Where the laws touch

Yes, for what the two overlap on. DORA calls itself lex specialis with regard to NIS2, so for a financial entity the DORA rules on ICT risk management, incident reporting, resilience testing, information sharing and ICT third-party risk apply instead of the NIS2 ones. NIS2 says the same thing from its own side. The financial entity stays inside the NIS2 ecosystem for cooperation and information flow, and its supervisors still talk to the NIS2 authorities.

Both apply. NIS2 states in its own scope article that it applies without prejudice to the GDPR, so the two run cumulatively: NIS2 governs the security of your network and information systems, and the GDPR governs the personal data those systems process. Where NIS2 requires entities and authorities to process personal data, it points at the GDPR for the lawful basis rather than creating its own.

No, not for the same conduct. If the GDPR supervisory authority has already imposed an administrative fine, the NIS2 competent authority must not impose a NIS2 fine for an infringement arising from the same conduct. The duties still stack, and the authorities must inform each other when an infringement looks like it also entails a personal data breach, but the penalty for that one course of conduct does not land twice.

No. The AI Act says it does not affect the GDPR, and leaves data protection law standing underneath it, with two narrow exceptions it names in its own text. In practice the AI Act leans on the GDPR rather than displacing it: it borrows the GDPR definitions of personal data, profiling and special categories, and it points deployers of high-risk systems at the GDPR data protection impact assessment.

From the GDPR. The AI Act's own definitions article defines special categories of personal data by reference to GDPR Article 9(1), together with the equivalent provisions of the law enforcement directive and the EU institutions regulation. That is why biometric categorisation is treated the way it is: the newest act in the family is built on the oldest one's terms.

It contributes to it, and does not replace it. The AI Act says that where an obligation of the fundamental rights impact assessment is already met by a data protection impact assessment carried out under GDPR Article 35, the fundamental rights assessment complements that assessment. Two instruments, one evidence base, and the AI Act one is still owed.

Both regimes reach it, and they are made to coordinate rather than choose. NIS2 requires the competent authorities to inform the DORA Oversight Forum when they exercise supervisory or enforcement powers over an essential entity that has been designated a critical ICT third-party service provider under DORA. The designation does not remove the NIS2 supervision; it adds a party that has to be told.