NIS2, AI Act, Data Act: the laws are new, the boardroom question is not
NIS2, the AI Act, the Data Act and the Cyber Resilience Act feel like a flood of new obligations. Yet the underlying question is anything but new: do you know your organisation's risks and dependencies, and can you prove it?
In brief
- New legislation feels overwhelming, but at its core it asks the same thing as ever: do you know your risks and dependencies?
- The conversation is shifting from policy to proof. Having an AI policy is not enough; you must be able to show what you actually use.
- Four questions you must be able to answer this quarter: which AI systems, which data, which suppliers and who is responsible?
From policy to proof
Almost every organisation now has a cybersecurity policy, cloud policy or AI guidelines on paper. But the question that increasingly follows is: can you also demonstrate that you are genuinely in control? Many directors and owners struggle with a seemingly simple question: which AI systems are actually being used within the organisation?
Our AI Inventory module answers exactly that question, in 30 minutes rather than through a tour of every department. It brings tools, use cases, data and ownership together in one place, so policy becomes evidence you can actually show.
The four questions you must answer this quarter
1. Which AI systems are being used within your organisation?
2. What data is processed in them, such as contracts, financial information or medical data?
3. Which suppliers play a role in those systems?
4. Who within the organisation supervises these applications?
Most businesses have this information somewhere, but rarely in one place. That means nobody has the complete picture when a customer, auditor or supervisor asks for it.
Why this is becoming more urgent
AI is moving from isolated experiments into core processes such as customer service, HR and document processing. That increases the impact when something goes wrong. A hallucinating chatbot can make commitments to customers. An HR algorithm can discriminate in practice. These are not entirely new risks, but AI introduces a new cause, greater speed and a much larger scale.
The practical governance question is therefore not whether you have adopted every new legal term. It is whether you know which systems can affect customers, employees and business decisions, which safeguards apply and who intervenes when an outcome is wrong.
The rules are new. The responsibility is not.
Sources and further reading
Last reviewed on 13 October 2026. Legislation and official guidance may change.
Not compliant yet?
Start the free AI Compliance Scan and know where you stand in 30 minutes.
No demo.
Just a good conversation.
Together we look at what is going on, what is relevant and where the biggest risks sit.
Book an introductionRelated within this theme