The Flanders-China Chamber of Commerce organized an exclusive webinar focused on Cybersecurity and AI Compliance in Europe – Burden, or Opportunity on 19 August 2025.
Ms Gwenn Sonck, Executive Director, Flanders-China Chamber of Commerce, welcomed the participants and introduced the topic of the webinar and the speaker. Cybersecurity and AI compliance in Europe, is it a burden or opportunity? Today, we explore a critical topic in Europe's digital transformation. Europe's regulatory landscape, including GDPR, the AI Act, and cyber security mandates, often feels complex and demanding. Many see these regulations as burdens, but as we'll hear from our expert speaker, Mr. Koert van Espen, Managing Partner of Apogado, these can become powerful strategic opportunities. Koert brings over 30 years of experience blending legal and technical expertise in cybersecurity, privacy, and AI compliance, guiding organizations and companies to navigate and leverage Europe's digital laws.
Mr Koert Van Espen, Managing Partner of Apogado gave a presentation on how companies can turn EU cybersecurity, privacy, and AI compliance into strategic business opportunities. Apogado is a team of ICT lawyers, engineers, and cybersecurity experts, helping customers dealing with their compliance issues, more specifically related to privacy, such as the GDPR, but also cybersecurity and now more and more the AI Act. Mr. Van Espen used to work in research and consulting in many big companies and then decided to found his own company. He also worked for the State Secretary of Privacy in Belgium. He is an engineer, not a lawyer, and studied a little bit of management as well, but is backed up by a good team of ICT lawyers within the company.
Mr. Van Espen gave an overview of why very often compliance is considered as being a burden rather than an opportunity, but these burdens can quite easily be turned into opportunities. Why does compliance feel heavy? There is the GDPR, NIS2, DORA, the AI Act, and many others. The GDPR is probably something that everybody is quite familiar with already, since it has been around for more than seven years. The GDPR focuses on protecting citizens' privacy as a fundamental human right. It has a global reach, which means that even if your company is not based in Europe, but you are targeting European citizens, or if you are based in Europe and you are targeting European citizens, who are at that moment not in Europe, the GDPR still applies, with a few exceptions. The key principles of GDPR are lawfulness, which means that you need to have a legal ground to process data. There are principles such as fairness and proportionality, transparency, data minimization – which means that you should not use more data than strictly necessary – and purpose limitation – one of the principles often violated, both in small and in large corporations. It means actually that once you have the data, that you need to think twice before you're going to do something different with that type of data. There's the data subject rights, which is a very powerful and fundamental principle within the GDPR, and everything is being treated as a risk. Now to deal with the GDPR in a professional business-friendly way requires that you not only have legal knowledge, but also technical and practical knowledge. You need to know how to deal with the data protection authorities, to understand case law, and the member state's particularities. There are not that many, but there are also more technical and scientific challenges like anonymization of data, data protection techniques, technical security architectures and so on. We always try to treat this in a business-friendly manner, to try to always find a solution if the GDPR is somehow strict or if there is some kind of gray area.
NIS2, or by extension all cybersecurity regulation, is very often considered as the flip side of the same coin. By the way, NIS stands for Network and Information Systems. Where GDPR focuses on the protection of the individual, of the person, NIS2 actually focuses on protecting data and systems. It's all about cybersecurity resilience against hackers, cyber criminals, and these kind of crooks. The scope is to one extent much wider, because it doesn't only cover personal data, it covers all your systems and assets within your enterprise, but also to some extent it's been narrowed down because it only focuses on essential and important sectors. Those sectors are still quite broad, for instance, any type of government, utilities, banking, logistics, and so on, food production, all those sectors are affected by NIS2. What is even more important, all suppliers are actually affected by NIS2. So if you are a company and you might not be directly impacted by NIS2, but you are supplying to one of those, for instance, if you are supplying to a government or you're supplying to the financial sector, or you're supplying to the food sector, also your company will be affected, because one very important principle in NIS2 is supply chain security, which is very often not very well treated within corporations. NIS2 is risk-based. Incident reporting is very crucial. You only have 24 hours to report a risk, and then you have a few more hours to actually analyze the incident and report it again.
