{
  "attribution": {
    "source": "legal.exploreworldai.com",
    "canonical": "https://legal.exploreworldai.com/api/public/v1/cross-jurisdiction",
    "cite_as": "NovaCopilot, legal.exploreworldai.com (https://legal.exploreworldai.com/api/public/v1/cross-jurisdiction)",
    "license": "https://legal.exploreworldai.com/revision",
    "version": "legal-2026-10-07",
    "fingerprint": "ewai:shared:73ddaa",
    "proof": "sha256:784cd3d122c47de3b1efe83d3ee23d4d36c5ca53e1355a9e32feef0c70459e17",
    "jurisdiction": "shared",
    "lang": "en",
    "publisher": "NovaCopilot by ExploreWorld Legal",
    "terms": "https://legal.exploreworldai.com/om"
  },
  "brand_source": "Source: NovaCopilot",
  "brand": {
    "product": "NovaCopilot",
    "platform": "ExploreWorldAI",
    "infrastructure": "ExploreWorld Legal",
    "infrastructure_url": "legal.exploreworldai.com",
    "legal_entity": "Valkiv Ventures AB",
    "permanent_url": "https://legal.exploreworldai.com/novacopilot",
    "source": "Source: NovaCopilot",
    "powered_by": "Powered by NovaCopilot",
    "license": "https://legal.exploreworldai.com/licensvillkor",
    "contact": "stig@valkiv.com"
  },
  "schema_version": "1",
  "id": "chain:cross:eu~eu",
  "object_type": "cross_jurisdiction",
  "from": "eu",
  "to": "eu",
  "kind": "eu_article_crosswalk",
  "total": 14,
  "links": [
    {
      "relation": "analogous_to",
      "symmetric": true,
      "from": {
        "actId": "gdpr",
        "celex": "32016R0679",
        "article": "32",
        "path": "/eu/rattsakter/gdpr-2016-679/artikel-32"
      },
      "to": {
        "actId": "nis2",
        "celex": "32022L2555",
        "article": "21",
        "path": "/eu/rattsakter/nis2-2022-2555/artikel-21"
      },
      "note": "Both articles require security measures proportionate to the risk, one for personal data and one for network and information systems.",
      "readAt": "2026-08-18"
    },
    {
      "relation": "analogous_to",
      "symmetric": true,
      "from": {
        "actId": "gdpr",
        "celex": "32016R0679",
        "article": "32",
        "path": "/eu/rattsakter/gdpr-2016-679/artikel-32"
      },
      "to": {
        "actId": "dora",
        "celex": "32022R2554",
        "article": "9",
        "path": "/eu/rattsakter/dora-2022-2554/artikel-9"
      },
      "note": "Safeguards for processing meet safeguards for the ICT systems of a financial entity: the same kind of requirement, a different object of protection.",
      "readAt": "2026-08-18"
    },
    {
      "relation": "intersects_with",
      "symmetric": true,
      "from": {
        "actId": "gdpr",
        "celex": "32016R0679",
        "article": "33",
        "path": "/eu/rattsakter/gdpr-2016-679/artikel-33"
      },
      "to": {
        "actId": "nis2",
        "celex": "32022L2555",
        "article": "23",
        "path": "/eu/rattsakter/nis2-2022-2555/artikel-23"
      },
      "note": "One and the same incident can trigger notification to the data protection authority and to the CSIRT, on different deadlines and to different recipients.",
      "readAt": "2026-08-18"
    },
    {
      "relation": "intersects_with",
      "symmetric": true,
      "from": {
        "actId": "gdpr",
        "celex": "32016R0679",
        "article": "33",
        "path": "/eu/rattsakter/gdpr-2016-679/artikel-33"
      },
      "to": {
        "actId": "dora",
        "celex": "32022R2554",
        "article": "19",
        "path": "/eu/rattsakter/dora-2022-2554/artikel-19"
      },
      "note": "Reporting a major ICT-related incident and notifying a personal data breach can be triggered by the same event at a financial entity.",
      "readAt": "2026-08-18"
    },
    {
      "relation": "depends_on",
      "symmetric": false,
      "from": {
        "actId": "ai-act",
        "celex": "32024R1689",
        "article": "10",
        "path": "/eu/rattsakter/ai-act-2024-1689/artikel-10"
      },
      "to": {
        "actId": "gdpr",
        "celex": "32016R0679",
        "article": "9",
        "path": "/eu/rattsakter/gdpr-2016-679/artikel-9"
