MCP or uploading documents to ChatGPT: what is the difference for NIS2?
A chat such as ChatGPT gives you text that you paste somewhere yourself. An assistant connected over MCP writes straight into the NIS 2 walkthrough's lists, through the same checks as the app, under your name and marked on the screen. For a draft you read and paste in yourself, a chat is fine.
What is the difference between MCP and a chat with documents?
In a chat you upload an accounts payable list or an inventory and ask for a supplier list. Back comes text or a table, which you copy into your records by hand.
The chat knows only what you uploaded, as it stood on the day you uploaded it. What a colleague added to the walkthrough yesterday, it does not see. And later nobody can tell which row came from the chat.
An assistant connected over MCP reads the current state of your walkthrough before it writes: the answers so far and the rows already on a list. Then it enters each fact where it belongs.
What does the server check when the assistant enters data?
Every entry goes through the same checks as in the app; a date has to be a date, for example. Two more rules apply to assistants: the server refuses an empty answer, and it does not change a signed item.
What does not fit goes back to the assistant with the reason.
It saves as you, with your rights. The activity log shows the change under your name with “via” and the assistant's name. The screen shows which assistant wrote it on which day.
Where does the data go, in a chat and over MCP?
If the model runs at a vendor, that vendor sees what the assistant works with in both cases. In a chat that is what you upload or paste, over MCP it is what the assistant reads from the walkthrough.
Both run under your company's agreement with that vendor. If the assistant and the model run on your own hardware, nothing leaves your network.
Anthropic describes one difference for Claude. Feedback data, meaning what you send with the thumbs up or down button, does not include raw content from connectors, including remote and local MCP servers, “though data may be included if it's directly copied into your conversation with Claude”.
For its commercial products Anthropic also states that inputs and outputs are not used for training by default. We have not checked the terms of OpenAI or Microsoft; read your company's agreement with them.
When is a chat fine?
For a text you read and paste in yourself anyway. The security policy in 2.4, for example, has the field “Anything else that applies at your company (optional)”. You can have a chat draft that, read it, and copy it into the field.
Give the chat only what it needs for the wording, then. It does not need names, network diagrams or credentials for that.
For lists with many rows, and for facts someone should be able to trace later, a connected assistant has more going for it.
What does MCP not solve?
A connected assistant can be wrong just as a chat can. The mark on the screen shows you where to look, and you finish the item yourself.
Text in your records can also contain sentences a model takes for instructions. This is called prompt injection. In its baseline protection against indirect prompt injections (version 1.0, 14.09.2026) the BSI notes that no reliable countermeasure exists that removes the problem completely.
The server tells the assistant to treat everything it reads as data, and it marks filling in as a step that changes data. Choose an assistant that asks you before such a step.
How the walkthrough does it
The difference shows in the lists at the start of the walkthrough and in the security policy.
2.2 Write down what your company has: the assistant ticks the entries directly and describes them. You type nothing, but you do check.
Each of these changes then appears in the activity log under your name, with “via” and the assistant's name.
2.4 Write the security policy: both work here. An assistant picks the sections and writes what else applies, or you copy a draft from a chat into the field.
Either way the policy stays a draft until management approves it at 7.3.
Common questions
Does the vendor see less of our data with MCP?
Not as such. What the assistant reads goes to its vendor, so the model can work with it. The difference lies in what you copy into a conversation yourself, and with Anthropic in what can end up in feedback data.
May a connected assistant do more than a chat?
Yes, it may write in your walkthrough, as you. That is why an admin first turns on “Allow AI assistants for this company”, and each person can disconnect theirs in Settings. A chat without a connection changes nothing in your records.
Can I use MCP directly in ChatGPT?
Yes, ChatGPT and Claude can add an MCP server as a custom connection and sign in through the browser for it. Articles of their own on ChatGPT and on Claude explain how. So far we have tested Claude Code, not these two.
Which is better for a first supplier list?
If your accounts payable list exists as a file, a connected assistant. It creates the suppliers in 5.1 directly in the list that 2.3 and 5.2 need later. You check the list and remove in the app anything that is not a supplier.
Read next
- Connecting ChatGPT to the NIS2 walkthroughAs a custom MCP server with a browser sign-in, since ChatGPT takes no pasted key. What has to be reachable for it.
- What is a NIS2 MCP server?The connection through which your own AI assistant reads and fills in the walkthrough, as you. What it does, what it may not do and how to start.
- Tracing AI entries: the audit trailEvery screen an assistant wrote carries its name and the day. Every change is in the log under the person, via the assistant.
- Claude custom connector: connecting the NIS2 walkthroughAs a custom connector with “Register automatically”. Which plan, who adds it, and why Claude needs an instance reachable from the internet.
Sources
- Anthropic Privacy Center, Is my data used for model training?, privacy.claude.com, updated 18.08.2026
- BSI, Basisschutz gegen Indirect Prompt Injections in dokumentbasierten LLM-Chats, version 1.0, 14.09.2026, bsi.bund.de
- OpenAI Developers, authentication documentation, developers.openai.com/plugins/build/auth
- open-isms, lib/mcp/tools.ts and lib/mcp/agent.ts, github.com/NISD2/open-isms
- open-isms, content/docs/self-hosting/mcp.md, github.com/NISD2/open-isms
In practice
Where this comes up in the walkthrough
The walkthrough turns this into steps you fill in, with the law explained beside each one. Open a step to see its screen, filled in for a made-up company.
Risk Management
Write down what your company has
A list of the processes, software and devices you work with.
Risk Management
Write the security policy
A short policy that management approves.
What the walkthrough costs
€4,800 net a year, plus VAT
30 days money backBy invoice, due in 30 days. Cancel within the first 30 days, before the first export or sign-off: invoice cancelled or money back.
Guided NIS 2 implementation, step by step
A history of changes and sign-offs to show your regulator
Deadlines and reminders for each requirement
Security questionnaire for your suppliers
Export to PDF or CSV at any time
Been asked to handle NIS2?
In the end you have everything in one document: what is done, what is still open, and your management's approval with name and date. The app writes the texts.
