Sensaka Data Center MonitoringSensaka
    Back to BlogAnalysis · AI-era IT jobs

    Compliance is the IT job Europe keeps creating: AI Act, NIS2, DORA

    European IT postings kept falling after the new rules arrived. The rules still changed the jobs: compliance, governance and named regulations moved into leadership and security ads, and the security chief moved closer to the CEO.

    November 2026 7 min readDa Li

    Part of the AI-era IT jobs series. Start with CIO and IT manager jobs grew 26 %. The managers under them got cut..

    Table of Contents
    1. Five dates in twelve months
    2. Compliance moved into the job ad
    3. Fewer openings, more duties
    4. Poland: late, then all at once
    5. What this means if you work in IT in Europe
    6. Sources

    In the winter of 2022-23, not one of the 148 security job pages I collected from company career sites named NIS2, DORA, the EU AI Act, the Cyber Resilience Act or ISO 42001. In May to October 2026, 14.2 % of the Europe-based security ads named at least one of them, against 3.9 % of the US ones [job-page study, 2026]. Over the same period, IT operations postings in Germany and France kept falling. The laws have not reversed that fall. They have written new duties into the IT and security jobs that remain, created governance and risk work in regulated sectors, and moved the security chief closer to the CEO.

    // 01

    Five dates in twelve months

    The EU AI Act came into force on 1 August 2024. NIS2 had to be in national law by 17 October 2024, and on 28 November 2024 the Commission wrote to 23 member states that had missed the deadline [European Commission, 2024]. NIS2 covers 18 sectors. DORA has applied to 20 types of financial entity since 17 January 2025 [EIOPA, 2026]. The AI Act's bans and its duty to train staff in AI literacy applied from 2 February 2025, and the rules for general-purpose models from 2 August 2025. The high-risk obligations were due on 2 August 2026 until the Digital Omnibus, published in July 2026, moved them to 2 December 2027 for stand-alone systems and to 2 August 2028 for AI built into regulated products [Gibson Dunn, 2026].

    Timeline of EU AI Act, NIS2 and DORA obligations 2024 to 2028, Poland's NIS2 law and the US federal Chief AI Officer mandate
    Obligation dates for the EU AI Act, NIS2 and DORA, Poland's NIS2 law and the US federal Chief AI Officer memos. Sources: OMB; Gibson Dunn; European Commission; Cloud Security Alliance; Dudkowiak and KPMG.

    The closest US step in this window was inside government. A federal memo of March 2024 gave every agency 60 days to name a Chief AI Officer, and the April 2025 memo that replaced it kept the role [OMB, 2024 and 2025].

    The deadlines show up in budgets. In ENISA's 2025 survey of 1,080 organisations, 70 % named NIS2 and compliance as the main driver of their security spending, and 76 % struggled to attract IT specialists [HaystackID, 2025].

    // 02

    Compliance moved into the job ad

    I counted compliance terms in two sets of company job pages. The first is IT leadership ads, 57 from October 2022 to March 2023 and 116 from May to October 2026. The second is security ads, 148 and 914 for the same periods. The counting script removes legal boilerplate such as "in compliance with applicable laws", and it ignores "DORA" where an engineering ad means the DevOps delivery metrics of that name.

    Share of IT leadership and security job ads mentioning compliance, governance, risk, security standards and EU rules, 2022-23 vs 2026
    Share of company job pages mentioning each term, US and Europe pooled. Source: job-page study, Greenhouse, Lever and Ashby boards; counts in the ai-era-it-jobs study data.

    In leadership ads, "compliance" or "regulatory" went from 19 % to 37 %. "Governance" went from 5 % to 28 %, and ads that name ISO 27001, SOC 2 or NIST went from 4 % to 15 %. In security ads the base was already higher. Compliance went from 38 % to 49 %, named security standards from 22 % to 31 % and governance from 12 % to 23 % [job-page study, 2026].

    The European split is where the regulation shows. In security ads, 14.2 % of the 120 Europe-based pages named NIS2, DORA, the AI Act, the Cyber Resilience Act or ISO 42001, against 3.9 % of 436 US pages. Among leadership ads, 13 of the 22 Europe-based pages in 2026 mention compliance, against 1 of 11 in 2022-23. Those leadership samples are small, so read them as direction. The ads are specific. An N26 controls manager designs controls for ISO 27001, GDPR, DORA, NIS2 and the AI Act. Adyen's security programme manager oversees DORA and other Dutch central bank mandates. GetYourGuide's GRC manager will "shape how we meet obligations like NIS2" [job-page study, 2026].

    AI governance became part of the security job at the same time. In ISACA's 2025 survey, 47 % of security professionals had helped develop AI governance in their organisation, up from 35 % a year earlier [ISACA, 2025].

    // 03

    Fewer openings, more duties

    None of this turned into more openings. Indeed's index of IT operations and helpdesk postings in Germany averaged 100 in August 2024, the month the AI Act came into force, and 65 in September 2026. France went from 119 to 63. The US index fell less, from 77 to 70 [Indeed via FRED, 2026].

    Indeed IT operations and helpdesk postings index, Germany, France and the US, 2022 to 2026, with EU regulation dates marked
    Indeed job postings index, IT operations & helpdesk, monthly mean, February 2020 = 100. Source: Indeed Hiring Lab via FRED, data to 16 October 2026.

    Nothing in this data says the rules caused that fall. The synthesis report behind this series reads Europe's continued decline after 2024, while US postings recovered, as the closest thing to an AI effect in the postings data [synthesis report, 2026]. The rules did not offset it either. The EU's vacancy rate in information and communication fell from 3.9 % to 2.2 % between late 2022 and late 2025, while the number of ICT specialists in work grew from 9.37 million to 10.45 million [Eurostat, 2026]. My reading is that employers are keeping the people they have and adding the new duties to existing jobs.

    The duties also changed who reports to whom. Heidrick & Struggles found 5 % of CISOs reporting to the CEO in 2023, 14 % in 2024 and 42 % in 2025 [Heidrick & Struggles, 2024 and 2025]. NIS2 and DORA make management answer for cyber and ICT risk, and boards responded by moving their security chief closer. A recruiter's 2026 guide to the German market calls DORA the single biggest source of GRC work in financial services [Barclay Simpson, 2026]. The AI side shows up in titles more than in compliance. UK adverts for a "Head of AI" went from 20 in 2024 to 151 in 2026 [ITJobsWatch, 2026], and 38.5 % of Fortune 1000 firms had a Chief AI Officer by early 2026 [DataIQ, 2026].

    From the vendor side, this looks like GDPR again. Most GDPR work arrived after its deadline, and I expect the same here. The synthesis report behind this series forecasts that European GRC and AI-governance hiring peaks in 2027-28, with medium confidence [synthesis report, 2026].

    // 04

    Poland: late, then all at once

    Poland transposed NIS2 about eighteen months late. The amended national cybersecurity act (KSC) came into force on 3 April 2026, and essential and important entities have been registering since 7 May 2026 [Dudkowiak and KPMG, 2026]. In June 2026 the Sejm also passed Poland's own act on AI systems, which sets up a national supervisory commission, KRiBSI [DWF, 2026].

    The demand was there before the law. On LinkedIn, Poland had the second-highest concentration of cyber job demand of 14 countries, 3.5 % of all postings, in 2024 [LinkedIn Economic Graph, 2024]. Cyber ads on No Fluff Jobs roughly doubled between the first quarter and the autumn of 2025 [Antyweb, 2025]. Polish firms are late on AI itself: 8.4 % of firms with ten or more staff used AI in 2025, against 20.0 % across the EU [Eurostat, 2026]. For Polish IT teams the regulatory work in 2026 is mostly NIS2. AI Act work comes later, and the synthesis report puts Poland's GRC hiring peak in 2028 [synthesis report, 2026].

    // 05

    What this means if you work in IT in Europe

    1. Learn to map one regulation to controls and evidence: NIS2 for most sectors, DORA in finance, the AI Act if your company builds or deploys AI. Security ads that name ISO 27001, SOC 2 or NIST went from 22 % to 31 %, and the European ones now name the EU rules on top.
    2. If you are starting out, look at governance, risk and compliance work in a regulated sector. A bank under DORA or an essential entity under NIS2 still needs people to collect evidence and own controls, and someone has to answer for them.
    3. If you run IT, budget for compliance headcount in 2027 whatever happens to your AI plans. Most of the work lands after the deadlines, and the AI Act's high-risk duties start in December 2027.

    NIS2 and DORA evidence starts with knowing what you run and how it is connected, which is the configuration record Sensaka's CMDB & ITSM module keeps.

    // Sources

    Sources

    See hardware, power and cooling health from outside the operating system. Request an online trial and explore how Sensaka brings hardware, operations and business services into one platform.

    Request an Online Trial →
    Core Solution Pillar

    Sensaka AI & GPU Infrastructure Observability

    Full-stack thermal, liquid cooling, and BMC hardware monitoring for high-density NVIDIA H100/B200 GPU racks and AI clusters.

    Explore GPU & AI Observability

    Related articles & analysis

    AI productivity, measured: −19 % to +22 %, not 10×Analysis · AI-era IT jobsWhat's next for help desk and IT support people, 2027–2029Analysis · AI-era IT jobsHelp desk jobs after AI: postings down 49 % in the US and 70 % in the UK, headcount upAnalysis · AI-era IT jobsThe IT job market 2022→2026: openings collapsed, jobs mostly didn'tAnalysis · AI-era IT jobs
    All articles