Q: What is a GPAI model and does that regime affect me?

GPAI means 'general-purpose AI' — broadly usable models such as large language models. The model's provider has its own duties (transparency, technical documentation, a copyright policy; extra requirements for systemic risk). If you use a GPAI model in your own application, you are usually not the model provider, but the rules for your application apply.

Q: Does my company fall under NIS2?

That depends on your sector and size. NIS2 targets 'essential' and 'important' entities in designated sectors — including transport and logistics — above certain thresholds. Transport is named explicitly as an essential sector. The Dutch implementing law sets the precise scope.

Question 1

Does the AI Act apply now, or only from 2027?

Accepted Answer

Partly already. The prohibited practices (Art. 5) and the AI-literacy duty (Art. 4) have applied since 2 February 2025, and the GPAI regime since 2 August 2025. The heaviest high-risk obligations are shifting — expected to 2 December 2027 via the Digital Omnibus agreement — but until that is in the Official Journal, the formal date stands.

Question 2

Is my AI system high-risk?

Accepted Answer

Usually not. A system is only high-risk if it falls under an Annex III category (such as recruitment, lending or critical infrastructure) and genuinely plays a meaningful role in the decision. A large share of AI uses fall outside it; the classification depends on your concrete use.

Question 3

Do I already need to act on AI literacy?

Accepted Answer

Yes. Since 2 February 2025 every organisation deploying AI must ensure sufficient AI literacy among those who work with it (Art. 4). There is no revenue threshold or sector exemption. It is role-based knowledge — knowing what the system can do, its risks and when a human steps in — not a mandatory course.

Question 4

What is a GPAI model and does that regime affect me?

Accepted Answer

GPAI means &#x27;general-purpose AI&#x27; — broadly usable models such as large language models. The model&#x27;s provider has its own duties (transparency, technical documentation, a copyright policy; extra requirements for systemic risk). If you use a GPAI model in your own application, you are usually not the model provider, but the rules for your application apply.

Question 5

How high are the fines under the AI Act?

Accepted Answer

The heaviest category — deploying a prohibited AI practice — can cost up to €35 million or 7% of worldwide annual turnover, whichever is higher. Other infringements carry lower maxima. Enforcement is being phased in.

Question 6

What is the difference between the Data Act and the GDPR?

Accepted Answer

The GDPR concerns personal data; the Data Act concerns access to and sharing of (mainly non-personal) data from connected products, such as sensors and on-board units. They can overlap: if your product data also contains personal data, both apply at once.

Question 7

Does my company fall under NIS2?

Accepted Answer

That depends on your sector and size. NIS2 targets &#x27;essential&#x27; and &#x27;important&#x27; entities in designated sectors — including transport and logistics — above certain thresholds. Transport is named explicitly as an essential sector. The Dutch implementing law sets the precise scope.

Question 8

Which goods fall under CBAM?

Accepted Answer

CBAM, the carbon border levy, applies to imports of carbon-intensive goods: iron and steel, aluminium, cement, fertilisers, hydrogen and electricity. Importers must report the embedded emissions; the financial obligation is phased in.

Question 9

Does the Platform Work Directive apply to my delivery platform?

Accepted Answer

If you assign and manage work via a digital platform, most likely yes. The directive introduces a legal presumption of employment and sets requirements for algorithmic management (transparency, human oversight). The concrete rules follow from national transposition, due by 2 December 2026.

Question 10

When does ETS2 start and what does it mean for my fuel costs?

Accepted Answer

ETS2 prices the CO2 emissions of fuels for road transport and buildings through a separate emissions trading system, expected from 2027. The cost sits with fuel suppliers and is likely passed through to diesel and pump prices. See the file for the exact date and conditions.

Question 11

Has the AI Act been postponed?

Accepted Answer

Not as a whole. Only the high-risk block and the transparency layer shift (expected to December 2027 and December 2026) via the Digital Omnibus agreement. The prohibited practices, the AI-literacy duty and the GPAI regime still apply. And until the shift is in the Official Journal, the formal date remains legally binding.

Question 12

What is a FRIA and do I need to do one?

Accepted Answer

A FRIA is the fundamental rights impact assessment of Article 27 of the AI Act. Certain deployers of high-risk AI — mainly public bodies and some private parties — must assess the impact on fundamental rights before putting the system into use. If you don&#x27;t use a high-risk system in such a context, the FRIA is not required.

