European security teams are living through an unusual moment: two major regulatory regimes—the NIS2 Directive and the EU AI Act—are landing on the same organizations at roughly the same time. NIS2 dramatically expands the population of companies subject to cybersecurity obligations and incident reporting deadlines, while the AI Act's phased timeline brings general-purpose AI and high-risk system obligations into force through 2026 and beyond. Treated separately, they produce duplicated audits, conflicting control catalogs, and compliance fatigue. Treated as one operating model, they become a forcing function for the security program you probably wanted to build anyway. This playbook lays out how to run both regimes off a single set of controls. It is a practitioner's view, not legal advice—entity classification and national specifics belong with your counsel.
Two Regimes, One Operating Model
NIS2 (Directive (EU) 2022/2555) replaces the original NIS Directive and widens scope to [1] 'essential' and 'important' entities across sectors ranging from energy and health to digital infrastructure, managed service providers, and parts of manufacturing. Because it is a directive, each member state transposes it into national law—in Estonia, cybersecurity obligations are administered under national legislation with the Estonian Information System Authority (RIA) as the key supervisory [2] and CSIRT contact point, and transposition details have continued to settle, so verify your current national requirements. The AI Act (Regulation (EU) 2024/1689), by contrast, applies directly across the EU without transposition and takes a risk-based approach [3]: prohibited practices, high-risk systems, transparency obligations, and a dedicated regime for general-purpose AI models. The practical consequence is that most in-scope organizations should not build two compliance programs. Build one risk management system, one control catalog, and one evidence repository, then map each regulation's articles onto it.
The NIS2 Incident Clock: 24 Hours, 72 Hours, One Month
NIS2's most operationally demanding requirement is its incident reporting cadence for significant incidents: an early warning to the relevant CSIRT or competent authority within 24 hours of becoming aware, a fuller incident notification within 72 hours, and a final report within one month, with intermediate updates on request. A 24-hour early warning is not a forensics report—it is a signal that something significant is happening and whether cross-border or malicious activity is suspected—but hitting it consistently requires preparation: a written definition of what your organization treats as 'significant', pre-drafted notification templates, a named on-call owner for regulatory communication, and evidence capture that starts at detection rather than after containment. NIS2 also raises the stakes for leadership: management bodies are expected to approve and oversee risk management measures and can be held accountable for failures, which tends to concentrate executive attention in a way security teams can constructively use.
The AI Act Timeline: GPAI Obligations Are Already Live
The AI Act entered into force in August 2024, and its obligations apply in stages: prohibitions on certain practices applied first, obligations for general-purpose AI (GPAI) models began applying in August 2025, and the bulk of remaining obligations—including much of the high-risk regime—apply from August 2026, with some product-embedded high-risk categories on a longer runway. For security teams the GPAI regime matters even if you never train a model, because your vendors do: providers of GPAI models owe technical documentation, information to downstream integrators, and a copyright policy, while models designated as posing systemic risk carry additional evaluation, adversarial testing, and serious-incident reporting duties. If you deploy high-risk systems, expect obligations around logging, human oversight, robustness, and post-market monitoring. Two actions pay off immediately: inventory every AI system and model in use (including AI features embedded in SaaS), and assign each a provisional risk classification with the evidence you would need to defend it. Timelines and guidance have continued to evolve, so check current European Commission and AI Office publications [4] before committing dates to your roadmap.
Mapping to ISO 27001 and NIST CSF So You Only Build Once
NIS2's Article 21 lists minimum measures—risk analysis and information system security policies, incident handling, business continuity and crisis management, supply chain security, security in acquisition and development, effectiveness measurement, cyber hygiene and training, cryptography, access control, and multi-factor authentication. Read that list next to ISO/IEC 27001:2022 Annex A and NIST CSF 2.0 and the overlap is unmistakable; CSF 2.0's Govern function in particular lines up with NIS2's emphasis [5] on management accountability. The efficient pattern is a unified control matrix: one row per control, columns mapping it to NIS2 measures, AI Act articles where relevant, ISO 27001 Annex A controls, and CSF subcategories, with a single evidence link per row. An existing ISO 27001 certification does not automatically make you NIS2-compliant—registration, reporting, and national specifics still apply—but it means most of the control substance already exists and audits can reuse evidence instead of regenerating it. ENISA's implementation guidance is a useful reference point when you need [6] to justify interpretation choices.
Training Is Now a Legal Obligation, Not a Perk
Both regimes make competence a compliance matter. NIS2 expects members of management bodies to follow cybersecurity training and encourages equivalent training for employees on a regular basis; the AI Act's Article 4 requires providers and deployers to ensure a sufficient level of AI literacy among staff dealing with AI systems, taking their role and context into account. The defensible implementation is role-based rather than one-size-fits-all: board-level briefings on risk oversight and reporting duties, secure development and AI-specific threat training (prompt injection, data leakage, model supply chain) for engineering teams, incident-response exercises for operations, and general awareness for everyone else. Two details matter for audit readiness: keep completion records tied to named individuals and dates, because training evidence is among the first things a supervisory authority or auditor will request, and refresh content on a defined cycle so it reflects the systems actually in use rather than last year's stack.
Conclusion
NIS2 and the AI Act reward the same behaviors: knowing your assets, governing risk at the top, responding to incidents on a clock, managing your supply chain, and training your people. Organizations that treat the pair as a single program—one control matrix, one evidence base, one training curriculum—will spend less and end up more secure than those running parallel compliance projects. Start with entity classification and an AI inventory, wire the 24/72-hour reporting drill into your incident process, and let the regulations fund the security fundamentals. Then verify the details with counsel and your national authority, because transposition and guidance are still moving.
References
- [1]NIS2 Directive: securing network and information systems — European Commission
- [2]Information System Authority (RIA) — Estonian Information System Authority
- [3]AI Act | Shaping Europe's digital future — European Commission
- [4]European AI Office — European Commission
- [5]NIST Cybersecurity Framework (CSF) 2.0 — NIST
- [6]NIS2 Technical Implementation Guidance — ENISA