      },
      "note": "The article on data and data governance leans on the exception for special categories of personal data where such data are needed to detect and correct bias.",
      "readAt": "2026-08-18"
    },
    {
      "relation": "depends_on",
      "symmetric": false,
      "from": {
        "actId": "ai-act",
        "celex": "32024R1689",
        "article": "26",
        "path": "/eu/rattsakter/ai-act-2024-1689/artikel-26"
      },
      "to": {
        "actId": "gdpr",
        "celex": "32016R0679",
        "article": "35",
        "path": "/eu/rattsakter/gdpr-2016-679/artikel-35"
      },
      "note": "The obligations of the deployer presuppose the impact assessment the data protection regulation already requires, and refer back to it.",
      "readAt": "2026-08-18"
    },
    {
      "relation": "analogous_to",
      "symmetric": true,
      "from": {
        "actId": "ai-act",
        "celex": "32024R1689",
        "article": "22",
        "path": "/eu/rattsakter/ai-act-2024-1689/artikel-22"
      },
      "to": {
        "actId": "gdpr",
        "celex": "32016R0679",
        "article": "27",
        "path": "/eu/rattsakter/gdpr-2016-679/artikel-27"
      },
      "note": "Both articles require a representative inside the union for a party established outside it, with the same role as the point of contact for supervision.",
      "readAt": "2026-08-18"
    },
    {
      "relation": "analogous_to",
      "symmetric": true,
      "from": {
        "actId": "dora",
        "celex": "32022R2554",
        "article": "28",
        "path": "/eu/rattsakter/dora-2022-2554/artikel-28"
      },
      "to": {
        "actId": "gdpr",
        "celex": "32016R0679",
        "article": "28",
        "path": "/eu/rattsakter/gdpr-2016-679/artikel-28"
      },
      "note": "The requirements on the contract with an ICT third-party provider sit close to those on the processor agreement: instructions, audit and exit.",
      "readAt": "2026-08-18"
    },
    {
      "relation": "intersects_with",
      "symmetric": true,
      "from": {
        "actId": "taxonomy",
        "celex": "32020R0852",
        "article": "8",
        "path": "/eu/rattsakter/taxonomi-2020-852/artikel-8"
      },
      "to": {
        "actId": "csrd",
        "celex": "32022L2464",
        "article": "1",
        "path": "/eu/rattsakter/csrd-2022-2464/artikel-1"
      },
      "note": "The disclosure duty on environmentally sustainable activity is delivered inside the sustainability report the reporting directive builds out.",
      "readAt": "2026-08-18"
    },
    {
      "relation": "intersects_with",
      "symmetric": true,
      "from": {
        "actId": "nis2",
        "celex": "32022L2555",
        "article": "21",
        "path": "/eu/rattsakter/nis2-2022-2555/artikel-21"
      },
      "to": {
        "actId": "dora",
        "celex": "32022R2554",
        "article": "6",
        "path": "/eu/rattsakter/dora-2022-2554/artikel-6"
      },
      "note": "A financial entity reads risk management in the sector act that takes precedence, and the general article only so far as it is not covered there.",
      "readAt": "2026-08-18"
    },
    {
      "relation": "intersects_with",
      "symmetric": true,
      "from": {
        "actId": "dsa",
        "celex": "32022R2065",
        "article": "16",
        "path": "/eu/rattsakter/dsa-2022-2065/artikel-16"
      },
      "to": {
        "actId": "gdpr",
        "celex": "32016R0679",
        "article": "17",
        "path": "/eu/rattsakter/gdpr-2016-679/artikel-17"
      },
      "note": "A notice of illegal content and an erasure request can concern the same post, but are decided on different grounds and by different recipients.",
      "readAt": "2026-08-18"
    },
    {
      "relation": "analogous_to",
      "symmetric": true,
      "from": {
        "actId": "data-act",
        "celex": "32023R2854",
        "article": "4",
        "path": "/eu/rattsakter/dataforordningen-2023-2854/artikel-4"
      },
      "to": {
        "actId": "gdpr",
