Do NIS2 records filled in by AI hold up in an audit?

Has any authority allowed or rejected NIS 2 records written by AI?

No, as far as we could check (as of October 2026). We found no statement from the BSI, ENISA or national authorities on whether records written by AI count.

The legal texts do not settle it either. NIS 2 mentions AI only in two recitals, Implementing Regulation (EU) 2024/2690 not at all. What they require is measures (Art. 21 NIS 2) and their approval by management (Art. 20(1)).

The German BSIG expressly requires companies to document how they comply with their duty to take risk management measures (§ 30(1) sentence 3 BSIG). None of these provisions says who has to type the document.

Art. 20(1) and Art. 21 NIS 2 · § 30(1) sentence 3 BSIG

What can supervisors ask for in an audit?

For essential entities, the authority may, among other things, carry out on-site inspections and regular and targeted security audits by an independent body or by the authority itself. It can request information, including your documented policies, and evidence of their implementation (Art. 32(2) NIS 2).

For important entities, the authority acts after the fact, when it has evidence, indications or information that an entity allegedly does not comply with NIS 2 (Art. 33(1)). It then has similar means, without regular audits.

In Germany, § 61 BSIG covers particularly important entities and § 62 BSIG important ones. In a review, a particularly important entity hands over the relevant records, documents and other papers on request (§ 61(5)). For an important entity, the BSI can take the same measures where facts suggest it does not implement its duties, or not correctly (§ 62). Operators of critical facilities prove implementation every three years through security audits, examinations or certifications (§ 39 BSIG).

Art. 32 and 33 NIS 2 · §§ 39, 61 and 62 BSIG

What matters for records an AI filled in?

That they are true. Supervisors can ask for evidence that your policies are implemented (Art. 32(2)(g) and Art. 33(2)(f) NIS 2). A policy describing measures your company does not have does not help with that.

ComplianceForge, a seller of documentation templates and so not neutral, writes from practice: “Auditors don't just review documentation, they compare it to reality.” In other words, auditors hold the records up against what actually happens in the company.

A language model can invent details that sound plausible: a backup schedule that never existed, or a second factor that is not switched on. So the walkthrough's server instructs the assistant to enter only what your documents and systems show, and to leave a field empty rather than guess. That instruction does not guarantee the model follows it.

Art. 32(2)(g) · Art. 33(2)(f) NIS 2

What does the walkthrough show an auditor?

Every change appears in the activity log under the name of the person who made it. If it came through an assistant, it reads “via” and the assistant's name. Every screen an assistant wrote also carries a mark, for example “Filled in by the assistant claude-code/2.1.287 on 16 October 2026”.

Only a person can finish an item; no assistant can. In 7.3 management approves the documents, signed in with its own account. Each document then reads “Approved on” with the date and the name. For each open point, the screen records who takes care of it and by when.

The export “Everything in one document” sums up the whole walkthrough: status, open points, documents, risk matrix and all registers, each requirement with its approval. Admins, reviewers and management can export. The export does not show which entries came from an assistant; the mark in the app and the activity log show that.