Question 13

Do I have to disclose that something was made by AI?

Accepted Answer

Often yes. Article 50 of the AI Act requires transparency: users must know when they are interacting with an AI system (such as a chatbot), and AI-generated content and deepfakes must be recognisable as such. These duties apply in phases; see the file for the exact dates.

Question 14

May I monitor my drivers or staff with AI?

Accepted Answer

Not without limits. AI that infers emotions in the workplace has been banned since 2 February 2025 (Art. 5). Other forms of AI monitoring can be high-risk and in any case fall under the GDPR: you need a legal basis, transparency and proportionality. Continuous, intrusive monitoring is legally risky.

Question 15

Do DORA or NIS2 apply to me?

Accepted Answer

For financial entities DORA prevails: it is the lex specialis for digital resilience in the financial sector. If you don&#x27;t fall under it but are in a designated sector (such as transport), NIS2 applies. Some organisations touch both; the file explains the demarcation.

Question 16

What is the Cyber Resilience Act?

Accepted Answer

The Cyber Resilience Act sets mandatory cybersecurity requirements for products with digital elements — from software to connected hardware — across their lifecycle, including security updates and vulnerability reporting. Manufacturers must demonstrate conformity (CE marking). The requirements apply in phases.

Question 17

May I use a digital consignment note (e-CMR)?

Accepted Answer

Yes. The e-CMR is the electronic version of the international consignment note; states that ratified the protocol recognise it as legally valid. In the EU the eFTI Regulation sits on top, requiring authorities to accept digital transport data. See the file for the status per country.

Question 18

From when is eFTI mandatory?

Accepted Answer

The eFTI Regulation requires authorities to accept transport information digitally when a company provides it electronically; that acceptance duty starts in 2027. For companies, providing it is not an obligation but a right — and increasingly the norm in practice. See the file for the exact date.

Question 19

What does AEO status get you?

Accepted Answer

AEO (Authorised Economic Operator) is the &#x27;trusted trader&#x27; status in customs law. It brings benefits such as fewer physical checks, faster handling and mutual recognition with third countries. In return there are requirements on compliance, record-keeping and security.

Question 20

Which AI uses are outright banned?

Accepted Answer

Article 5 bans, among others: social scoring by authorities, untargeted facial-recognition scraping, emotion recognition in the workplace and education, biometric categorisation on sensitive traits, certain predictive-policing uses, and manipulative or exploitative AI. These prohibitions have applied since 2 February 2025.

Question 21

When do I, as a user, become a 'provider' under the AI Act?

Accepted Answer

Under Article 25 you, as a deployer, become a provider yourself — taking on the heavier provider duties — if you put your own name or brand on a high-risk system, substantially modify it, or change it so that it becomes high-risk. Responsibility then shifts to you.

Question 22

Do I have to report a serious AI incident?

Accepted Answer

Yes, for high-risk AI. Article 73 requires providers to report serious incidents to the market surveillance authority without undue delay after establishing a causal link. See the file for the exact deadlines per incident type.

Question 23

Does my high-risk AI need CE marking?

Accepted Answer

Yes. High-risk AI must undergo a conformity assessment and carry CE marking before being placed on the market. For most systems this can be done via internal control; in certain cases a notified body is required.

Question 24

Is my planning algorithm high-risk?

Accepted Answer

Possibly. Algorithms that allocate work, monitor performance or evaluate staff fall under the Annex III employment category and can therefore be high-risk. It depends on how decisively the system shapes decisions about people.

Question 25

Do my warehouse robots fall under the AI Act or the Machinery Regulation?

Accepted Answer

Often both. If the robot uses AI as a safety component, the AI Act may apply; on top of that, the new Machinery Regulation sets its own safety requirements. The two regimes stack, with combined CE requirements. See the file for the timeline.

Question 26

What is the GPAI Code of Practice and must I join?

Accepted Answer

The GPAI Code of Practice is a voluntary instrument (Art. 56) through which providers of GPAI models can demonstrate compliance with their duties. Three chapters: transparency, copyright, and safety & security. Joining is not mandatory, but the code is becoming the benchmark in practice.

Question 27

Do I have to mark AI-generated content?

