NIS2 readiness starts with ownership, logging, and clear accountability.
If AI agents affect operational processes, governance questions should be answered before rollout.
Short answer: who does NIS2 affect and what must be done?
Germany's NIS2 implementation act has applied since 6 December 2025 and covers around 29,500 entities according to the BSI; registration was due by 6 March 2026 with a grace period to 31 July 2026.
The checklist walks through the applicability check, registration, risk management, reporting duties and the role of AI agents in producing evidence.
Weekly AI live calls are now embedded across the site.
Every Saturday at 11:00 Europe/Berlin, the format gives a compact mix of market filtering, practical cases, questions, and clear next steps.
Next session: Saturday, September 12, 2026 at 11:00 · Europe/Berlin. The series then continues on a weekly rhythm.
Seven checkpoints
These questions should be answered before a production rollout.
- Is the use case clearly described and owned by the business?
- Are data sources, storage locations, and onward transfers documented?
- Are approvals defined for critical decisions?
- Are roles between business, IT, privacy, and management aligned?
- Are relevant actions logged and versioned?
- Is there a fallback and incident path?
- Are involved vendors and subprocessors transparently documented?
Review the checklist together
If you want, we can assess your concrete use case with you in a structured way.
Start potential analysis
If you want to prioritize a real process, a few clear inputs are enough for a strong first assessment.