Does NIS2 apply to AI systems?

NIS2 (Directive (EU) 2022/2555) applies to essential and important entities in the sectors it lists, and covers all the network and information systems they rely on, which includes AI systems and AI services. In-scope organisations must manage cybersecurity risks, including supply-chain risks from AI vendors, and report significant incidents within strict deadlines.

How it works

1. Check whether your organisation is in scope under your country's NIS2 law.
2. Include AI systems and AI suppliers in your cybersecurity risk management.
3. Make sure AI-related incidents feed into your incident reporting process.
4. Keep sealed logs that show what happened and when.