MANAGEMENT BODY · BOARD
Must approve and oversee the cybersecurity risk-management measures, and can be held personally liable for failing to do so — including temporary disqualification from management duties.
NIS2 art. 20 · art. 32.6
security
Is your own position free of liability?
European regulation stopped addressing companies in the abstract some time ago: it names roles and accountable individuals. Meanwhile, the automations that move your data and your invoices are increasingly built by teams that never passed through IT — and every one of them falls under duties that already have a name, an article and a deadline attached.
EU-hosted · GDPR · NIS2 · DORA · AI Act-ready
who answers for it
These obligations have names attached — and some of them are personal.
European regulation no longer stops at the company: it names roles, and in the case of NIS2 it reaches the management body directly. Automations built outside the review process fall inside these duties all the same.
CISO
Asset management and access-control policies as a mandatory measure, and incident early warning within 24 hours — impossible on automations nobody has inventoried.
NIS2 art. 21.2.i · art. 23 · GDPR art. 32
CTO · HEAD OF IT
A complete, current inventory of ICT assets and their dependencies, plus a register of third-party providers — for systems built by teams that never asked IT.
DORA art. 8 · art. 28.3
DPO · DATA PROTECTION
Every automation that touches personal data is a processing activity: it belongs in the Art. 30 record, may need a DPIA, and any breach must be notified within 72 hours.
GDPR art. 30 · 33 · 35 · 22.3
CFO · FINANCE
Integrity, unalterability and traceability of invoicing records produced by software — including any intermediate flow that transforms or replicates them.
RRSIF art. 8 (VeriFactu) · RD 1007/2023
AI COMPLIANCE OWNER
Transparency where systems interact with people, human oversight and event logging where the use is high-risk, and a technical dossier to back both.
AI Act art. 50 · art. 14 · art. 11
Scope and thresholds vary by sector, size and national transposition — verify your own case.
Informational, not legal advice.
risks to mitigate
The exposure a security review keeps finding.
Five patterns, each one a direct consequence of departments being able to build their own operations. For each, what Kimetai does about it.
RISK 01
Automations nobody declared
Low-code and agentic AI let any department build tools and automations without passing through IT or security. What was never declared cannot be governed, and does not appear in any register.
WITH KIMETAI
Read-only connectors inventory every automation across the platforms your company already pays for, and alert on each new one — without asking teams to change how they build.
GDPR art. 30 · NIS2 art. 21.2.i · DORA art. 8
RISK 02
Embedded, permanent credentials
An API key written into a flow, never rotated, with write access to production. A non-human identity with standing privilege that no policy governs.
WITH KIMETAI
Each automation gets a signed identity with a named human behind it, scoped permissions, automatic key rotation and global revocation in seconds.
GDPR art. 32 · NIS2 art. 21.2.i
RISK 03
No owner, no documentation
Built by someone who has since left, absent from every internal manual. When it fails, nobody knows what it was supposed to do — or who may switch it off.
WITH KIMETAI
A named owner per automation and a versioned classification record: data classes, systems written into, criticality and the frameworks that reach it.
GDPR art. 30 · DORA art. 8.4 · AI Act art. 11
RISK 04
Silent changes of regime
The day someone adds an AI step to a deterministic workflow, or points it at a new system, the applicable regime moves. The assessment on file is already out of date.
WITH KIMETAI
Re-classification is triggered by the change, not by the calendar: drift alerts and a new proposed risk level whenever the flow is modified.
AI Act art. 50 · Annex III · NIS2 art. 21
RISK 05
Evidence scattered across platforms
Each platform keeps its own log, in its own format, with its own retention window. Reconstructing one incident means five consoles — with the clock already running (24h for the NIS2 early warning, 72h to notify a personal-data breach under the GDPR).
WITH KIMETAI
One hash-chained trail for every platform, sealed with eIDAS-qualified timestamps, under a single retention policy — and exportable as the evidence pack each framework asks for.
GDPR art. 33 · NIS2 art. 23 · RRSIF art. 8
kimetai: immutable audit
Evidence nobody can rewrite. Including us.
Every audit event carries the hash of the previous one, forming a per-tenant chain: altering any record breaks every hash after it, visibly. Periodic seals use eIDAS-qualified timestamps, so the chain can be verified by a third party — without trusting Kimetai.
- SHA-256 hash chain per tenant, append-only store
- eIDAS-qualified timestamp seals
- Retention windows you configure, to match what your sector requires
$ kimetai audit verify --tenant acme --from 2026-01checking 1,204,318 events…hash chain intact52 eIDAS seals validno gaps, no rewritesverified in 41.2s · exit 0Illustrative run · synthetic data
regulatory positioning
Built against the rules your automations will be judged by.
EU AI ACT
Risk classification per Regulation (EU) 2024/1689, auto-generated Article 11 technical documentation, Article 14 human-oversight workflows with a sealed approval record.
eIDAS
Qualified timestamps seal the audit chain, giving exported trails evidentiary weight in European jurisdictions.
NIS2
Automation actions become traceable, attributable events — the incident reconstruction and reporting discipline NIS2 expects of essential entities.
DORA
For financial entities and their ICT providers: the automation inventory and its dependencies map directly onto the register of information the regulation expects.
INVOICING RECORDS
Six national regimes converging into intra-EU digital reporting from 2030: the SdI clearance in Italy, KSeF in Poland, PDP platforms in France, XRechnung in Germany, Peppol BIS in Belgium and VeriFactu in Spain. Whichever applies to you, the flows that transform or replicate invoicing data stay traceable.
GDPR
EU residency by default, DPA with every plan, data-minimising event payloads, and retention windows you control.
Stop carrying a risk you cannot even see.
In 45 minutes we map which automations are running in your company, and you identify who answers for each one and which duties already reach them. You leave the call knowing exactly what you are exposed to — with or without Kimetai.