NIS2 Directive

The directive names essential and important entities, and then tells them to manage cyber risk and report incidents. An assistant inside such an entity inherits both obligations. This starter connects AI traffic to the measures article and the reporting article.

Article 21 lists the measures and Article 23 sets the reporting clock. An entity in scope must show a control set and an incident path together. Half of that proof is configuration, and half is a rehearsed process.

Requests pass injection screening and an identity check first. Reporter names, personnel records and vendor contacts are masked, which fits an incident workflow where people are named. Prompts that carry a critical service runbook, privileged access detail or source selection information are blocked.

Automated traffic detection follows, and it only warns. A script is flagged and not stopped, so treat that signal as input for your monitoring team rather than a control.

Human handover applies to the whole response path here. The gateway records an escalation and gives the caller no generated content, whatever the question was. That is welcome when a filing deadline and a public statement are at stake, and costly for a routine query.

Answers must reach 0.85 combined with an accuracy floor of 0.80. Risk analysis, continuity testing and supplier assessment remain program work under the directive. The financial resilience starter fits a bank or an insurer better, because sector regulation drives that duty.