Access and roles
Users, administrators and maintenance access are set up separately. Each role receives as many rights as necessary and as few as possible; who may see which documents follows the permissions that already apply in your organisation.
NIS2
NIS2 & local AI
Planning, operating and documenting secure AI infrastructure for organisations in the EU in a traceable way.
Fundamentals
What NIS2 is about
- What is NIS2?
NIS2 is the second EU directive on network and information security (Directive (EU) 2022/2555). It defines which organisations in the European Union must meet minimum cybersecurity requirements, which measures these include and how security incidents are to be reported.
As a directive, it does not apply directly but is transposed by each member state into its own national law. The basic requirements are the same across Europe; authorities, reporting channels and individual details can differ from country to country.
- Which organisations does NIS2 apply to?
The directive distinguishes between “essential” and “important” entities across a range of sectors — including energy, transport, health, banking and financial markets, drinking water and waste water, digital infrastructure, public administration, postal services, waste, chemicals, food, manufacturing and digital services. As a rule, medium-sized organisations and above are covered; individual areas have exceptions in both directions.
In addition, there are organisations that do not themselves fall under the directive but, as suppliers or service providers, have to meet the requirements of their covered customers contractually. Whether and how your organisation is classified follows from the national transposition and is a legal question we do not answer — but we can create the technical preconditions for it.
- Why does NIS2 also concern AI infrastructure?
An AI system that reads documents, provides knowledge and automates processes is an IT system like any other — with access, interfaces, updates and data that have to be protected. It is therefore part of the information technology that a covered organisation’s security measures extend to.
Local processing takes some questions off the table, such as the one about external recipients. It does not answer the questions about access rights, logging, recovery and currency. Precisely these questions belong at the introduction stage, not afterwards.
- What does supply chain security mean?
NIS2 requires covered organisations to consider the security of their supply chain as well — the service providers and products their own IT depends on. For an AI system this means it has to be traceable which software, which models and which components are inside it, where they come from and who maintains them.
That is why every infrastructure we deliver comes with documentation of the components in use. It turns a black box into a list your responsible staff can work with.
Security measures
Which security measures does Locallution take into account?
Within the AI infrastructure we deliver, we provide for the following measures. Which of them are implemented, and to what depth, is decided together with your IT and data protection staff during planning — and recorded in writing.
Multi-factor authentication
Administrative access can be secured with a second factor, and so can remote maintenance access. Whether and where MFA makes sense for users too depends on your existing sign-in and is clarified during planning.
Network and interfaces
Before go-live it is settled which systems the AI system may reach and which may reach it. External connections exist only where they are needed — and then named, limited and controllable in your firewall.
Backup and recovery
What is backed up, where and how often, is agreed; recovery is not attempted for the first time in an emergency. Models and configuration are reproducible — a device failure means downtime, but no rebuilding by hand.
Logging
Sign-ins, administrative changes and maintenance access are logged. What is retained and for how long is agreed with you — so that an incident can be traced without accumulating unnecessary data.
Patch and update concept
Security and software updates are checked for compatibility and installed by arrangement, outside your working hours. Significant version changes are documented, so that it is always clear which state is running.
Vulnerability management
Vulnerabilities that become known in components in use are assessed and, if they affect the system, fixed by update or configuration. The component list is the precondition: you can only check what you know.
Documentation of components in use
Operating system, language models, applications and essential libraries are listed with version and origin. The list is part of the handover and kept up to date when something changes — the basis for any supply chain assessment.
Ongoing maintenance
After the introduction the system is not left to itself: regular function checks, tested updates, technical fault fixing and upkeep of the documentation are part of the support — as Security & Maintenance on a monthly basis, or included in the rental.
Within the EU
National transposition within the EU
NIS2 is an EU directive. Its specific implementation is carried out through the national laws of the individual member states. That is why authorities, reporting channels and individual detailed requirements can differ from country to country.
In its projects, Locallution takes into account both the European NIS2 baseline requirements and – where relevant to the project – the national transposition in the respective member state.
Example: In Austria, the national transposition is carried out in particular through the NISG 2026.
No automatic NIS2 compliance
A local AI system on its own does not make an organisation NIS2-compliant, and this page does not replace a legal assessment. Locallution supports the technical implementation and documentation of relevant security measures within the AI infrastructure it delivers.
Which specific legal requirements apply to your organisation depends on the respective member state, on the size of the organisation, its sector and its individual classification. Your legal advisers and your competent authority are the right places for that — we supply the technical details.
Where does your AI infrastructure stand today?
In a first conversation we look at your processes and your existing IT and clarify which security requirements need to be taken into account for a local AI system in your organisation. Free of charge and without obligation.
Free process & security analysis
The same first conversation as everywhere on this website, with a focus on your security requirements.