It depends on what the platform is and who it serves. NIS2 can apply directly, where an agent platform qualifies as a cloud computing service or managed service provider of sufficient size in the EU. It applies indirectly far more often, because customers in scope must manage the security of their suppliers, including your platform.
When does NIS2 apply directly to a platform?
The NIS2 Directive sets cybersecurity risk management and incident reporting duties for essential and important entities in the EU. Entities are in scope by sector and size. The sectors include digital infrastructure, which covers cloud computing services, and ICT service management, which covers managed service providers serving other businesses. Member states transpose the directive into national law, so the exact rules and the authority you deal with depend on the country.
An agent platform that hosts and runs agents for business customers can look a lot like a cloud computing service or a managed service. Whether it is one, and whether it meets the size thresholds, is a question of fact for each provider. A small start-up may be outside the direct scope; a large platform serving many EU firms may well be inside it.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
How does NIS2 reach a platform indirectly?
NIS2 requires entities in scope to manage supply chain security, including the security practices of their direct suppliers. A hospital, an energy company or a transport operator that runs agents on your platform must assess you. In practice that means questionnaires, contract clauses, audit rights and incident notification terms. Many platforms meet NIS2's substance through their customers long before they are designated themselves. A vendor due diligence questionnaire for AI agent platforms shows the questions to expect.
Financial entities are different. For banks, insurers and investment firms, DORA sets the specific rules for ICT risk, and the overlap is explained in DORA vs NIS2 for AI agents: which applies.
What does NIS2 require, in substance, and what is specific to agents?
NIS2's risk management measures include risk analysis and security policies, incident handling, business continuity, supply chain security, security in development and maintenance, access control, the use of cryptography, and staff training. Management bodies must approve the measures, oversee them and can be held responsible.
For an agent platform, these carry particular weight:
| NIS2 measure | What it means for an agent platform |
|---|---|
| Access control | Each agent is an identity; credentials scoped per capability and per customer |
| Supply chain security | Model providers and connectors are your suppliers; assess and contract with them |
| Secure development | Changes to agent runtime, tools and guardrails tested before release |
| Incident handling | Detect agents acting wrongly, not only systems going down |
| Business continuity | Customers can fall back to manual work if agents are stopped |
| Cryptography | Customer data and credentials encrypted in transit and at rest |
What may agents do, and what stays with a person?
On the platform itself, people should keep the decisions that change the security posture for every customer: changing guardrails, granting a new class of tool access, rotating platform credentials, and declaring a significant incident. Agents can help: triaging alerts, drafting incident reports, checking configurations against policy. But a significant incident report under NIS2 should be approved by a named person who understands it.
An illustrative example
Take an agent platform serving a dozen mid-sized EU utilities and logistics companies. It is not large enough to be designated itself. In one quarter, it receives NIS2 supplier questionnaires from most of its customers, each slightly different.
Rather than answer each ad hoc, the platform maps its controls to NIS2's measures once: per-agent identities, a supplier register including its model providers, change testing for guardrails, and outcome-based monitoring that flags agents acting outside normal patterns. When one customer's agent is later tricked by a malicious attachment into querying records outside its scope, the platform's guardrail refuses the action, the event is logged, and the customer receives the details it needs for its own assessment of NIS2 incident reporting when an AI agent is involved.
Which controls should a platform put in place?
- Determine your own status under the national law of each member state where you operate.
- Build a NIS2 control map once and reuse it for every customer questionnaire.
- Treat model providers as critical suppliers, with security terms and change notice.
- Monitor agent behaviour, not only uptime, so incidents are caught early.
- Give customers incident data fast enough for their own reporting duties.
The broader picture of which regulation asks for which control is in AI agent regulation, mapped to controls.
Questions people ask
Is a customer that only uses agents for internal work affected?
If the customer is an essential or important entity, its NIS2 duties cover the systems it uses, including agents, whether they face customers or not.
Does NIS2 regulate how agents decide?
No. NIS2 is about cybersecurity and resilience. It cares whether an agent can be compromised, misused or cause an outage, not whether its decisions are fair or correct.
Who reports an incident involving an agent: the platform or the customer?
The entity in scope reports its own significant incidents. If both are in scope, both may have duties. Contracts should set out how fast the platform informs the customer.