The EU legal landscape is currently undergoing a fundamental transformation, with the AI ACT (Artificial Intelligence Regulation) and the NIS2 Directive (implemented in Poland as an amendment to the National Cybersecurity System Act – UKSC) becoming its pillars. These changes, which became fully applicable in the Polish legal system in April 2026, impose unprecedented obligations on businesses in terms of risk management and digital resilience. A key takeaway from the analysis of both acts is that their requirements apply not only to high-risk AI systems but also encompass a broad spectrum of technologies and processes used by key and important entities.
Universal scope of regulation:
A fundamental misinterpretation of the AI Act is the belief that this regulation applies only to a narrow group of systems classified as high-risk. In reality, the EU legal framework aims to encompass almost the entire ecosystem . The NIS2 Directive adopts a horizontal "all-hazards" approach, meaning that every IT system (including those based on artificial intelligence) used to provide critical or important services must meet rigorous security standards. Therefore, if a company, for example, in the energy, transport, or healthcare sectors, implements AI tools to optimize processes, regardless of whether the system is deemed high-risk under the AI Act, it becomes an integral part of the networks and IT systems subject to the NIS2 Directive. This, in turn, requires the implementation of adequate and proportionate technical, operational, and organizational measures, such as risk analysis, incident management, and business continuity.
Key and important sectors:
The UKSC amendment significantly expanded the list of entities operating in industries covered by the new requirements, dividing them into 19 key and important sectors. Key entities, i.e., those subject to the most stringent oversight, include public administration, the space sector, and cloud and data center service providers. Important sectors, in turn, include the production of chemicals, food, medical devices, and waste management.
For entities operating in these industries, integrating the AI Act with NIS2 will require systematic risk assessmentsthat take into account the specifics of AI tools. NIS2 views artificial intelligence as an innovative technology that, while supporting attack detection, can also generate new vulnerabilities in the supply chain.
Touchpoint – Supply Chain Security:
One of the most crucial issues of NIS2 is supply chain security. Companies should therefore verify not only their own systems but also the security standards of their ICT product or service providers. In the context of artificial intelligence, this means that the AI model provider will become a critical link in the entire security architecture of a given entity.
The AI Act and its related CRA (Cyber Resilience Act) introduce "secure by design" requirements and the obligation to manage vulnerabilities throughout a product's lifecycle (from design, through production, and even after it has been withdrawn from the market). Companies covered by NIS2 that use or implement AI technologies should apply due diligence procedures, including the right to audit suppliers and verify supplier security policies. Otherwise, a lack of oversight over an AI software provider could be considered a breach of statutory obligations, which would open the door to severe sanctions.
The Management Board and its responsibility:
A significant corporate "cultural" change, however, is the direct and personal accountability of management staff, imposed by NIS2. Pursuant to Article 20 of the NIS2 Directive, boards are required to approve risk management measures and oversee their implementation. Therefore, ignorance of the specifics of AI systems within a company does not absolve management from responsibility for potential incidents. Furthermore, the UKSC amendment, in conjunction with Article 20(2) of NIS2, also introduces a requirement for mandatory and periodic cybersecurity training for unit managers. The aim of this is to build awareness that the security of IT systems (including those based on AI) is a strategic business responsibility—not solely the domain of IT departments.
Sanctions and penalties:
Failure to comply with the obligations arising from NIS2 and the AI Act may result in severe financial sanctions, modeled on those in force in the GDPR. For key entities, fines can reach up to €10 million or 2% of total annual global turnover. However, in cases of the most serious violations, for example, threatening national security, defense, public order, or human life and health, fines of up to PLN 100 million are provided for, in accordance with Article 73(5) of the UKSC.
An important element of supervision is the S46 system, to which key and important entities are required to register by 3 October 2026. This system is used for multi-stage reporting of serious incidents (24 hours for an early warning, 72 hours for a full report), which, for example, in the event of a failure of AI systems requiring a quick response, will become a key operational challenge.
In summary, linking the AI Act to the NIS2 directive creates a coherent legal regime, forcing companies to shift from reactive to proactive risk management. Companies in sectors covered by this regulation should understand that AI technology security is inextricably linked to an organization's overall cyber resilience. The time for leniency for delays in implementing these standards has passed, and the stakes are not only avoiding multi-million fines but, above all, ensuring business continuity and trust in digital commerce.
This article is for informational purposes only and does not constitute legal advice.
Legal status as of July 22, 2026.
author / editor of the series:
