NIS2 · DORA · CRA · AI governance

Straight answers on NIS2, DORA, the CRA and AI risk.

I help you work out what actually applies to you, in plain language, including the blockchain dependencies DORA guidance hasn't caught up with yet.

Check your scope Book a consultation →
CRA reporting is live. It has applied since 11 September 2026, and the 24-hour clock runs from when you become aware, not when you finish investigating. Work out your deadlines with the reporting clock.

The confusion is real, and it's not just you

Scope is broader than it looks

NIS2 brought far more Swedish organisations into scope than the old rules did, as NCSC notes (in Swedish). Many don't yet know they're one of them.

AI use is outrunning any policy

Most orgs have people using AI tools daily with no framework for what's safe to feed them or rely on.

Your customer's obligations become yours

NIS2 makes organisations responsible for their supply chain. For suppliers who aren't regulated themselves, that arrives as contract terms and security questionnaires.

Your DORA file stops at the blockchain

If you hold, settle or custody anything onchain, those networks are part of your ICT risk. Very little guidance exists yet on how to treat them.
check

Are you likely in scope?

A quick four-question check to see whether NIS2 or DORA is likely to reach you. It is a starting point, not a legal determination.

Is your organisation a bank, insurer, investment firm, payment provider, or crypto-asset service provider?
Do you operate in energy, transport, health, digital infrastructure, public administration, or manufacturing of critical products?
Are you a public body, a provider of public electronic communications, DNS or trust services, or the only provider in Sweden of a service others depend on?
Do you have 50+ employees, or turnover / balance sheet over €10M?
This is a starting point, not a legal determination. If you want it mapped properly to your organisation, that's the kind of work I do.
Already dealing with an incident? Work out your reporting deadlines →
services

What I work on

For manufacturers placing connected products on the EU market, energy and water, municipal operations, the suppliers who serve them, and financial firms starting to depend on blockchain infrastructure.

◆

Compliance & risk

NIS2, DORA and CRA readiness, risk assessments, audit preparation for regulated organisations.
core practice
◆

AI governance

What the EU AI Act already requires of you, what is deferred to 2027, and a workable way to classify AI use by risk.
specialisation
◆

Onchain finance risk

Blockchain dependencies reviewed for your DORA file: governance, keys, transaction controls, incidents, smart contracts, third parties and cryptographic agility.
specialisation
insights

Start with what's actually changing

Reporting has applied since 11 September 2026, and most published advice still conflates it with the 2027 requirements.

The CRA's first deadline asks for less than you've been told

Article 14 brings in a reporting duty, not a vulnerability handling programme. What actually triggers a report, the 24 and 72-hour clock, who counts as a manufacturer when you rebrand or reconfigure someone else's hardware, and the two things still unsettled in Sweden.
Leighton Wilson, Indura Labs ·
Read the guide →
"Does this even apply to us?" is the question most SMEs get stuck on first.

NIS2 vs DORA: which one applies to you?

NIS2 covers a broad set of "essential" and "important" sectors under Swedish cybersecurity law; DORA is narrower and specific to financial entities. Most organisations only need to check one. This piece walks through the Part A / Part B split in plain language, so you can place yourself before anything else.
Leighton Wilson, Indura Labs ·
Read the guide →
Not every AI use in your org needs the same level of scrutiny.

A simple way to gate AI use by risk

A four-gate way to sort AI uses in your organisation by how much scrutiny they actually need, from "just try it" to "needs sign-off first." Built to be usable by a stretched IT person in an afternoon, not a formal governance programme.
Leighton Wilson, Indura Labs ·
Read the guide →
Leighton Wilson
about

I'm Leighton. I help organisations work out what Cybersäkerhetslagen, DORA, the CRA and the EU AI Act actually ask of them, and how to get there without a huge programme.

I came to security the long way round. Nine years as a chef, in kitchens across several countries, taught me to work under pressure and not leave until the job's done. Six years as a time-served electrician, including plant-floor work, taught me to start with how things actually run, not how the policy says they run. From there I moved into tech: first a fintech startup, where my interest in security started, then IT deployment work for the NHS.

Today I do risk assessments, NIS2 readiness and AI governance work as an independent consultant. I also build open-source security tools in public, including an OT protocol anomaly detector and a vendor-risk model for NIS2 supply chains, so you can see how I work before we talk.

Based in Östersund. Security+, Network+ and INE AI Systems Security Specialist (eAIS) certified.

Ready to talk?

Book a consultation to discuss NIS2, DORA or CRA work, onchain dependencies, or AI governance.

1. You get a real reply

Email goes straight to me, not a funnel. No automated sequence, no sales team.

2. First conversation is a scope, not a pitch

We talk through what you're actually dealing with. No slide deck, no pressure to commit.

3. You'll know exactly where you stand

If it's not a fit, I'll say so. If it is, nothing starts until you've agreed the scope and cost.
Book a consultation
© indura labs · Östersund, Sweden contact@induralabs.segithubcontactRSS feeddisclosureslegal