Exploring Common Traits in EU Digitalization Regulations : Towards Joint Implementation for Organizational Compliance

Sammanfattning

With an increase of cyber attacks, cyber security is a topic which affects more or less every industry in society today. The European Union has, as part of their Digital Decade initiative, approved one new regulation and proposed another regarding cyber security: AI Act (AIA) and Cyber Resilience Act (CRA). Once entered intoforce, these regulations will affect multiple organizations and industries. Existing research is available in areas of safety assessment mechanisms of both artificial intelligence and cyber resilience, and there is also research supporting the connection of AIA and CRA. However, the existing research intertwining the regulations do not highlight specific practical organizational implementations which would align both regulations. To fill the lack of practical multi-regulation compliance, this research aims to identify similar aspects of the AIA and CRA and to suggest joint implementations to comply with both regulations on their similarities. The method for this research surrounds a comparative analysis of the regulations, and a case study involving experts in the fields of law and information security with the objective of exploring different implementation options to comply with the proposed regulations.The outcome of this project resulted in the identification of overlapping regulatory obligations, and suggestions of how an organization can initialize the compliance management for AIA and CRA simultaneously.