NIS2 and cybersecurity training for staff who run AI agents

NIS2 requires essential and important entities in the EU to manage cybersecurity risk, report significant incidents and train both their management bodies and their staff. Where those entities run AI agents, the training must cover agent-specific risks: credentials agents hold, instructions hidden in documents, model provider supply chains, and recognising when an agent's behaviour is an incident.

What does NIS2 ask of the people who run agents?

The NIS2 Directive sets cybersecurity obligations for entities in sectors the EU treats as essential or important, implemented through national law. In substance, entities must take appropriate and proportionate technical, operational and organisational measures to manage risks to their network and information systems. Those measures include risk analysis, incident handling, business continuity, supply chain security, security in acquisition and development, access control, and basic cyber hygiene practices and cybersecurity training.

Management bodies must approve the measures, oversee their implementation and can be held responsible for failures. Their members must follow training to gain enough knowledge and skills to identify risks and assess cybersecurity practices, and entities are expected to offer similar training to employees regularly.

Entities must report significant incidents to the national authority or response team in stages, starting with an early warning soon after they become aware. Staff who cannot recognise an incident cannot start that clock.

AI agents bring all of these into new places. An agent holds credentials to production systems, reads content from outside, and acts. The systems view is in NIS2 and AI agents: cybersecurity duties for essential entities.

Who does it apply to?

Medium and large entities in sectors such as energy, transport, banking, financial market infrastructure, health, drinking water, digital infrastructure, ICT service management, public administration and others, along with certain entities regardless of size. Whether an agent platform falls in scope itself is covered in does NIS2 apply to AI agent platforms. Financial entities subject to DORA apply its more specific ICT rules in place of overlapping NIS2 duties.

Within an entity, staff who run agents include workspace operators, agent owners, platform and security engineers, incident responders, procurement and vendor managers, and the management body.

What training does NIS2 imply when agents act?

For the management body. Members need to understand what agents do and how they fail, well enough to approve risk measures. That means knowing the depth each critical agent works at, what actions are held for people, what the platform withholds outright, and how an agent incident would be detected and reported.

Cyber hygiene for agents. Operators must treat agent credentials as privileged access: scoped to the agent's role, never shared, rotated and monitored. An agent with broader access than its role is an attack surface.

Prompt injection and manipulation. Agents read emails, documents and web pages. Any of them can carry instructions meant to redirect the agent. Operators must know that external content arrives marked as external, that an external claim cannot authorise a payment, and how to spot an agent behaving as if it obeyed a hidden instruction.

Supply chain. Model providers and agent platforms are suppliers. Vendor managers need to know what data they receive, how they secure it, how model changes are communicated, and what happens if the supplier is compromised.

Change and acquisition. Changing an agent's brief or sources is a change to a production system. It should pass through security review. Raising an agent's depth must rest on certification evidence, not a configuration edit.

Incident recognition and reporting. An agent acting outside its bounds, a run of unusual refusals, a held action no one requested, or an agent dropped to depth 1 after a certification run that clears no depth may each signal an incident. Operators must know how to stop the agent, preserve the record and escalate in time for staged reporting. Every verdict is filed in an append-only record, which is what responders will need.

How do you meet NIS2 and show it?

Exercises matter here. Run a tabletop or live exercise in which an agent receives a document carrying a hidden instruction, and see whether operators notice and escalate.

What will the national authority or an auditor ask?

• Which agents touch critical services, and what can each do?
• What training has the management body received on agent risk?
• Who holds agent credentials, and how are they controlled?
• How would you detect a prompt injection against an agent?
• How do you oversee your model provider?
• Walk us through how an agent incident would be reported.

What does NIS2 not cover?

It does not regulate AI decisions or fairness; the EU AI Act does. It does not cover personal data protection, which GDPR governs. For financial entities, DORA's ICT risk, incident reporting, testing and third-party rules apply instead where they overlap. And it does not prescribe a curriculum. Card data adds its own standard; see PCI DSS v4.0 security awareness for staff who run AI agents. Service providers proving competence to clients face the questions in how outsourcing providers can prove staff are trained to oversee AI agents. The guide to AI literacy and certification covers the wider model.

This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.

Where the Academy fits

Pryme Intelligence Academy's Foundations track gives management body members a short grounding in why agents must be governed, the decision chain and depth. Operators take the Operator track, whose modules include when something goes wrong and reading the workspace. Labs run in a free Build workspace, so operators can practise stopping an agent and reading the record without touching production.