EU regulatory compliance, NIS 2 and EU AI Act

NIS 2, what it requires and who it applies to

The NIS 2 Directive (EU 2022/2555) is the EU's mandatory cybersecurity framework for organisations operating in sectors considered essential or important to society and the economy. In Germany, it has been transposed into national law through the NIS2UmsuCG, which entered into force on 6 December 2025 with no transition period.

Organisations with 50 or more employees or annual turnover exceeding EUR 10 million operating in a covered sector are generally in scope. Essential entities, those in high-criticality sectors such as energy, healthcare, water, digital infrastructure, and transport, face stricter obligations and closer regulatory scrutiny. Important entities in sectors including postal services, food, manufacturing, and chemicals face proportional but still binding requirements.

AuditVantage® provides entity classification support, helping organisations assess likely scope, probable entity category, and the technical and organisational measures corresponding to the obligations the client determines apply to its organisation. Final classification and formal legal interpretation rest with the client and, where required, qualified counsel.

Article 21 security measures

NIS 2 requires organisations to implement appropriate and proportionate technical, operational, and organisational measures to manage cybersecurity risks. Article 21 specifies minimum security measures, including risk analysis, incident handling, business continuity, supply chain security, access control, cryptography, and multi-factor authentication.

AuditVantage® conducts gap assessments against Article 21 requirements, identifies control deficiencies, and supports implementation of the required measures in a way that is proportionate to the organisation's size, risk exposure, and operational context. For organisations already certified to ISO 27001, the assessment identifies gaps between existing controls and NIS 2 obligations, avoiding duplication of effort.

EU AI Act, and how ISO/IEC 42001 is the implementation pathway

The EU AI Act (Regulation 2024/1689) is the world's first comprehensive legal framework for AI. It applies to providers, deployers, importers, and distributors of AI systems used in the EU. Obligations vary by risk category and actor type, with the strictest requirements applying to high-risk AI systems listed in Annexes I and III.

For organisations facing the high-risk obligations under Chapter III of the regulation, ISO/IEC 42001:2023 is the canonical implementation pathway. The Act requires a quality management system (Article 17), a risk management system (Article 9), data governance (Article 10), technical documentation (Article 11), record-keeping (Article 12), transparency to deployers (Article 13), human oversight (Article 14), accuracy and robustness (Article 15), and post-market monitoring (Article 72). ISO/IEC 42001 is a management system standard that provides the governance structure for all of these in a form that is externally verifiable and that aligns to the harmonised standards expected to underpin EU AI Act conformity assessment.

For organisations already operating an ISO/IEC 27001 ISMS, the route from ISMS to AIMS is more efficient than building either from scratch. The two standards share the Harmonized Structure, which means Clause 4 through Clause 10 transfer substantially. What needs to be added is the AI-specific layer: AI system inventory, AI impact assessment, AI lifecycle controls, AI-specific data governance, and AI-specific transparency obligations. Most of these concentrate in ISO 42001 Annex A.

AuditVantage® supports organisations in classifying their AI systems under Annex III, identifying applicable obligations under Chapters II and III, mapping existing ISO 27001 ISMS coverage against ISO 42001 requirements, and preparing the management system documentation and governance processes required for conformity. The Auditor's Lens engagement is available as an independent read on whether your AIMS will hold up under conformity assessment.

Germany, NIS2UmsuCG and BSI

Germany's national transposition of NIS 2 introduces specific registration requirements, sector-specific thresholds, and regulatory enforcement by the Bundesamt für Sicherheit in der Informationstechnik (BSI). The NIS2UmsuCG includes provisions beyond the minimum requirements of the directive, including KRITIS rules and sector-specific implementing guidance.

AuditVantage® advises organisations on the German regulatory context, including BSI registration procedures, KRITIS-specific obligations, and the relationship between NIS2UmsuCG requirements and existing frameworks such as ISO 27001 and IT-Grundschutz.

Multi-framework integration

Most organisations facing NIS 2 also operate under other compliance obligations, GDPR, ISO 27001, TISAX, SOC 2, or the EU AI Act. AuditVantage® designs integrated programmes that map common controls across frameworks, reducing duplication and overall compliance costs. A single gap assessment can provide baseline coverage across multiple regulatory obligations, with framework-specific gap analysis conducted from that foundation.