How do I build an asset inventory for NIS2 with AI?

How does an AI assistant build the inventory?

An asset inventory is the list of what your company needs for its work: processes, software, technology and rooms. In the NIS 2 walkthrough you keep it in item 2.2, and a connected AI assistant can fill it there from your records.

It connects through MCP (Model Context Protocol), an open standard that lets an assistant such as Claude read and enter data in an application. It then works with the rights of the person who connected it.

Give it what you already have: your IT provider's inventory, a licence list, or an export from your CMDB, the database where your IT keeps its devices and software. The assistant matches the lines to catalogue entries, ticks those and adds entries of its own for the rest.

The server tells every assistant to enter only what your records and systems show, and to leave a field empty rather than guess. Whether it did, you can see on the list itself.

What belongs in the asset inventory under NIS 2?

Item 2.2 keeps four lists: “What your company does every day” (your processes), “Software for customers, staff and money”, “Software everyone uses” and “Technology and rooms”. Each comes with a catalogue to tick, 132 entries in all, such as “Accounting software (DATEV, Lexware, sevDesk, lexoffice)” or “Laptops and desktops”.

Then come “Which software exactly, and from whom?” and “Which technology exactly, and from whom?”. For each entry they record what you actually use, what for, whether it runs in house or in the cloud, and who provides it.

The directive counts policies on risk analysis and asset management among the minimum measures. In Germany, the BSIG asks for concepts for managing your ICT systems, products and processes; a list is the usual first step.

A complete, up to date inventory is required in so many words by Implementing Regulation (EU) 2024/2690, Annex point 12.4. It applies directly only to certain digital services, such as cloud and data centre providers.

Art. 21(2)(a) and (i) NIS 2 · § 30(2) no. 1 and 9 BSIG

What does the AI not do with the inventory?

It does not finish item 2.2, and it takes nothing off the list: none of its tools deletes an entry from this list. If something wrong is on it, you take it off in the app.

It works on items that are still open or that you set aside. Once you have finished 2.2, the server takes nothing more from the assistant on that item; you make changes in the app.

While an item that relies on this list is signed off, such as 2.2 itself or 4.4 on backups, the tools refuse any change to the list. They name the items concerned.

The change would take that sign-off back. That is a person's step in the app, and the item then goes to management again.

How do I check what the AI entered?

Every screen an assistant wrote carries a mark at the top, for example “Filled in by the assistant claude-code/2.1.287 on 16 October 2026”. The assistant gives that name itself. The mark stays even if you change the screen afterwards.

The activity log lists every change under the name of the person who connected the assistant, with “via” and the assistant's name. That keeps changes made in the browser apart from changes made through the assistant.

Before you finish, go through all four lists and both detail screens. Look out for software you rent from the cloud, such as email or accounting: the walkthrough names it as often missed, and a plain device list will not contain it.