Who is liable for AI entries under NIS2?
Under Art. 20(1) NIS 2, management approves the measures, oversees their implementation and can be held liable for infringements, whoever filled in a field. In the walkthrough every entry an assistant makes stands under the name of the person who connected it. No assistant can finish or approve an item.
What does NIS 2 give to management?
Under Art. 20(1) NIS 2, management approves the risk management measures under Art. 21. It oversees their implementation and can be held liable for infringements.
In Germany, § 38(1) BSIG transposes this: management is obliged to implement the measures and oversee their implementation.
For certain digital services, Implementing Regulation (EU) 2024/2690 goes further. Under point 2.1.1 of its Annex, management accepts the risk assessment results and the residual risks, or an accountable person who reports to it.
None of these provisions mentions AI. The duty to approve and oversee stays with management, whoever filled in a field.
Art. 20(1) NIS 2 · § 38(1) BSIG · Annex point 2.1.1 CIR (EU) 2024/2690
Whose entry is it in the walkthrough?
In the walkthrough an assistant works as the person who connected it, with exactly their rights. What it saves appears in the activity log under that person's name, with “via” and the assistant's name.
So it is that person's entry. They connected the assistant and can disconnect it in Settings at any time.
With the switch “Allow AI assistants for this company” an admin can turn assistants off for the whole company. That ends every connection.
Why can the assistant not approve anything?
Approval belongs to management, so the MCP server has no tool for it. An assistant cannot finish an item, cannot record that the company decided not to do one, and cannot approve anything.
At 7.3 only someone who has been assigned the team role “CEO / Managing Director” can approve, signed in with their own account. The name and the date of the approval then stand on each document they approved.
What does the AI Act say?
A company that uses an AI assistant at work is its “deployer” under Art. 3(4) AI Act. Art. 4 as amended by Regulation (EU) 2026/1744 asks deployers for measures that support the AI literacy of their staff, with no specific level required.
In our reading, not an authority's, filling in NIS 2 records is not a high-risk use under Annex III. Our article on NIS 2 and the AI Act covers this in more detail.
Art. 3(4) and Art. 4 AI Act
Does management have to understand what it approves?
Approving and overseeing assume that management understands what it decides on. Under Art. 20(2) NIS 2, members of management have to follow training.
In Germany, § 38(3) BSIG requires management to take part in training regularly.
In the walkthrough this is item 1.1. An assistant can record there who was trained when, and upload the certificate if it can send files itself. Management has to take part itself.
Art. 20(2) NIS 2 · § 38(3) BSIG
How the walkthrough does it
In the walkthrough, accountability shows in two places: training at the start and approval at the end.
1.1 Get management trained: an assistant records who in management was trained when. Management attends the training itself.
Before finishing each item, a person reads the screens that carry an assistant's mark and corrects in the app what is wrong.
7.3 Record the management review: management sees its risks and the open points, each with a record of who takes care of it and by when, and approves the documents. Name and date are recorded.
After that, the server refuses an assistant's change to a list a signed item rests on. A person makes such changes in the app, and the item goes back to management.
Common questions
Who is liable if the AI enters something wrong?
In the walkthrough the entry stands under the name of the person who connected the assistant. Your NIS 2 obligations do not change: management approves the measures and oversees their implementation. That is why a person should check every item before finishing it.
Who has to accept a risk assessment an AI produced?
Under Art. 20(1) NIS 2, management approves the measures. For certain digital services, point 2.1.1 of the Annex to Implementing Regulation (EU) 2024/2690 has management accept the results and residual risks, or an accountable person who reports to it. In the walkthrough an assistant rates in 2.3, but it cannot approve at 7.3.
Can we see later which entries came from AI?
Yes. Every screen an assistant wrote carries its name and the day. The activity log shows each change under the person's name, with “via” and the assistant's name.
Can a managing director leave the approval to their own assistant?
Not in the walkthrough. There is no tool for it, not for a managing director's assistant either. Management approves in the app, with its own account, and its name and the date then stand on each approved document.
Read next
Sources
- Directive (EU) 2022/2555 (NIS 2), Art. 20(1) and (2), EUR-Lex
- BSIG, § 38(1) and (3), gesetze-im-internet.de
- Implementing Regulation (EU) 2024/2690, Annex point 2.1.1, EUR-Lex
- Regulation (EU) 2024/1689 (AI Act), Art. 3(4), Art. 4 and Annex III, Art. 4 as amended by Regulation (EU) 2026/1744, EUR-Lex
- open-isms, lib/mcp/procedures.ts and server/trpc/routers/durchgang.ts (the approval), github.com/NISD2/open-isms
In practice
Where this comes up in the walkthrough
The walkthrough turns this into steps you fill in, with the law explained beside each one. Open a step to see its screen, filled in for a made-up company.
Effectiveness Assessment
Record the management review
Management checks whether the measures work and approves your documents.
Governance & Liability
Get management trained
Every member of management, regularly.
What the walkthrough costs
€4,800 net a year, plus VAT
30 days money backBy invoice, due in 30 days. Cancel within the first 30 days: invoice cancelled or money back.
Guided NIS 2 implementation, step by step
A history of changes and sign-offs to show your regulator
Deadlines and reminders for each requirement
Security questionnaire for your suppliers
Export to PDF or CSV at any time
Been asked to handle NIS2?
In the end you have everything in one document: what is done, what is still open, and your management's approval with name and date. The app writes the texts.
