A text two years in the making
The European NIS2 directive was due to be transposed by member states by 17 October 2024. In France, the bill on the resilience of critical infrastructure and the strengthening of cybersecurity, passed by the Senate in March 2025, is still being examined by the National Assembly in autumn 2026. Meanwhile, ANSSI, the French cybersecurity agency, published a reference framework in March 2026 to help organisations prepare.
The change in scale is considerable: NIS2 extends cybersecurity obligations to thousands of entities, including many mid-sized companies and local authorities.
Generative AI, the blind spot of security policies
Security policies cover the network, workstations, email and access. They often forget generative AI tools, even though these concentrate new risks:
- Sensitive data pasted into external services, beyond any control.
- Personal accounts used for work, without company authentication.
- Connectors giving a third-party service access to entire document spaces.
- No usable logging in the event of an incident.
New risks specific to AI
Beyond data leaks, generative AI brings risks that security teams are starting to take on board:
- Prompt injection: a booby-trapped document or web page can contain hidden instructions that hijack an assistant or an agent.
- Over-powered agents: an agent allowed to read, write and send must be limited to minimal rights, like any service account.
- Scattered API keys: embedded in scripts or automation tools, they must be inventoried, limited and quickly revocable.
- Dependence on a provider: a service outage or a change of terms can block processes that have become critical.
What NIS2 expects, applied to AI
The directive requires proportionate risk management, control of the digital supply chain and the ability to detect and report incidents. For AI, this translates very concretely:
- Inventory the AI tools in use and the data flowing through them.
- Reduce dependence on third-party providers for sensitive uses.
- Control access using the company directory.
- Log requests so incidents can be investigated.
Bring IT, security and the business together
NIS2 makes cybersecurity a management responsibility. For AI, this means moving away from a situation where each department adopts its own tools. Simple governance is often enough: a register of uses, a list of approved tools, clear rules on which data may or may not be used, and an internal solution that makes uncontrolled tools unnecessary.
AI that comes inside your perimeter, not out of it
AI deployed on premises fits into your security policy instead of bypassing it: permissions mapped to your Active Directory, no outbound traffic, a request identifier on every response. That is the approach of MIA and our local API, which let security teams stay in control of AI use.
Sources: Directive (EU) 2022/2555 (NIS2); French bill on the resilience of critical infrastructure and the strengthening of cybersecurity; reference framework published by ANSSI in March 2026.
