NIS2 does not mention AI agents, but its cybersecurity risk management measures cover them fully. An essential or important entity that runs agents must include them in its risk analysis, access control, supply chain security, incident handling and continuity plans. Its management body must approve those measures, oversee them and be trained enough to understand the risks agents add.
What does NIS2 require?
The NIS2 Directive requires essential and important entities to take appropriate and proportionate technical, operational and organisational measures to manage risks to the network and information systems they use, and to prevent or minimise the impact of incidents. The measures follow an all-hazards approach and include, in substance:
- policies on risk analysis and information system security;
- incident handling;
- business continuity, including backups, disaster recovery and crisis management;
- supply chain security, including security aspects of relationships with direct suppliers and service providers;
- security in acquiring, developing and maintaining systems, including vulnerability handling;
- policies and procedures to assess whether measures are effective;
- basic cyber hygiene and cybersecurity training;
- cryptography and encryption where appropriate;
- human resources security, access control policies and asset management;
- multi-factor or continuous authentication and secured communications where appropriate.
Management bodies must approve the measures, oversee their implementation and can be held liable for failures. Their members must follow training to gain sufficient knowledge to identify risks and assess practices.
Who does it apply to?
Medium and large entities, and some smaller ones, in sectors listed in the directive, including energy, transport, banking, financial market infrastructure, health, drinking water, digital infrastructure, managed ICT services, public administration, and others such as manufacturing and digital providers. Essential entities face proactive supervision; important entities face supervision mainly after evidence of problems. For financial entities, DORA applies as the more specific regime on ICT risk; see DORA and AI agents: what financial entities must do. Whether an agent platform vendor is itself caught is covered in does NIS2 apply to AI agent platforms.
What does NIS2 mean when the system is an agent that acts?
Take a hospital group or a water utility using agents for scheduling, procurement, service desks or maintenance planning. Four NIS2 measures need agent-specific design.
Access control and asset management. Agents are assets with identities that read and write in operational systems. Each needs an owner, a classification and permissions limited to its capability. An agent with broad service-account access to operational systems is a large target.
Supply chain security. The agent platform and model provider are direct suppliers. Their security, their own suppliers, and their ability to change the model under the agent all belong in supplier assessments and contracts.
Secure development and vulnerability handling. Agents have new vulnerabilities, such as instructions hidden in documents they read. Testing and vulnerability handling must cover those. The EU AI Act's accuracy and cybersecurity duty for high-risk systems points the same way; see EU AI Act Article 15 accuracy and cybersecurity for AI agents.
Separation of duties. If the same person can change an agent's instructions and approve the change, one compromised account can alter how an agent behaves across the organisation. The principle in what segregation of duties is applies to agent configuration as to payments.
How do you meet the duties for agents?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Risk analysis | Agent threats included: manipulation, excessive permissions, supplier change | Risk register entries |
| Incident handling | Agent misbehaviour and compromise handled as security incidents | Incident procedures; records |
| Business continuity | Fall-back to people or alternative model if agent or provider fails | Continuity plans; test results |
| Supply chain security | Platform and model provider assessed; change notification terms | Supplier assessments; contracts |
| Secure development and vulnerabilities | Adversarial testing of agents; vulnerabilities tracked to fix | Test reports; vulnerability log |
| Effectiveness assessment | Periodic review of agent controls | Review reports |
| Cyber hygiene and training | Staff who build or oversee agents trained on agent risks | Training records |
| Access control and assets | Agent register; unique identities; least privilege | Asset register; access reviews |
| Authentication | Strong, short-lived machine credentials for agents | Credential configuration |
| Separation of duties | Configuration changes approved by someone other than the author | Change approvals |
| Management body | Measures approved; members trained | Board minutes; training records |
Management training links to the EU AI Act's literacy duty for staff who work with AI; see how to meet AI literacy duties for staff who supervise AI agents.
What will a national authority ask?
- Which agents operate in your network and information systems, and what can they reach?
- Are agent threats in your risk analysis?
- How do you assess the agent platform and model provider as suppliers?
- What happens to essential services if an agent or its provider fails?
- Who can change an agent's configuration, and who approves it?
- Has the management body approved these measures and been trained?
What does NIS2 not cover?
It does not regulate the fairness or quality of agent decisions. It does not certify agents. National transposition adds detail and may differ between member states. For financial entities, DORA's specific regime takes precedence. For the full map, see AI agent regulation, mapped to controls.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Where Pryme fits
In Pryme, an agent's sources and actions are set per capability in a versioned brief, and the minimum chain enforces them at the moment of action alongside the platform guardrails. Some actions are withheld for every agent at every depth. Because governance sits apart from the model, a second model can be qualified in advance as a continuity fall-back without rebuilding the controls.
Questions people ask
Does adopting agents change an entity's NIS2 classification?
No. Classification depends on sector and size. Agents change the risks the entity must manage, not whether NIS2 applies.
Are management bodies personally liable for agent-related security failures?
NIS2 allows member states to hold management bodies accountable for failures to meet risk management duties. Agents are within those duties, so the same accountability applies.
Should agents be allowed to act in operational technology systems?
Only with great care. Actions in operational systems can affect safety and essential services. Most entities keep agents to reading and drafting there, with people executing changes.