There is also a list of 10 organizational and technical measures that you need to implement. Very important is that if there are any board members participating, there is the personal accountability of the board under NIS2. This is actually often a very good entry ticket to convince corporations that they should deal with NIS2. To deal with NIS2 requires mainly technical knowledge, but it also requires some skills such as procurement power. You do need to have the right experience to deal with suppliers, for instance. Also, you do need to know about creating business continuity plans, incident response plans, drafting policies, dealing with technical implementation, the IT department, IT suppliers, and so on.
One very particular act is the Digital Operational Resilience Act (DORA), which is kind of similar to NIS2, but is very much focused on the financial sector in the broad sense. Principles are risk management, incident classification and reporting, resilience testing, and again, we have this third party or supplier risk management. It requires technical and practical knowledge and auditing skills as well. Even if there are these very strict security obligations, there is still some space to move, and therefore it's important that you actually know how to deal with that.
Finally, we have the AI Act, or Artificial Intelligence Act, which has a different focus, which is to ensure safe, ethical, and trustworthy AI systems. The scope does not just affect the development or the deployment, but also the use of AI within the EU. Principles are risk-based, but also you need to check to which risk category your system belongs. Depending on the risk level, the obligations are hugely different. In general, the obligations are about transparency, documentation and bias detection. Those who are into AI know that bias is a huge problem. The AI Act stipulates that you need to take correct measures to avoid bias in your system. Also there are specific rules about your training, training sets, data that you are using for training, human oversight, and also cybersecurity. To deal with the AI Act mainly requires legal knowledge, but also technical and even ethical understanding. You need to know what those conformity assessments are like, and you need to understand what machine learning is like. If you don't know what a neural network is, then you can't understand what the AI Act is about.
All those regulations combined can be considered as being Europe's digital trust framework, and they all interact with each other. For example, if you are dealing with AI, the data you are feeding your AI systems with needs to be GDPR compliant. If your data is not GDPR compliant, then actually you are polluting your AI system, and it is very hard to get it clean again. Under NIS2, depending on whether you are considered an essential entity or an important entity, the fines can be very hefty, up to €10 million, or even twice that amount, if you make the same mistake again. There are also a lot of administrative sanctions, and the authorities might even appoint a control officer to supervise your compliance or fire a manager in your company. NIS2 is still new, so we can expect the fines to increase in the future.
But it is not just a burden, there are also a lot of opportunities. It's an opportunity to get more profits by addressing new markets. It's a way to protect your assets. It also has an interesting crossover to governance and efficiency, and it can even be considered as an innovation catalyst. Compliance is your entry ticket into the EU market. It is a trust enabler for your partners, regulators, and consumers. It makes that you can be a market differentiator, which gives you in turn positive PR, and it can give you some brand reputation, or even boost the reputation of your company. The most important reason to be compliant is cybersecurity and privacy and protecting your own assets. There's a reduced risk of data breaches, cyber incidents and internal accidents, which also means that there is a much lower risk for fines, lawsuits, and this famous wall of shame. It's not just about your data, it's also about your own intellectual property, which is much better protected. Moreover, many cyber insurance companies will give you lower premiums when you have proven that you are compliant. In case something does happen, the chances that your insurance company will pay you are much higher.
It is also much easier to get financing when you can prove that you are handling your data carefully. The average costs of a data breach has been increasing in the past years to about 4 to 5 million euros or dollars, which is much higher than the cost of protection. As companies are increasing the maturity of their cybersecurity and compliance in AI, you see that the overall maturity of the company is increasing by leveraging principles as privacy by design and security by design, which means that your systems, applications and processes are way more agile. It will be easier to attract high-skilled people. In the war for talent, nobody wants to work anymore for a shabby organization that is careless about their data. It is also much easier to attract investors or partners. A very interesting opportunity is that you should take this as a catalyst for innovation. Do not see this merely as a cost, but consider this as an investment.
It might also be worth considering certification. This doesn't solve everything, and it's not because you're certified that you're compliant, but it does show that you are on a very good way to compliance. One of the most popular certifications is ISO 27001, there are many others depending on the business that you're in, but you can also get certified against GDPR. Finally, it's important that you have some kind of information security management system and a corporate risk management system. The last key success factor is that you should not consider it as a one-off, but as a continuous exercise, because the regulatory frameworks are evolving, technology is changing, case law continues to appear, and threats are ever-changing and becoming different.
The costs of compliance can be estimated at about 0.25% of turnover, which is actually a pretty low percentage compared to what you can win, which is 10% to 15% of turnover. So the return on investment is high.
A Q&A session concluded the webinar.
