NIS2

NIS2 is Directive (EU) 2022/2555, which replaces the first NIS directive and greatly expands the number of organisations covered. It applies to medium and large entities in essential sectors (energy, transport, banking, health, water, digital infrastructure, public administration…) and important sectors (postal services, waste management, chemicals, food, manufacturing, digital providers…).

It requires cybersecurity risk-management measures (policies, incident handling, business continuity, supply-chain security, encryption, access control, training), reporting of significant incidents on very short deadlines (early warning within 24 hours) and makes management bodies accountable.

As a directive, each country transposes it into its own law; check the Regulatory Radar for the current status. Many AI systems are part of the infrastructure NIS2 requires to be protected.