Accepted Answer

Often yes. Providers must mark their AI output in a machine-readable way, and deployers must label deepfakes as artificial (Art. 50). The European Commission published a code of practice showing how; the underlying transparency duty applies in phases.

Question 28

Do I need to adjust my contracts for the Data Act?

Accepted Answer

Probably. The Data Act affects terms on data access and sharing, switching between cloud services, and includes protection against unfair contract terms for SMEs. Review your B2B data and cloud contracts. The regulation has applied since September 2025.

Question 29

What does the PPWR change for my packaging?

Accepted Answer

The Packaging and Packaging Waste Regulation (PPWR) sets requirements on recyclability, recycled content and reducing packaging waste, plus reuse targets. The obligations are phased in. See the file for the relevant dates and exemptions.

Question 30

What is FuelEU Maritime and does it affect my shipping?

Accepted Answer

FuelEU Maritime requires ships to gradually cut the greenhouse-gas intensity of the energy they use on board. It applies to large ships calling at EU ports and is in force from 2025, alongside the ETS for shipping. See the file for the details.

Question 31

What does Euro 7 change for my fleet?

Accepted Answer

Euro 7 tightens vehicle emission limits and adds new requirements, such as limits on brake and tyre particles and rules on battery durability. The standards are phased in; see the file for the dates per vehicle category.

Question 32

What is the EU Digital Identity Wallet (eIDAS 2)?

Accepted Answer

Under the revised eIDAS Regulation, member states must offer citizens and businesses a European Digital Identity Wallet to prove identity and documents securely and across borders. Rollout is foreseen from 2026; see the file for the status.

Question 33

What are the NIS2 reporting deadlines for an incident?

Accepted Answer

For a significant incident there is a staged duty: an early warning within 24 hours, a fuller notification within 72 hours, and a final report later. The precise handling runs via the national CSIRT/authority.

Question 34

My customer asks for CSRD data while I don't report myself — must I provide it?

Accepted Answer

Formally you are not in scope if you fall below the CSRD thresholds, but large customers and banks increasingly request ESG data through the value chain. In practice, providing it becomes part of the contract: not delivering can cost you the business.

Question 35

Does the AI Act apply to small businesses (SMEs)?

Accepted Answer

Yes. There is no size threshold and no SME exemption: the AI Act applies whether you have 5 or 5,000 people, and also if you only use AI rather than build it. There are SME support measures, though, such as free access to regulatory sandboxes and simplified technical documentation. Want to know what affects you? Take the free scan on yrproject.

Question 36

Is there a free way to check what the AI Act means for me?

Accepted Answer

Yes. The free AI Act scan on yrproject shows in a few minutes which rules affect you — prohibited practices, high risk, GPAI, transparency and AI literacy — with a readiness score, your biggest gaps and source references. No account needed; everything stays local in your browser.

Question 37

How do I start making an inventory of my AI systems?

Accepted Answer

Start with an inventory: which AI systems do you use or build, for what purpose, and what role does the system play in decisions about people? That determines the risk class and therefore your obligations. Over half of organisations don&#x27;t yet have such an overview — it&#x27;s the first step. The free scan on yrproject structures this inventory for you.

Question 38

What steps should I take before the AI Act deadlines?

Accepted Answer

Four steps, in order: (1) inventory your AI systems; (2) classify them (prohibited, high-risk, GPAI, transparency); (3) sort out AI literacy now — that duty already applies; (4) for high-risk AI, build the management system (EN ISO/IEC 42001 helps) and layer the harmonised standards on later. Start with the free scan to see your baseline and gaps.

Question 39

May I use copyright-protected material to train AI?

Accepted Answer

For commercial AI training in the EU you rely on the text-and-data-mining exception (Art. 4 DSM Directive): it applies unless the rightholder made a machine-readable reservation. The AI Act obliges GPAI providers to respect that reservation and to publish a summary of the training data — including for models trained outside the EU but placed on the EU market.

Question 40

Do I own the copyright in what an AI produces?

Accepted Answer

Purely machine-generated output in principle carries no copyright: protection requires a human creative choice (an &#x27;author&#x27;s own intellectual creation&#x27;, CJEU). If you give the final result your own stamp through selection, editing or targeted instructions, it may be protected. Where the line falls is case-specific; arrange exclusivity contractually if needed.

Question 41

Do autonomous AI agents fall under the AI Act?

