sources cited

125