An employee pastes a customer file into ChatGPT to get a summary. In the same organisation's NIS2 project, the talk is of firewalls, backups and reporting deadlines, not of that text field. Yet that is exactly where NIS2 applies. AI tools are part of your attack surface, your data processing and your supply chain, and NIS2 wants all three under control.
What NIS2 is, in short
NIS2 is a European directive that raises cybersecurity requirements for essential and important organisations, in sectors such as energy, transport, healthcare, drinking water, digital infrastructure and government. In the Netherlands it is implemented through the Cyberbeveiligingswet. It comes down to four things:
- Risk management. Appropriate technical and organisational measures for your information security.
- Incident reporting. Significant incidents must be reported within short deadlines.
- Management accountability. Leadership must approve and oversee the measures.
- Supply chain. You must also manage the risks of your vendors and services.
AI use affects all four.
AI is part of your attack surface
Every AI tool your team uses is a place where data can leave your organisation. An employee who pastes a quote, a case file or source code into a public chatbot widens your attack surface without anyone noticing. NIS2 calls for appropriate information security measures, which means AI use cannot sit outside your policy.
An AI data leak can be a reportable incident
NIS2 sets reporting obligations for significant incidents, with an early warning shortly after discovery and a fuller notification later. If sensitive data leaks through an AI tool and that affects your service or security, it can be such an incident. That comes on top of any data breach notification under the GDPR. The Dutch Data Protection Authority is already seeing more data breaches through AI chatbots. Under NIS2, such a leak is a security incident as well as a privacy problem.
Management is accountable
One of the most pointed provisions in NIS2 is that accountability lies with management. Leadership must approve and oversee the risk measures and can be held liable if they fall short. AI governance is part of that: there must be a policy on which AI tools may be used and with which data. See enforcing an AI policy.
Shadow AI is a supply-chain risk
NIS2 requires you to manage your supply chain. An unapproved AI tool is effectively an unknown vendor processing your data. You cannot apply measures, agree terms or assess risks for tools you do not know about. So visibility into which AI is in use is a NIS2 measure in itself. And a ban often backfires: people switch to their phones, and shadow AI grows.
Of everything BeeSensible does, this is the closest match to a NIS2 requirement. "You cannot manage tools you don't know about" is not a slogan here; it describes precisely the gap the Inbox and the AI register exist to close. They show every AI tool opened in your organisation, with a risk score from the catalogue and the status "No decision yet" until the organisation chooses "Allowed", "Limited use" or "Not allowed".