Accepted Answer

There is no separate &#x27;agent&#x27; category, but agentic AI is firmly covered: the underlying model via the GPAI regime, the risk class via the use (Annex III = high-risk), plus the duties on transparency (Art. 50) and human oversight (Art. 14). The sharpest open question is liability for what an agent does autonomously. Treat an agent as high-risk until analysis shows otherwise.

Question 42

May I use AI in recruitment and hiring?

Accepted Answer

Yes, but under conditions. AI for recruitment, selection and workforce management falls under Annex III of the AI Act and is high-risk — for every employer, regardless of sector or size. You must build in human oversight, inform candidates and workers, and comply with the GDPR for automated decisions. Emotion recognition in the workplace is banned outright.

Question 43

Which incidents must AI providers report to the authorities?

Accepted Answer

Providers of high-risk AI must report serious incidents to the market surveillance authority (Art. 73). &#x27;Serious&#x27; includes death or serious harm to health, serious and irreversible disruption of critical infrastructure, breaches of fundamental rights, and serious damage to property or the environment. Reporting is without undue delay after establishing a causal link; see the file for the exact deadlines.

Question 44

What is AEO and why apply for the status?

Accepted Answer

AEO (Authorised Economic Operator) is the customs status of &#x27;trusted trader&#x27;. You apply for it because it brings concrete benefits: fewer physical and document checks, priority treatment, simplifications and mutual recognition with third countries. In return there are requirements on compliance, record-keeping, solvency and security.

Question 45

Does NIS2 apply to the transport and logistics sector?

Accepted Answer

Yes. Transport is a designated essential sector under NIS2 — road, rail, air and water transport and related infrastructure. Medium and large entities must take risk-management measures, report incidents and ensure compliance at board level. The precise scope follows from the national implementing law.

Question 46

Do I have to register my organisation under NIS2?

Accepted Answer

Often yes. Member states must set up a registration mechanism, and entities in scope of NIS2 must register with the competent authority or CSIRT, providing basic details such as contact points and the member states where they operate. Certain digital service providers face a specific registration duty. See the file for the Dutch implementation.

Question 47

What does NIS2 mean for management liability?

Accepted Answer

NIS2 makes cybersecurity a management responsibility. The board must approve the risk-management measures, oversee their implementation and undergo mandatory training — and can be held personally liable for serious negligence. Cybersecurity is thus no longer an IT matter but a boardroom one.

Question 48

Does medical AI fall under the AI Act or the MDR?

Accepted Answer

Often both. If the AI is a medical device (or part of one), the MDR applies with CE marking; at the same time AI as a safety component in such a regulated product is high-risk under the AI Act (Annex I). The conformity assessment is aligned as far as possible, via the same notified body. Health data also falls under the GDPR as special-category personal data.

Question 49

May an algorithm automatically reject a candidate?

Accepted Answer

In principle no. GDPR Art. 22 prohibits decisions based solely on automated processing that significantly affect someone — such as an automatic rejection — unless safeguards apply (information, human intervention, objection). The AI Act adds meaningful human oversight for high-risk recruitment. &#x27;A human presses the button&#x27; is not enough.

Question 50

How do I prevent AI discrimination in recruitment?

Accepted Answer

Recruitment AI is high-risk: the AI Act requires representative, bias-examined training data (Art. 10) and human oversight (Art. 14). Test your data and outcomes for unequal effects on protected groups, keep a human in the loop, and document your bias checks. Equal-treatment law and the GDPR also apply — a skewed outcome can be unlawful on three tracks.

Question 51

May I monitor employees with AI?

Accepted Answer

Within limits. Emotion recognition in the workplace is banned (Art. 5). Performance or behaviour monitoring can be high-risk (Annex III) and in any case falls under the GDPR: you need a valid legal basis, transparency and proportionality, often a DPIA, and in many countries works-council approval. Continuous, intrusive monitoring is legally risky.

Question 52

Does the AI Act apply to schools and education?

Accepted Answer

Yes, and strictly. AI that determines admission, evaluates learning outcomes, assesses the level of education or monitors test behaviour (proctoring) falls under Annex III and is high-risk. Emotion recognition in educational institutions is also banned (Art. 5). The GDPR applies too, often involving minors&#x27; data, plus the AI-literacy duty.

Question 53

Does the AI Act apply to government?

