NIS2 and the AI Act: what applies when an AI assistant helps?
If a company under NIS 2 uses an AI assistant, both laws apply, to different questions. NIS 2 requires you to protect your IT and management to approve the measures. Under the AI Act your company is a “deployer” and takes measures to support its staff's AI literacy. On our reading, filling in NIS 2 records triggers no high-risk duties.
What does NIS 2 govern, and what does the AI Act govern?
NIS 2, Directive (EU) 2022/2555, requires essential and important entities to take measures that protect their network and information systems (Art. 21). Management approves these measures and oversees their implementation (Art. 20(1)).
The AI Act, Regulation (EU) 2024/1689, governs AI systems according to their risk. It applies, among others, to providers placing AI systems on the market in the EU and to deployers established in the EU (Art. 2(1)). Whether your company falls under NIS 2 plays no part in this.
The two do not refer to each other. The AI Act does not mention NIS 2, and NIS 2 mentions AI only in recitals 51 and 89, as encouragement to use it for cybersecurity.
Is your company a deployer under the AI Act?
Yes, if it uses an AI assistant at work. Under Art. 3(4) AI Act a deployer is anyone using an AI system under its authority, except in the course of a personal non-professional activity. The provider is whoever develops the system and places it on the market under its own name (Art. 3(3)), as a rule the maker of your assistant.
Mind the German wording: the German text calls a deployer “Betreiber”, the same word the BSIG uses for operators of critical facilities. In the AI Act it means anyone using an AI system at work.
Art. 50 sets out transparency duties. Those of deployers concern emotion recognition, biometric categorisation, deep fakes and text published to inform the public on matters of public interest. On our reading, internal NIS 2 records are none of these.
Art. 3(3) and 3(4) · Art. 50 AI Act
Is an AI assistant that fills in NIS 2 records a high-risk system?
High-risk systems include those listed in Annex III (Art. 6(2)). Point 2 covers critical infrastructure: AI systems intended to be used as safety components in the management and operation of critical digital infrastructure, road traffic, or the supply of water, gas, heating or electricity.
Since the amendment by Regulation (EU) 2026/1744, Art. 6(1a) says it outright: AI systems used solely for non-safety related aspects of user assistance, performance optimisation, service efficiency, automation or convenience or quality control do not qualify as safety components. Recital 55 already states that components intended solely for cybersecurity purposes should not qualify as safety components.
Our reading, not an authority's: an assistant that fills in lists and texts in the walkthrough assists users and takes writing off their hands. If it gets something wrong, a wrong entry sits in your records, which a person can correct. So the counter-rule in Art. 6(1b) for systems whose failure or malfunctioning would endanger health and safety does not apply, and neither does Annex III point 2. An AI system that controls a facility is a separate question.
Even a system listed in Annex III is not high-risk under Art. 6(3) where it poses no significant risk of harm to the health, safety or fundamental rights of natural persons, for example because it is intended to perform a narrow procedural task or a preparatory task to an assessment. A provider who classifies its system this way documents its assessment (Art. 6(4)).
Annex III point 2 · Art. 6(1a), 6(1b), 6(3) and 6(4) AI Act · recital 55
What does the AI Act ask of you as a deployer?
Art. 4 AI Act, since 27 July 2026 in the version of Regulation (EU) 2026/1744: providers and deployers take measures to support the development of AI literacy of their staff and of other persons dealing with AI systems on their behalf. They do not have to guarantee any specific level for anyone. The Commission and the Member States support SMEs in particular (Art. 4(2)).
Our suggestion for a start in the walkthrough: whoever connects an assistant knows what it may fill in there, that it can be wrong, and how to recognise its entries.
The duties for high-risk systems apply from 2 December 2027 for systems under Annex III and from 2 August 2028 for systems under Annex I (Art. 113, also amended). They include the deployer duties in Art. 26, such as human oversight.
Art. 4, Art. 26 and Art. 113 AI Act, as amended by Regulation (EU) 2026/1744
Where do NIS 2 and the AI Act meet in your company?
For NIS 2 the assistant is software your company uses (2.2) and its vendor a supplier (5.1). Our article on the AI vendor as a supplier shows what that means in detail.
Two training duties sit close together. Art. 20(2) NIS 2 requires the members of management to follow cybersecurity training; in Germany this is § 38(3) BSIG. Art. 4 AI Act concerns the AI literacy of everyone working with AI systems. The walkthrough asks about the first one in 1.1.
