EU AI Act vs NIS2: Cybersecurity Duties for AI Systems in Critical Sectors

AI now runs inside the systems Europe depends on most: grid balancing, water treatment, traffic control, hospital scheduling, network operations and cloud platforms. Two EU laws decide how those AI systems must be secured. The NIS2 Directive sets cybersecurity duties for the organisations that run essential and important services. The EU AI Act sets cybersecurity duties for the AI systems themselves, and classes AI used as a safety component in critical infrastructure as high-risk.

Neither law mentions the other much, but they overlap heavily. A water utility using AI to control chemical dosing is a NIS2 essential entity and a deployer of high-risk AI. A cloud provider hosting AI workloads is a NIS2 entity and may be an AI Act provider. If one incident hits both, it can trigger reports under both laws.

This guide compares the two regimes, explains where each one's cybersecurity duties apply to AI, and sets out how to build one security programme that satisfies both.

The short answer

NIS2 regulates the organisation: if you are an essential or important entity, you must manage cybersecurity risk across all your network and information systems, including the AI you build, buy and run. The AI Act regulates the AI system: if it is high-risk, it must be designed to be accurate, robust and secure against both ordinary attacks and AI-specific ones, such as data poisoning and adversarial inputs.

For a critical-sector operator using high-risk AI, the two layer on top of each other. NIS2 sets the security baseline for the whole organisation. The AI Act adds model-level security requirements, human oversight and AI-specific incident reporting on top.

What NIS2 requires, and how it captures AI

NIS2 replaced the original NIS Directive and widened scope to 18 sectors: 11 sectors of high criticality, such as energy, transport, banking, health, drinking water, digital infrastructure, ICT service management and public administration, plus 7 other critical sectors, such as manufacturing, digital providers and research. Entities are classed as essential or important, mainly by size and sector.

Its core duties are short to list but heavy to implement:

• Governance (Article 20): management bodies must approve cybersecurity risk measures, oversee them, follow training, and can be held liable for failures
• Risk management (Article 21): an all-hazards approach covering at least ten areas, including risk analysis, incident handling, business continuity, supply chain security, secure development and vulnerability handling, cryptography, access control and the effectiveness of measures
• Incident reporting (Article 23): early warning within 24 hours of becoming aware of a significant incident, a full notification within 72 hours, and a final report within one month
• Supervision and penalties: fines of up to EUR 10 million or 2% of worldwide turnover for essential entities, and EUR 7 million or 1.4% for important entities

NIS2 doesn't use the term "AI", but its scope is technology-neutral. An AI model that controls a process, a machine learning pipeline, an AI API and the data that feeds them are all network and information systems. AI vendors are part of the supply chain that Article 21 requires you to secure.

ENISA's report also found that attacks on the AI supply chain are on the rise. AI has become both a tool for attackers and a new point of exposure for defenders.

What the AI Act adds for critical sectors

The AI Act's cybersecurity duties are concentrated in high-risk AI. For critical sectors, the key entry point is Annex III, point 2: AI systems intended as safety components in the management and operation of critical digital infrastructure, road traffic, or the supply of water, gas, heating or electricity. AI that is part of products covered by EU product law, such as machinery or medical devices, can also be high-risk through Annex I.

For high-risk AI, Article 15 requires an appropriate level of accuracy, robustness and cybersecurity throughout the life cycle. It explicitly requires measures against AI-specific vulnerabilities and, for systems that keep learning, against harmful feedback loops:

High-risk AI also needs risk management, data governance, logging, human oversight and post-market monitoring. Providers must report serious incidents under Article 73, and the AI Act's definition explicitly includes a serious and irreversible disruption of the management or operation of critical infrastructure. Deployers, such as a utility using a vendor's AI, must assign competent human oversight, monitor the system, keep logs and tell the provider about risks or incidents.

If you are working on AI security in a critical sector, I post practical breakdowns of NIS2, the AI Act, MITRE ATLAS and ISO 42001 regularly on LinkedIn. Feel free to connect with me there and tell me which overlap your security team is working through.

EU AI Act vs NIS2: side by side

Three overlaps that catch organisations out

1. One incident, two reports

Suppose an attacker poisons the data feeding an AI system that balances load on a regional grid, causing an outage. The grid operator must send a NIS2 early warning within 24 hours. If the AI system is high-risk, its provider must also report a serious incident under the AI Act, and the operator, as deployer, must inform the provider. Different authorities, criteria and deadlines apply.

2. AI vendors are now supply chain risk

NIS2's supply chain duty covers the security of your relationships with direct suppliers. When you buy an AI model, platform or API, that vendor's security practices, model update process and incident handling become part of your NIS2 risk. Under the AI Act, the same vendor (as provider) must give you instructions for use, accuracy metrics and information on known risks. Use both to write better contracts.

3. Cloud and AI providers can be both

Cloud computing providers, data centre operators and managed service providers fall under NIS2's digital infrastructure and ICT service management sectors. If they also place high-risk AI on the market, or build AI into their services, they carry AI Act provider duties too. Their NIS2 security baseline helps, but doesn't cover model-level AI security.

Where NIS2 stands in late 2026

NIS2 transposition was slow. Member States had until 17 October 2024, but the Commission sent letters of formal notice in November 2024 and reasoned opinions to 19 Member States in May 2025. On 8 July 2026 it referred Ireland, Spain, France and the Netherlands to the Court of Justice. The Netherlands' law took effect on 15 August 2026, and Austria's new NIS law applied from 1 October 2026. By 24 October 2026, 24 of 27 Member States had a NIS2 law in force.