Accepted Answer

Yes, and extra strictly. AI that determines access to public services or benefits, or is used in law enforcement, migration or justice, is high-risk (Annex III). As deployers, public authorities must carry out a fundamental rights assessment (FRIA, Art. 27) before use and be transparent to citizens. The SyRI case shows why: transparency and proportionality are decisive.

Question 54

What is the European Health Data Space (EHDS)?

Accepted Answer

The EHDS is an EU regulation that gives citizens access to and control over their electronic health data and enables cross-border exchange (primary use), and governs the reuse of health data for research and policy via access bodies (secondary use). It builds on the GDPR and forms the backbone of trustworthy healthcare AI. Application is phased.

Question 55

Is AI online proctoring (exam surveillance) allowed?

Accepted Answer

Under conditions. AI that detects prohibited behaviour during tests is high-risk (Annex III): human oversight on every flag, transparency and logging. If the tool measures emotions or &#x27;engagement&#x27;, it is banned (Art. 5). The GDPR also requires proportionality (is there a less intrusive alternative?) and a DPIA — especially for minors.

Question 56

Must governments publish or register their algorithms?

Accepted Answer

Yes, in two ways. Dutch governments publish their algorithms in the national Algorithm Register (transparency to citizens). In addition, the AI Act requires registration of high-risk AI in an EU database (Art. 49/71) — also by the authority deploying such a system. Keep the information consistent with your fundamental rights assessment (FRIA).

Question 57

Prohibited AI practices (Article 5): the hard floor that already applies

Accepted Answer

Article 5 is the hardest provision of the AI Act: not obligations or conditions, but an outright ban. It has applied since 2 February 2025, to providers and deployers alike, and the Digital Omnibus agreement of May 2026 changes nothing about it (see the timeline). Violations risk the regulation&#x27;s highest fine category: up to €35 million or 7 percent of worldwide annual turnover (Article 99(3)).

Question 58

High-risk AI mapped: classification and obligations in one overview

Accepted Answer

The high-risk regime of Chapter III is the centre of gravity of the AI Act: by far the most obligations, the conformity assessment and the CE marking hang from it. It is also the part whose date of application is expected to shift, under the Digital Omnibus agreement of 7 May 2026 (see the timeline), to 2 December 2027 (Annex III) and 2 August 2028 (Annex I). What has to be done does not change — only when.

Question 59

FRIA: when must I run a fundamental-rights impact assessment (Art. 27)?

Accepted Answer

Short answer: Not every user of high-risk AI has to run a fundamental-rights impact assessment (FRIA). Article 27 of the AI Act imposes that duty only on specific deployers: public bodies, private parties that provide public services, and those using high-risk AI to assess creditworthiness or for risk assessment and pricing in life and health insurance. The FRIA must be completed before first use.

Question 60

The AI Act timeline of obligations: what applies when

Accepted Answer

The AI Act (Regulation (EU) 2024/1689) entered into force on 1 August 2024, but its obligations apply in stages. Since the political agreement on the Digital Omnibus of 7 May 2026, two timelines moreover run in parallel: the dates currently written in the regulation, and the dates politically agreed but not yet published in the Official Journal. Anyone navigating this field needs to know both.

Question 61

The GPAI regime: what providers of general-purpose AI models must already do

Accepted Answer

While the high-risk obligations are expected to shift to late 2027, the regime for general-purpose AI models (GPAI) is already running at full speed. Chapter V has applied to new models since 2 August 2025, and on 2 August 2026 the European AI Office gains the power to enforce it. For anyone offering large models — or building on them — this is currently the most concrete part of the AI Act.

Question 62

Article 4 AI Act: the literacy obligation that already applies

Accepted Answer

Article 4 of the AI Act is one of the least conspicuous but most broadly applicable provisions of the law. It has applied since 2 February 2025, it touches virtually every organisation that uses AI systems — including those that merely deploy a generative AI assistant — and it was not postponed by the Digital Omnibus agreement of May 2026.

Question 63

Article 50: chatbots, deepfakes and the duty to make AI recognisable

Accepted Answer

Between the prohibitions (already applicable) and the high-risk regime (expected late 2027) sits Article 50: the transparency layer that touches nearly every organisation deploying AI towards the public. Under the Digital Omnibus agreement of 7 May 2026 this layer becomes applicable on 2 December 2026 — formally, until publication in the Official Journal, the date still reads 2 August 2026 — and the accompanying marking code of practice was published in final form on 10 June 2026.

