NIS2
The EU’s cybersecurity directive that extends security duties to many industries — with liability for management.
NIS2 is the revised EU directive on network and information security. It significantly widens the circle of affected organisations: alongside ‘critical’ ones, many ‘important’ entities across sectors such as energy, health, finance, administration, digital services and transport now fall in scope.
The duties cover risk management, incident reporting channels and technical protective measures. New and consequential is the personal responsibility of management: it is liable for implementation.
For running AI this means: an AI system is part of risk management and must be operated securely and traceably. Anyone running AI in a third party’s cloud shifts part of that risk out of their own control. (Not legal advice.)