NIS2
The NIS2 Directive (Network and Information Security Directive 2) is the EU's updated cybersecurity legislation for essential and important entities across critical sectors. It expands scope, strengthens security requirements, and introduces stricter incident reporting obligations and supply chain security mandates compared to the original NIS Directive.
Why It Matters
NIS2 applies to a broader set of sectors than its predecessor, including energy, transport, health, digital infrastructure, ICT service management, public administration, and space. Organizations in these sectors must implement risk-based cybersecurity measures and report significant incidents within 24 hours.
For AI agent governance, NIS2's supply chain security requirements are directly relevant. If an organization in a covered sector uses AI agents that access critical systems, the governance of those agents becomes part of the organization's NIS2 compliance surface.
Member states were required to transpose NIS2 into national law by October 2024, though implementation timelines vary. Organizations in scope should already be assessing how their AI agent deployments affect their NIS2 compliance posture.