Question 64

AI Act: how high are the fines and who enforces?

Accepted Answer

Short answer: The AI Act (Regulation (EU) 2024/1689) sets tiered fines in Article 99, rising to EUR 35 million or 7% of total worldwide annual turnover for breaching the prohibition on certain AI practices — whichever is higher applies. Enforcement is shared: national market surveillance authorities enforce within the Member States, while the European Commission&#x27;s AI Office supervises providers of general-purpose AI models.

Ask the analyst: answers with sources

Ask a question

Keep asking — or apply this to your own systems?

Does the AI Act apply now, or only from 2027?

Is my AI system high-risk?

Do I already need to act on AI literacy?

What is a GPAI model and does that regime affect me?

How high are the fines under the AI Act?

What is the difference between the Data Act and the GDPR?

Does my company fall under NIS2?

Which goods fall under CBAM?

Does the Platform Work Directive apply to my delivery platform?

When does ETS2 start and what does it mean for my fuel costs?

Has the AI Act been postponed?

What is a FRIA and do I need to do one?

Do I have to disclose that something was made by AI?

May I monitor my drivers or staff with AI?

Do DORA or NIS2 apply to me?

What is the Cyber Resilience Act?

May I use a digital consignment note (e-CMR)?

From when is eFTI mandatory?

What does AEO status get you?

Which AI uses are outright banned?

When do I, as a user, become a 'provider' under the AI Act?

Do I have to report a serious AI incident?

Does my high-risk AI need CE marking?

Is my planning algorithm high-risk?

Do my warehouse robots fall under the AI Act or the Machinery Regulation?

What is the GPAI Code of Practice and must I join?

Do I have to mark AI-generated content?

Do I need to adjust my contracts for the Data Act?

What does the PPWR change for my packaging?

What is FuelEU Maritime and does it affect my shipping?

What does Euro 7 change for my fleet?

What is the EU Digital Identity Wallet (eIDAS 2)?

What are the NIS2 reporting deadlines for an incident?

My customer asks for CSRD data while I don't report myself — must I provide it?

Does the AI Act apply to small businesses (SMEs)?

Is there a free way to check what the AI Act means for me?

How do I start making an inventory of my AI systems?

What steps should I take before the AI Act deadlines?

May I use copyright-protected material to train AI?

Do I own the copyright in what an AI produces?

Do autonomous AI agents fall under the AI Act?

May I use AI in recruitment and hiring?

Which incidents must AI providers report to the authorities?

What is AEO and why apply for the status?

Does NIS2 apply to the transport and logistics sector?

Do I have to register my organisation under NIS2?

What does NIS2 mean for management liability?

Does medical AI fall under the AI Act or the MDR?

May an algorithm automatically reject a candidate?

How do I prevent AI discrimination in recruitment?

May I monitor employees with AI?

Does the AI Act apply to schools and education?

Does the AI Act apply to government?

What is the European Health Data Space (EHDS)?

Is AI online proctoring (exam surveillance) allowed?

Must governments publish or register their algorithms?

Prohibited AI practices (Article 5): the hard floor that already applies

High-risk AI mapped: classification and obligations in one overview

FRIA: when must I run a fundamental-rights impact assessment (Art. 27)?

The AI Act timeline of obligations: what applies when

The GPAI regime: what providers of general-purpose AI models must already do

Article 4 AI Act: the literacy obligation that already applies

Article 50: chatbots, deepfakes and the duty to make AI recognisable

AI Act: how high are the fines and who enforces?

May I monitor my drivers with AI?

AI in recruitment for logistics: is it high-risk under the AI Act?

Is eFTI mandatory for me as a carrier?

The Data Act for transport and logistics: who gets access to your vehicle and supply-chain data?

Which goods fall under CBAM?

Does NIS2 apply to my transport or logistics company?

When does ETS2 actually start?

EMSWe: one maritime window for ship and port reporting

Cyber Resilience Act: security requirements for connected products

eCMR: the electronic consignment note in road transport

FuelEU Maritime & EU ETS: decarbonisation reaches shipping

PPWR: the packaging regulation reshapes your logistics

CSRD after the Omnibus: who in transport still has to report?