Risk management
Concepts for risk analysis and information system security, incident handling, business continuity and crisis management.
Who falls under NIS 2
NIS 2 distinguishes “particularly important” and “important” entities. Sector and size are decisive: as a rule, companies from 50 employees or €10 million turnover are affected if they operate in one of the sectors — including energy, transport, health, water, digital infrastructure, ICT service management, postal services, waste, chemicals, food, manufacturing (incl. mechanical engineering, vehicle construction, medical devices, electronics), digital service providers and research.
Unlike earlier rules there are no official notices: companies must check themselves whether they are affected and register with the BSI. Suppliers not covered by the law themselves are effectively included via their customers' supply chain obligations.
The central obligations
The law requires a minimum level of risk management — appropriate, proportionate and documented.
Reporting duties
Significant security incidents: early warning within 24 hours, notification within 72 hours, final report within one month to the BSI.
Supply chain
Security in the supply chain and with service providers; requirements for procurement, development and maintenance.
Technology & organisation
Cryptography, access control, multi-factor authentication, vulnerability management, employee training.
Registration
Registration with the BSI including a point of contact; evidence obligations for particularly important entities.
Management
Management must approve and monitor measures and be trained itself — and is personally liable for violations.
What NIS 2 means for AI systems
AI systems are information systems within the meaning of the law. Anyone operating language models, agents or automations must include them in risk management: access, data flows, interfaces, providers. External AI providers are service providers in the supply chain — with the corresponding requirements for contracts and review.
At the same time AI helps with implementation: evaluating logs, detecting anomalies, prioritising vulnerabilities and preparing notifications within the tight deadlines. Here too: people decide, AI prepares — and its use is documented.
- AI inventory as part of asset recording (see AI Audit & Screening)
- Guardrails and logging of AI systems as a security measure
- Provider assessment of AI services by supply chain criteria
- AI-supported log analysis and preparation of notifications
Implementing NIS 2, ISO 27001, EU AI Act and GDPR together
Those already working to ISO 27001 or TISAX have structurally met a large part of the NIS 2 requirements — what is usually missing is registration, reporting processes and the formal involvement of management. Conversely, NIS 2 provides the occasion to build an information security management system that also serves the EU AI Act and GDPR. We plan implementation so that measures are built once and evidenced for all frameworks.
Sanctions and timeline
For particularly important entities, fines of up to €10 million or 2% of global annual turnover are provided, for important entities up to €7 million or 1.4%. Add BSI orders and the personal liability of management. The law is in force; registration and evidence deadlines are running. We check specific deadlines and the current state of implementation with you at project start, as details are updated through regulations and BSI requirements.