Can you implement NIS2 with AI?

What can an AI assistant take on for NIS 2?

It can gather facts that already exist and put them into the shape the walkthrough asks for. From an accounts payable list, an inventory or a licence overview it makes rows in a list.

For a policy it picks the sections that apply and writes what else holds in your company.

That is what the NIS 2 walkthrough is built for: it asks item by item what needs recording, and a connected assistant enters it there.

What does your company have to do itself?

A measure is in place when it works in daily operations: when, say, the second factor is switched on at the sign-ins and the backup can really be restored.

An assistant that fills in records can write this down. It cannot make it happen.

The decision stays with people too: under Art. 20(1) NIS 2, management approves the measures and oversees their implementation. Who is liable for what an AI enters, our article on that explains.

Art. 20(1) NIS 2

What does NIS 2 say about AI?

Little. The Directive names artificial intelligence in two recitals only, the reasoning that comes before the articles.

Under recital 51, Member States should encourage AI where it could improve the detection and prevention of cyberattacks, in line with data protection law. Under recital 89, entities should evaluate their own cybersecurity capabilities and, where appropriate, bring in technology such as AI or machine learning.

Implementing Regulation (EU) 2024/2690, which sets out the measures in more detail for certain digital services, does not mention AI at all. Neither text says whether a risk analysis may be produced with the help of AI.

No authority has said whether it accepts NIS 2 records written with AI, as far as we could check (as of October 2026).

Where does an assistant help in the NIS 2 walkthrough, and where not?

Most with lists that already exist in another form. In 2.2 your inventory becomes the list of your software and technology, in 5.1 your accounts payable list becomes the list of your suppliers.

It helps little with facts that are written down nowhere. If no document records when a backup was last restored successfully, the assistant cannot know it.

So the server instructs it to enter only what your records and systems show, and to leave a field empty rather than guess.

For two decisions it has no tool at all: whether your company decides not to do an item, and whether management approves the documents. People make those in the app.

What happens when the AI gets it wrong?

A language model can invent facts or put them in the wrong place. In the walkthrough that could be a supplier that does not exist, or a backup schedule that is wrong.

The server checks the form of an entry, for example that a date is a date. Whether it is true, it cannot know.

That is why a person finishes every item. Each screen an assistant wrote carries its name and the day. Read those screens before you finish, and correct in the app what is wrong.