NIS2 Compliance for Enterprise AI

The NIS2 Directive does not contain a special category for artificial intelligence. It does not need one. When AI supports a covered service, connects to operational systems, or handles company data, it becomes part of the entity's cyber risk.

NIS2 generally applies to medium-sized or larger essential and important entities in listed sectors, with exceptions, and some entity types are in scope regardless of size. National law decides scope. Confirm status wherever you operate.

NIS2 follows the system, not the AI label

The exposure includes managed AI applications and agents, but also employee use of external AI services. Retrieval can expose regulated data. Model artifacts can introduce supply-chain risk. A prompt injection can become a tool action. Sensitive context can leave through a browser assistant before a conventional application review begins.

Article 20 puts management on the hook

Article 20 requires management bodies to approve and oversee cybersecurity risk-management measures. Members of management bodies must complete training. They can also be held liable for infringements. AI risk is therefore not something to leave in a model card or an innovation committee slide.

Management needs to know which AI services are used, what data they reach, which agents invoke tools, what testing found, and which risks remain open. Excluding browser AI, embedded assistants, coding agents, or departmental endpoints leaves oversight incomplete.

Article 21 reaches the AI attack surface

Article 21 requires appropriate and proportionate technical, operational, and organizational measures under an all-hazards approach. The listed measures are a minimum. They include risk analysis, incident handling, continuity, supply-chain security, secure development, vulnerability handling, effectiveness testing, access control, and asset management.

For AI supply chains, that means examining model provenance, unsafe serialization, malicious artifacts, third-party services, and retrieval sources. For applications and agents, it means testing prompt-injection paths, tool permissions, data boundaries, and failure modes across languages and modalities.

Runtime controls should use the context they can actually observe, such as the user or application, prompt, response, retrieved context, and tool call. They should enforce policy before a risky interaction continues. Teams must test those controls repeatedly.

One clean run proves very little in a non-deterministic system.

Article 23 starts a clock

Consider an approved agent reading a poisoned document. The injected instruction causes it to call an approved tool and move customer data outside the intended workflow. Once the entity becomes aware that the incident is significant, the 24-hour clock starts.

Article 23 sets an early warning within 24 hours and an incident notification within 72 hours. The CSIRT or competent authority may request an intermediate report. A final report is generally due within one month of the incident notification, with a progress report used when the incident is still ongoing.

That timeline is a poor moment to discover that the evidence does not join up. Enterprises should ensure their combined application, model, retrieval, agent, tool, identity, and security telemetry can establish what happened, when it happened, what data was affected, which controls acted, and how the incident was contained.

National law changes the route

Belgium's law has been in force since 18 October 2024. Section 4.5 of its official FAQ says an existing ISO/IEC 27001 certificate can support a CyFun label with the appropriate certification scope and Statement of Applicability.

The Netherlands' Cybersecurity Act took effect on 15 August 2026. MijnNCSC routes incident reports to the sectoral CSIRT and supervisory authority.

Germany's law took effect on 6 December 2025. NIS2 registration and incident reporting use the BSI Portal. Check requirements wherever you operate.

What DeepKeep covers, and what it doesn't

‍

DeepKeep covers part of the technical problem.

The enterprise still owns legal scope, governance, training, risk acceptance, remediation, continuity, incident classification, national notifications, and compliance evidence. NIS2 accountability cannot be delegated to a product.

‍