NIS2 is also being amended. On 20 January 2026, the Commission proposed targeted amendments alongside a revised Cybersecurity Act. They aim to simplify jurisdiction rules, streamline ransomware data collection and strengthen ENISA's role in supervising cross-border entities. The Commission says the changes would ease compliance for 28,700 companies, including 6,200 micro and small enterprises. As of October 2026, the proposal was still before Parliament and Council.

How the timelines fit together

• 16 Jan 2023

  NIS2 enters into force.

• 1 Aug 2024

  AI Act enters into force.

• 17 Oct 2024

  NIS2 transposition deadline; NIS1 repealed from 18 October.

• 2 Feb 2025

  AI Act prohibitions and AI literacy duties apply.

• 7 May 2025

  Commission sends reasoned opinions to 19 Member States over NIS2.

• 20 Jan 2026

  Commission proposes targeted NIS2 amendments and a revised Cybersecurity Act.

• 8 Jul 2026

  Four Member States referred to the Court of Justice over NIS2.

• 2 Aug 2026

  AI Act Article 50 transparency duties and penalties apply.

• 1 Oct 2026

  Austria's NIS2 law (NISG 2026) applies.

• 2 Dec 2027

  AI Act high-risk duties apply to Annex III systems, including critical infrastructure AI.

A 6-step plan for one AI security programme

1. Map your entity status and AI inventory together

   Confirm your NIS2 classification (essential or important) in every Member State where you operate. List all AI systems and flag those that act as safety components in critical infrastructure or other high-risk uses.

2. Extend Article 21 measures to AI

   Bring AI systems into your NIS2 risk analysis, access control, secure development, vulnerability handling, logging and business continuity. Treat models, training data and AI pipelines as critical assets.

3. Add AI-specific security controls

   Defend against data poisoning, adversarial inputs, model extraction and prompt injection. Use MITRE ATLAS for threat modelling and red team high-risk AI against its techniques.

4. Harden AI supply chain contracts

   Require AI vendors to share security practices, model change notifications, vulnerability disclosure, incident cooperation and the AI Act documentation you need as a deployer.

5. Unify incident response

   Use one triage process that checks NIS2 significant-incident criteria and AI Act serious-incident criteria, with pre-agreed vendor roles and templates for both reporting tracks.

6. Brief the management body

   NIS2 makes management accountable for cybersecurity. Include AI risks, high-risk AI obligations and the 2 December 2027 deadline in board reporting and training.

Common mistakes to avoid

• Assuming NIS2 doesn't cover AI because it never mentions it
• Treating AI models as ordinary software, with no defences against poisoning or adversarial inputs
• Running separate incident processes for cyber and AI that never coordinate
• Assuming the AI vendor carries all AI Act duties, when deployers have their own
• Applying one country's NIS2 rules everywhere, when national transpositions differ

A prompt to map NIS2 and AI Act security duties for your AI

Paste in your organisation's details to get a first-draft security and compliance map. Your CISO and legal team should review it.

You are a cybersecurity and AI regulatory specialist with deep
knowledge of the NIS2 Directive (2022/2555), its national
transpositions, the EU AI Act (2024/1689) as amended by the
Digital Omnibus on AI, and MITRE ATLAS.

Our organisation:
[sector and Member States of operation; NIS2 classification
(essential or important); AI systems with purpose, provider
(in-house or vendor), hosting and what they control; whether any
act as safety components in critical infrastructure; key AI and
cloud vendors; current security framework (ISO 27001, NIST CSF);
incident response process]

Produce:
1. For each AI system: AI Act risk class and our role (provider
   or deployer), and how NIS2 Article 21 measures apply to it.
2. A gap table of AI-specific security controls needed under AI
   Act Article 15 (data poisoning, model poisoning, adversarial
   examples, confidentiality attacks, model flaws).
3. The top 10 MITRE ATLAS techniques relevant to our AI systems.
4. Contract clauses for AI vendors covering NIS2 supply chain
   security and AI Act deployer information needs.
5. An incident triage flow that tests NIS2 significant-incident
   and AI Act serious-incident criteria, with deadlines.
6. A board briefing outline and a plan to 2 December 2027.

Use only what I provide and mark uncertain points UNKNOWN.

NIS2 secures the organisation that runs the critical service. The AI Act secures the intelligence inside it. When AI controls the grid or the water supply, you need both locks on the same door. — Kumail Mehdi

Frequently asked questions

Securing AI in a critical sector? Let's connect on LinkedIn. I'm always glad to compare notes on AI and cybersecurity regulation.

Sources

• EUR-Lex — Directive (EU) 2022/2555 (NIS2)
• EUR-Lex — Regulation (EU) 2024/1689 (AI Act)
• ENISA — Threat Landscape 2025
• WAM — ENISA Threat Landscape 2025 key figures
• Hunton — Commission refers four Member States to the CJEU over NIS2
• Nisura — NIS2 implementation tracker by Member State
• Practicl — NIS2 Article 21 measures and transposition status
• European Commission — Cybersecurity Act and targeted NIS2 amendments
• IAPP — Practical impacts of the proposed NIS2 and CSA2 reforms
• Aegister — NIS2 amendments: what the Commission proposes