        "celex": "32016R0679",
        "article": "20",
        "path": "/eu/rattsakter/gdpr-2016-679/artikel-20"
      },
      "note": "The right to access data from a connected product runs parallel to the right to data portability, over a wider set of data.",
      "readAt": "2026-08-18"
    },
    {
      "relation": "intersects_with",
      "symmetric": true,
      "from": {
        "actId": "cra",
        "celex": "32024R2847",
        "article": "13",
        "path": "/eu/rattsakter/cyberresiliens-2024-2847/artikel-13"
      },
      "to": {
        "actId": "ai-act",
        "celex": "32024R1689",
        "article": "15",
        "path": "/eu/rattsakter/ai-act-2024-1689/artikel-15"
      },
      "note": "The requirements on products with digital elements and the accuracy, robustness and cybersecurity requirement for high-risk systems meet in one product when it is both.",
      "readAt": "2026-08-18"
    },
    {
      "relation": "depends_on",
      "symmetric": false,
      "from": {
        "actId": "eprivacy",
        "celex": "32002L0058",
        "article": "5",
        "path": "/eu/rattsakter/eprivacy-2002-58/artikel-5"
      },
      "to": {
        "actId": "gdpr",
        "celex": "32016R0679",
        "article": "6",
        "path": "/eu/rattsakter/gdpr-2016-679/artikel-6"
      },
      "note": "The protection of confidentiality of communications rests on a consent whose meaning is taken from the data protection regulation, which also carries the other bases.",
      "readAt": "2026-08-18"
    }
  ],
  "coverage": "in_register",
  "sha256": "e9c8dd44bdc590a8c36aeb5d629b0c9bc95f1176a6d8b24ffb19ccfcca5165af",
  "hash_algorithm": "SHA-256 över id, object_type och kedjans kärna (JSON)",
  "updated_at": "2026-10-07",
  "stay_current": {
    "freshness": "https://legal.exploreworldai.com/api/public/v1/freshness",
    "cursor": "MjAyNi0wOS0xMH5zZX52aXNzZWxibGFzYXJsYWdlbg",
    "chain_hash": "b2e9562b24e7de637742b1660609c2d36eb107fbb6c5ca8041be4979b823290d",
    "changes": "https://legal.exploreworldai.com/api/public/v1/changes/cursor?after=MjAyNi0wOS0xMH5zZX52aXNzZWxibGFzYXJsYWdlbg"
  },
  "permanent_url": "https://legal.exploreworldai.com/api/public/v1/cross-jurisdiction?from=eu&to=eu",
  "cite_as": "Source: NovaCopilot, chain:cross:eu~eu, sha256 e9c8dd44bdc590a8, https://legal.exploreworldai.com/api/public/v1/cross-jurisdiction?from=eu&to=eu",
  "disclaimer": "Source reference with official identifier. Not legal advice and not a compliance decision.",
  "hash": "sha256:784cd3d122c47de3b1efe83d3ee23d4d36c5ca53e1355a9e32feef0c70459e17",
  "version": "legal-2026-10-07",
  "expires": "2026-10-07T12:00:00.000Z",
  "dependency": {
    "index_version": "legal-2026-10-07+legal-2026-10-07+2026-10-07T08:23:33",
    "content_hash": "sha256:784cd3d122c47de3b1efe83d3ee23d4d36c5ca53e1355a9e32feef0c70459e17",
    "revalidate_after": "2026-10-07T09:58:22.487Z",
    "max_copy_age_seconds": 3600,
    "policy": "revalidate-required; attribution-preferred",
    "changelog": "https://legal.exploreworldai.com/api/public/v1/dependency",
    "verify": "https://legal.exploreworldai.com/api/public/v1/verify",
    "stale_copy_invalid": true
  },
  "canonical": "https://legal.exploreworldai.com/api/public/v1/cross-jurisdiction",
  "content_notice": {
    "legal_advice": false,
    "nature": "Source register. Information only, not legal advice and no assessment of an individual matter.",
    "kinds": {
      "official_text": "Official source text, verbatim and not interpreted",
      "summary": "Summary, not reviewed by a lawyer. Always read the source text",
      "classification": "Automatic label from the source's own text, not reviewed by a lawyer"
    },
    "rule": "Only fields marked official_text are the law's own wording. Everything else points to it.",
    "report_error": "https://legal.exploreworldai.com/api/public/v1/corrections",
    "ai_act_declaration": "https://legal.exploreworldai.com/api/public/v1/ai-act-declaration"
  },
  "usageInfo": "https://legal.exploreworldai.com/citering"
}