NIS2 and AI agents: what the rules mean in practice

The NIS2 Directive, Directive (EU) 2022/2555, sets cybersecurity duties for critical sectors across the EU. Its articles never mention artificial intelligence, let alone an AI agent; AI appears only in the recitals, as a tool for defenders. Our position: that silence is exactly why NIS2 covers agents in full. An agent with access to a mailbox, document store or business application is a privileged account, and NIS2 already governs those. Austria, whose transposition took effect on 1 October 2026, serves as our example. Last reviewed: 19 October 2026.

NIS2 in brief, with Austria as an example

Member States had to apply their national rules from 18 October 2024 (Article 41). Austria's Network and Information Systems Security Act 2026 (NISG 2026) was published on 23 December 2025 and entered into force on 1 October 2026, supervised by a new authority, the Bundesamt für Cybersicherheit. It covers entities in listed sectors such as healthcare, energy, digital infrastructure and managed ICT services, generally from medium size upwards: at least 50 employees, or annual turnover and balance sheet total both above EUR 10 million. Law firms and accountancy practices are not a sector in their own right, though smaller firms may feel the rules as suppliers to entities in scope.

An agent is a privileged account

Unlike a chatbot, an agent calls tools (see What is an AI agent?). Article 21 requires appropriate and proportionate measures, including access control policies, supply chain security and security in system acquisition and development. Implementing Regulation (EU) 2024/2690 spells these out for digital providers such as cloud, data centre and managed service providers. Austria's NISV 2026 regulation, published on 1 October 2026, extends them to every type of entity in scope. Three points in the Annex bear directly on agents:

• Rights by need: access rights are granted and revoked on the principles of need-to-know, least privilege and separation of duties (point 11.2.2). An agent that sorts receipts needs no write access to the accounts.
• Privileged accounts: privileged and system administration accounts need their own policy, strong authentication and privileges restricted as far as possible (point 11.3). An agent using the managing director's account hardly fits.
• Logs: where appropriate, logs cover extensions of permissions and all privileged access and administrative account activity (point 3.2.3). A chat history is no substitute for an audit trail per action.

When an agent incident becomes reportable

Under Article 23(3), an incident is significant if it has caused or can cause severe operational disruption or financial loss, or considerable material or non-material damage to others. For digital providers, the Implementing Regulation adds concrete triggers, among them exfiltration of trade secrets and successful, suspectedly malicious unauthorised access capable of causing severe disruption (Article 3). Austria's NISV 2026 sets comparable criteria for all entities.

A hypothetical case: a mid-sized hospital operator lets an agent triage incoming email. A crafted message uses indirect prompt injection to make it forward test results to an outside address. Our article on prompt injection in AI agents explains the mechanism; documented incidents show it is real. Whether such data exfiltration is significant has to be judged quickly, as the 24-hour clock runs from awareness of a significant incident. That requires evidence of what the agent did, when and on whose instruction.

Supply chain: model vendors and agent platforms

Agents are mostly assembled from bought-in parts: model, platform, plug-ins. Article 21(3) requires entities to consider the vulnerabilities of each direct supplier and the quality of its products and security practices, including secure development. Austria names ICT supply chain risk as a category every risk analysis must address (§ 3 NISV 2026). In practice, know where prompts and documents go and who updates model and platform. Cloud and managed service providers may be NIS2 entities themselves; that does not replace your own assessment.

What the board needs to know

Article 20 requires management bodies to approve the risk-management measures and oversee their implementation, and they can be held liable for infringements. Members must follow cybersecurity training, and entities are encouraged to offer similar training to staff; Austria makes that offer mandatory (§ 31). Austria also has management co-sign the report of an independent audit (§ 33(3)), and if an essential entity ignores an order, the authority can temporarily bar its management from their functions (§ 39(4)). The first step is an inventory of every agent and its rights, as set out in What is AI agent governance?

Control you can evidence

AEGIS, the locally operated agent system from oQueo, provides technical building blocks for several of these requirements: the language model itself holds no credentials, tools sit on an allowlist with default deny and a maximum level per agent, only what an independent checking authority has signed is executed, and every decision is recorded in an append-only audit log built as a SHA-256 hash chain. This supports your NIS2 obligations but replaces neither risk assessment nor legal review. More on our security page.

This article is a general overview and does not constitute legal advice.