NIS2 requires essential and important entities in the EU to manage cybersecurity risk, practise basic cyber hygiene, train their people and report significant incidents quickly. If you run or review AI agents at such an entity, you need specific awareness: spot manipulated inputs, protect access, treat odd agent behaviour as a possible incident and report it.
What does NIS2 ask of organisations and their people?
The NIS2 Directive sets cybersecurity duties for organisations in sectors the EU considers critical or important. Member states put it into national law. In substance, covered entities must take appropriate risk-management measures, covering among other things incident handling, supply chain security, access control and basic cyber hygiene with cybersecurity training. They must report significant incidents to the national authority within tight deadlines.
Management bodies carry personal responsibility. They must approve the measures, oversee them, and themselves follow cybersecurity training, and entities are encouraged to offer similar training to employees regularly.
For staff, that means security awareness is part of the job, not an annual click-through. For staff around AI agents, it means awareness of the ways agents can be attacked or misused.
Who does NIS2 apply to?
NIS2 applies to medium and large organisations in listed sectors, and some smaller ones of particular importance. The sectors include energy, transport, banking, financial market infrastructure, health, drinking water, digital infrastructure, ICT service management, public administration and space, with a further set including postal services, waste, food, manufacturing of certain products, and digital providers.
Financial entities covered by DORA generally follow DORA's more specific ICT rules instead, so in banks and insurers the equivalent expectations come through DORA. For hospitals, utilities, transport operators, data centres and managed service providers, NIS2 is the main framework.
That reach matters for job seekers. AI operations roles at a regional hospital, an energy supplier or an IT service provider all sit under NIS2. Operations coordinators in such firms are often the first to see something wrong; the role is described for the Netherlands, where NIS2 applies, and for comparison in the US, where it does not but similar habits are expected.
What security awareness is expected around agents?
General awareness covers phishing, passwords and reporting. Agents add five specific risks, and staff who work with them should recognise each.
- Manipulated inputs. An emailed invoice, web page or uploaded document can contain hidden instructions meant to make the agent do something it should not. This is prompt injection. A reviewer should treat content that arrived from outside as the weakest kind of evidence and be suspicious when an agent's draft suddenly changes course after reading one.
- Excessive agency. An agent with more access or actions than it needs widens the damage an attacker can cause. Staff should notice when an agent can reach things its job does not require, and say so.
- Sensitive information disclosure. An agent may be tricked into revealing data in a reply. Reviewers catch this before anything is sent.
- Credential and access hygiene. Approval rights are a target. Shared logins, approvals done on someone else's account, or approvals rushed under pressure are security failures.
- Unusual behaviour as an incident. An agent acting strangely, at odd times or in bulk, may be a security event, not just a quality issue. Report it through the incident route, not only to the agent owner.
These map closely onto the OWASP Top 10 for LLM Applications, which lists prompt injection, excessive agency and sensitive information disclosure among the main risks. For the card-data equivalent, see PCI DSS v4.0 security awareness for people who supervise AI agents handling card data.
How do you show employers you have that awareness?
| Requirement | What employers will expect of you | How to show it |
|---|---|---|
| Cybersecurity training and cyber hygiene | Complete training and apply it daily | Training records, and an example of a habit you kept |
| Incident handling | Recognise and report possible incidents at once | A near miss or incident you reported, and how |
| Access control | Use only your own credentials and approval rights | An account of the access rules you worked under |
| Supply chain security | Understand the agent platform as a supplier with its own risks | Show you know whom to tell about a supplier issue |
| Risk management | Flag agents with more reach than they need | An example of a scope question you raised |
| Significant incident reporting | Support fast, accurate reporting with clear records | Decision notes and timelines you kept |
What might an interviewer ask?
- "The agent processed a supplier invoice and then drafted a change to the supplier's bank details. What do you do?" Hold it. External content cannot authorise a payment change; verify through a known contact and report it as a possible attack.
- "A colleague asks you to approve their queue on your login while they are out. What do you say?" No. Approvals are tied to a named person for a reason.
- "What counts as a security incident with an agent?" Anything suggesting manipulation, unexpected access, data leaving where it should not, or bulk unusual actions.
An operations coordinator we will call Pieter prepared by describing a phishing email he had reported and explaining how the same trick would look if an agent read it. That made his awareness concrete. How security teams approve agents in the first place is explained in how to get IT security to approve an AI agent.
What does NIS2 not cover?
It does not apply to every organisation; small firms outside its sectors are generally not covered. It does not replace DORA for financial entities. It does not set individual certification for staff, and it does not prescribe a particular course. It also does not address AI-specific duties such as human oversight under the EU AI Act; it is a cybersecurity framework.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Questions people ask
Is security awareness enough to work in AI operations?
No, but it is part of the baseline. Review judgement and record-keeping matter as much. The guide to AI agent jobs and careers covers the full set.
Do I need a security certification?
Not for most operations roles. Specialist security roles are different. What operations employers want is evidence you behave securely around agents.
How do PCI DSS and NIS2 compare for staff?
PCI DSS focuses on card data and applies wherever cards are processed; NIS2 covers wider cybersecurity in listed EU sectors. The staff habits overlap heavily, as PCI DSS v4.0 security awareness and staff who run AI agents shows.