Management approves the measures (Art. 20(1) NIS 2); in Germany, § 38(1) BSIG obliges it to implement them and oversee their implementation. In the walkthrough no assistant has a tool for the approval.
Art. 20 NIS 2 · § 38(1) and (3) BSIG
How the walkthrough does it
At its start and its end the walkthrough shows what stays with management; it does not cover the AI Act itself.
1.1 “Get management trained”, screen “One line per person”: this holds the last training of each member of management. An assistant can enter the rows; management has to attend itself.
2.2 and 5.1: the assistant is on your software list, its vendor on the supplier list.
7.3 “Record the management review”: before the approval the walkthrough shows open points, for example “No management training in the last three years.” You set who takes care of each and by when.
On the screen “Management approves the documents” management reads each document and approves it, signed in with its own account. It then reads “Approved on” with the date and the name. An assistant fills in nothing in 7.3.
Common questions
Does the AI Act apply to companies that fall under NIS 2?
Yes, once they are established in the EU and use AI systems at work, because that makes them deployers (Art. 2(1)(b) and Art. 3(4) AI Act). This holds whether or not a company falls under NIS 2.
Do we have to declare AI systems in the NIS 2 registration?
The details Art. 3(4) NIS 2 lists for registration do not include AI systems: the entity's name, address and contact details including IP ranges, the sector and the Member States where it provides services. In Germany, § 33(1) BSIG adds the legal form, the commercial register number and the competent supervisory authorities, and no AI systems either. In the walkthrough, registration is item 12.2.
Do we need an AI officer?
The AI Act requires none from deployers; no such role appears in its text. Art. 4 asks for measures on AI literacy, and you decide who in the company drives them. For cybersecurity, NIS 2 places the responsibility with management.
Does the AI Act require a human to check what the AI enters?
The deployer's duty of human oversight sits in Art. 26(2) and applies to high-risk systems, for Annex III systems from 2 December 2027. For your NIS 2 records, NIS 2 is what counts: management approves the measures and oversees their implementation. In the walkthrough a person finishes every item, and management signs off in 7.3.
Read next
- Who is liable for AI entries under NIS2?Art. 20 NIS 2 puts approval and oversight on management, whoever did the typing. Whose entry it is in the walkthrough, and why no assistant approves.
- Can you implement NIS2 with AI?An AI assistant collects, sorts and enters facts. Your company carries out and approves the measures. What NIS 2 says about AI, and where the line runs.
Sources
- Regulation (EU) 2024/1689 (AI Act), Art. 2, Art. 3(3) and (4), Art. 4, Art. 6, Art. 26, Art. 50, Art. 113, Annex III point 2 and recital 55, EUR-Lex, CELEX 32024R1689
- Regulation (EU) 2026/1744 of 8 July 2026 (Digital Omnibus on AI), OJ L of 24.7.2026, in force since 27.7.2026 (Art. 4), Art. 1: new Art. 4, Art. 6(1a) and (1b), amended Art. 113, EUR-Lex, CELEX 32026R1744
- Directive (EU) 2022/2555 (NIS 2), Art. 3(4), Art. 20, Art. 21 and recitals 51 and 89, EUR-Lex, CELEX 32022L2555
- BSIG, § 33(1) and § 38(1) and (3), gesetze-im-internet.de
- open-isms, lib/durchgang/gaps.ts (open points before the approval), lib/mcp/walk.ts (what an assistant fills in) and server/trpc/routers/durchgang.ts (the approval), github.com/NISD2/open-isms
In practice
Where this comes up in the walkthrough
The walkthrough turns this into steps you fill in, with the law explained beside each one. Open a step to see its screen, filled in for a made-up company.
Governance & Liability
Get management trained
Every member of management, regularly.
Effectiveness Assessment
Record the management review
Management checks whether the measures work and approves your documents.
What the walkthrough costs
€4,800 net a year, plus VAT
30 days money backBy invoice, due in 30 days. Cancel within the first 30 days, before the first export or sign-off: invoice cancelled or money back.
Guided NIS 2 implementation, step by step
A history of changes and sign-offs to show your regulator
Deadlines and reminders for each requirement
Security questionnaire for your suppliers
Export to PDF or CSV at any time
Been asked to handle NIS2?
In the end you have everything in one document: what is done, what is still open, and your management's approval with name and date. The app writes the texts.
