NIS2 is known as a cybersecurity law, and it is. But most people picture firewalls and backups when they hear NIS2, not an employee pasting a customer file into ChatGPT. Yet NIS2 touches exactly that. AI tools are part of your attack surface, your data processing, and your supply chain, and all three are things NIS2 wants under control.
What NIS2 is, in short
NIS2 is a European directive that raises cybersecurity requirements for essential and important organisations, in sectors such as energy, transport, healthcare, drinking water, digital infrastructure, and government. In the Netherlands it is implemented through the Cyberbeveiligingswet. The core is four things:
- Risk management. Appropriate technical and organisational measures for your information security.
- Incident reporting. Significant incidents must be reported within short deadlines.
- Management accountability. Leadership must approve and oversee the measures.
- Supply chain. You must also manage the risks of your vendors and services.
AI use touches all four.
AI is part of your attack surface
Every AI tool your team uses is a place where data can leave your organisation. An employee who pastes a quote, a case file, or source code into a public chatbot widens your attack surface without anyone seeing it. NIS2 calls for appropriate information security measures, which means AI use cannot sit outside your policy.
An AI data leak can be a reportable incident
NIS2 has reporting duties for significant incidents, with an early warning shortly after discovery and a fuller notification later. If sensitive data leaks through an AI tool and that affects your service or security, it can be such an incident. That comes on top of any data breach notification under the GDPR. The Dutch data protection authority already sees data breaches through AI chatbots rising. Under NIS2, such a leak counts not only as a privacy problem, but also as a security incident.
Management is accountable
One of the sharpest points of NIS2 is that accountability sits with management. Leadership must approve and oversee the risk measures and can be liable if that falls short. AI governance is part of that: there must be a policy on which AI tools may be used and with which data. See enforcing an AI policy.
Shadow AI is a supply-chain risk
NIS2 requires you to manage your supply chain. An unapproved AI tool is effectively an unknown vendor processing your data. You cannot apply measures, make agreements, or assess risks for tools you do not know about. So visibility into which AI is in use is a NIS2 measure in itself. And a ban often backfires: people move to their phones, which makes shadow AI grow.
Of everything BeeSensible does, this is the closest one-to-one match to a NIS2 requirement in the whole product. "You cannot manage tools you don't know about" is not a slogan here, it is the exact gap the catalog and Adoption view exist to close: every AI tool your organisation has actually opened, scored for risk, sitting at "no decision yet" until someone allows it, allows it within limits, or rules it out.
