Can an AI assistant upload NIS2 compliance evidence?

How does the assistant upload a file?

An AI assistant connects to your company in the app through MCP (Model Context Protocol), an open standard. For files it has the tool upload_file. With it, the assistant asks for an address for exactly one file, giving the item, file name, file type and size.

The app issues an address that works only for your company's own storage and for exactly that size, at most 50 MB. The address is valid for 15 minutes. The assistant sends the file there itself, from the machine it runs on; the file's contents do not pass through the app.

Then it attaches the file: a certificate as a reference in the training line, any other document to the item with the tool fill_walkthrough_item.

For a document, the app checks that the file is in storage at the size announced. Only then does it count as evidence. If the file is missing, the server answers “The file has not been uploaded.”

Which evidence does the walkthrough ask for?

None of the items of the NIS 2 walkthrough needs a file to be finished. Where a file fits, it is optional: in 1.1, “Get management trained”, and in 8.2, “Record your staff training”, each training can carry a proof.

Behind this is a rule of the walkthrough: no evidence the law does not need. In Germany the BSIG requires your company to document that it takes its risk-management measures. In the walkthrough, that documentation is the entries and documents themselves, which management signs off in 7.3.

If someone has a certificate of attendance, attach it. After a webinar there is sometimes none; then you record the training without proof.

§ 30(1), third sentence, BSIG

What goes into the training lines of 1.1 and 8.2?

In 1.1 there is one line per member of management, with their latest training. The law requires members of management to take part in training regularly.

In 8.2 there is one line per training or briefing: who took part, the topic, the date and, if there is one, the provider. The law requires basic cyber hygiene practices and cybersecurity training, but no format and no interval.

Each line has two ways to add proof: a file, such as a list of who took part or a certificate as a PDF, or a link to the record at the provider. A link, such as an online course's completion report, also covers many staff at once.

Art. 20(2) and Art. 21(2)(g) NIS 2 · § 38(3) and § 30(2) no. 7 BSIG

What if your assistant cannot send files?

Uploading needs an assistant that can send a file itself. Claude Code runs on your computer and is such an assistant. If yours cannot, a chat app for example, it enters the line and you add the file in the app, in the field “Proof (optional)”.

An assistant works on items that are still open or set aside. Once 1.1 or 8.2 is finished or signed off, you attach a file in the app.

New training lines and corrections touch the sign-off of 1.1 and 8.2 at once, because both rely on the same list of trainings. If either item is signed off, the server refuses such changes from the assistant and names the item. That includes a certificate, because it sits in the training line.

Should you upload other documents as evidence?

upload_file also takes a document as evidence for an item, such as a report from your IT provider. It is then attached to that item and appears on the requirement page for it. The walkthrough itself asks for none.

Upload what an item asks for and leave the rest. Every file kept in the system needs looking after, and some contain data that does not belong there, such as individual staff members' test results.