How do I write NIS2 security policies with AI?
Six items of the NIS 2 walkthrough each write a document from a fixed template, from the security policy to the cryptography policy. An AI assistant picks the sections that fit your company and adds your own rules. You read every document, and management approves it.
What does the assistant write in a policy?
An AI assistant connects to your company in the app through MCP (Model Context Protocol), an open standard. It works with the rights of the person who connected it.
Each document comes from a template. Fixed sections, in the security policy for example scope, objectives and responsibility, are already in it. Below, the walkthrough asks “Which of these does your company have or do?” and offers sections to pick; last comes anything else that applies at your company.
The assistant reads the whole template. Then it sends two things: which sections fit your company, and your own text for the last section, up to 2,000 characters.
The walkthrough puts the rest together, with your company name and the answers from earlier screens of the same item, such as the emergency contacts in 3.1. The assistant cannot rewrite the fixed sections.
How does the assistant know which sections fit?
From your records. If you keep separate administrator accounts, your account management or a document from your IT provider shows it.
What it picks should be backed like that. A section that promises something your company does not do does not belong in the document.
Which policies does NIS 2 require?
Six items of the walkthrough end with a document. 2.4 is the information security policy, 3.1 the incident response plan, 4.2 the business continuity plan. 6.3 holds the rules for buying, updates and vulnerabilities, 9.1 the cryptography policy and 10.1 the policy for staff, access and IT.
The directive requires policies on risk analysis and information system security. The BSIG asks for concepts on risk analysis and IT security.
Cryptography and the policy for staff, access and IT have their own places in both texts: Art. 21(2)(h) and (i) NIS 2, § 30(2) no. 8 and 9 BSIG.
Art. 21(2)(a) NIS 2 · § 30(2) no. 1 BSIG
How does the assistant keep the cryptography list in 9.1?
Before the cryptography policy, 9.1 shows the list of your accepted methods for encryption, hash functions, signatures and keys, key exchange and TLS. Until you keep a list of your own, it is what Germany's BSI recommends in its Technical Guideline TR-02102, version 2026-01. The cryptography policy prints it.
The assistant can take this list over and set each entry: “Accepted”, “Only for what exists, not for anything new” or “Not to be used”.
It sends the whole list as it should stand; an entry it leaves out drops off the list. So check the list line by line. A list your company already keeps is not replaced by the BSI default.
Art. 21(2)(h) NIS 2 · § 30(2) no. 8 BSIG
What do you check before management approves?
Below each document is a tick box: “I have read the document, and it fits our company”. A person ticks it in the app. Without it the screen does not go on, and an assistant cannot tick it.
The mark with the assistant's name and the day shows which templates it worked on. Read those documents in full, especially the sections it picked and your own text at the end.
In the walkthrough, management approves all documents in item 7.3, signed in with its own account. Its name and the date are recorded on each document, which applies from that day.
Art. 20(1) NIS 2 · § 38(1) BSIG
How do you change an approved policy?
In the app. Once a document is approved, the server refuses any change the assistant makes to it and sends the link to the item. A changed text loses its approval, because management approved the earlier version.
If you change a document in the app, it becomes a draft again, and management approves the changed version once more.
For its digital services, Implementing Regulation (EU) 2024/2690 requires the security policy to state the date of its approval and management to review it at least annually (Annex points 1.1.1(k) and 1.1.2). For other companies the BSIG sets no interval; if you pick the annual review in your security policy, a year applies.
How the walkthrough does it
A document is written at the item where its duty sits, and approved in 7.3.
2.4, “Your policy”: the assistant picks the sections that fit and adds your own rules. You read it, tick the box and finish 2.4.
9.1, “Your accepted methods” and “Your cryptography policy”: it takes over the TR-02102 list, sets entries and picks sections such as encrypted laptops.
10.1, “Your policy for staff, access and IT”: it picks sections such as separate administrator accounts or the annual access review, where your records back them.
7.3, “Management approves the documents”: management reads each document and approves it. After that you change a document in the app, and it goes for approval again.
Common questions
Is there a template for the information security policy?
Yes, in item 2.4 of the walkthrough. It has fixed sections such as scope, objectives and responsibility, sections to pick, such as training or an annual review, and at the end a section for your own rules. Your company name is already in it.
Will a policy an AI helped write be accepted?
We have found no statement on this from the BSI, ENISA or any other authority. The NIS 2 directive requires management to approve the measures and oversee them. In the walkthrough that approval stays with management, document by document.
We already have our own policies. What now?
Give them to the assistant to read. It then picks the sections your existing rules cover and carries anything beyond them into the last section, in your own words. That section takes up to 2,000 characters.
In which language is the document written?
In the language your company keeps its records in. The screen says so below the template, for example “The document itself is written in English, like the rest of your company's records.” The language the assistant reads the walkthrough in does not change that.
Read next
- NIS 2 documents and templatesWhich evidence and policies you actually need.
- What can an MCP server fill in the NIS2 walkthrough?In 19 of 21 items, item by item: fields, lists, ratings, agreements, sign-ins, backups, policies. Finishing and approving stay in the app.
- Who is liable for AI entries under NIS2?Art. 20 NIS 2 puts approval and oversight on management, whoever did the typing. Whose entry it is in the walkthrough, and why no assistant approves.
Sources
- Directive (EU) 2022/2555 (NIS 2), Art. 20(1) and Art. 21(2)(a), (h) and (i), EUR-Lex
- BSIG, § 30(2) no. 1, 8 and 9 and § 38(1), gesetze-im-internet.de
- Implementing Regulation (EU) 2024/2690, Annex points 1.1.1(k) and 1.1.2, EUR-Lex
- BSI, Technical Guideline TR-02102, Cryptographic Mechanisms, bsi.bund.de
- open-isms, server/trpc/helpers/durchgang-inputs.ts (writePolicyInput) and server/trpc/routers/durchgang.ts (writePolicy), github.com/NISD2/open-isms
- open-isms, lib/mcp/tools.ts (refusal for approved documents), github.com/NISD2/open-isms
In practice
Where this comes up in the walkthrough
The walkthrough turns this into steps you fill in, with the law explained beside each one. Open a step to see its screen, filled in for a made-up company.
Risk Management
Write the security policy
A short policy that management approves.
Cryptography & Encryption
Write the cryptography policy
Where you encrypt, and who keeps the keys.
Access Control & HR Security
Write the staff, access and asset policy
Who gets into what, and what happens when someone leaves.
What the walkthrough costs
€4,800 net a year, plus VAT
30 days money backBy invoice, due in 30 days. Cancel within the first 30 days, before the first export or sign-off: invoice cancelled or money back.
Guided NIS 2 implementation, step by step
A history of changes and sign-offs to show your regulator
Deadlines and reminders for each requirement
Security questionnaire for your suppliers
Export to PDF or CSV at any time
Been asked to handle NIS2?
In the end you have everything in one document: what is done, what is still open, and your management's approval with name and date. The app writes the texts.
