Your applicability engine works in two layers. The first is EU-wide, covering rules like eIDAS 2.0, DORA, AMLR, and GDPR that apply to any EU profile. The second is a set of national overlays for Germany, Austria, and Switzerland, which add country-specific requirements such as BSI C5 cloud attestation, the Telematikinfrastruktur health-card migration, statutory written-form law, ZertES, and FINMA outsourcing rules, along with the revised Federal Act on Data Protection. Together, these two layers mean most profiles end up with three to seven applicable regulations.