NIS2 compliance country by country: every company scoped, registered and evidenced, with the board signing off
Every EU entity scoped, registered and evidenced per country, with the board signing off.
See one case, screen by screen ↓NIS2 Compliance is software for NIS2 scoping, gap assessment and Article 21 evidence for EU essential and important entities. Seven agents classify every company in every country, track each country's law, draft the registrations, map existing ISO 27001 controls to the ten measures, read every ICT supplier contract and keep the incident reporting routes ready. Legal counsel decides the law, the Head of GRC submits, and the named board member approves.
How to choose AI solutions for back-office and enterprise work →
Updated
A group with companies across the EU does not have one NIS2 obligation. Each country wrote the directive into its own law, with its own competent authority, its own registration portal and deadline, and sometimes its own extra rules. Every legal entity has to be classified in every country where it operates — Annex I or Annex II sector, size counted with linked companies, main establishment — then registered, assessed against the ten Article 21(2) measures and kept current. Most groups run it in spreadsheets per country and consultant memos, and redo it whenever the group structure or a national law changes.
The risk sits in the parts nobody had time to read: a registration that slipped past its deadline, supplier contracts checked by questionnaire instead of read for a security clause, two sources that disagree on when a national law took effect, and board approvals and training that were given but never recorded. Under Article 20 the management body approves the measures and can be held liable for them, and the maximum fine for essential entities is at least €10M or 2% of worldwide turnover, whichever is higher.
Estimated split for a group with about twenty in-scope companies in eight countries, by hand and with the solution.
Seven agents scope, track the law, register, assess, read contracts and re-check blind; counsel and the board decide.
Kestrel & Vane Group has 31 EU legal entities, 19 of them in scope across eight countries. On Wednesday 14 October 2026 the agents have worked overnight and seven things need a person. Here is how the Head of GRC, counsel and a board member work with the agents, screen by screen, in the working solution.
Sofie's day opens with what the agents did overnight and what needs a person: the German registration for K&V Logistics BV, 41 supplier contracts without a security clause, a board approval waiting six days, a counsel decision on two countries. The measure grid puts it in place: the ten Article 21(2) measures down the side, eight countries across the top. Of 80 cells, 60 are met, 16 partial and 4 are gaps, and 10 carry a corner mark where national law adds rules.
“Checker agent agreed on 60 of 62 claims · last run 13 Oct 17:20.”
Sofie opens measure (d) for Belgium, a gap. The cell shows each step the agents took and how long it took: the supplier register read, 212 agreements and their schedules read in 38.4 s, the security clause found in 171, 9 of the 41 without one scored critical, addendum KV-SEC-ADD v3 drafted. The Checker agent re-read the 9 critical agreements blind and agreed on 8. The directive text and the Belgian law sit underneath.
Article 21(2)(d): “Supply chain security, including security-related aspects of the relationships between each entity and its direct suppliers or service providers.”
Kestrel & Vane Logistics BV has 2,140 people and €612M turnover. The Scoping agent read its activities and NACE codes, sized it with the linked group companies under Recommendation 2003/361 and applied Article 26. In Belgium it runs a port terminal and inland-water freight, so it is essential under Annex I; its Duisburg branch runs parcel and courier services, so it is important in Germany under Annex II. Confidence 97%, confirmed.
The Scoping agent never decides a borderline case: Kestrel & Vane Group Services NV, an intra-group ICT provider at 71% confidence, waits for counsel.
Section 33 BSIG required registration by 6 March 2026, and the BSI gave associations until 31 July 2026. Without it there is no account on the BSI reporting portal, so the 24-hour early warning has no route. The Registration agent has filled the authority's fields: legal name, the Duisburg address, sector and subsector, type of entity, the security contact, the public IP ranges and the member states served — each with the system it came from.
“The agent does not submit: the portal needs the company's own login (an ELSTER organisation certificate), and the submission is a legal act by the company.”
Sofie submits the registration herself and records the reference the portal returned, BSI-REG-2026-118204, ticking that she submitted it on the authority's portal. The registration turns to registered, submitted 14 October 2026, and the count moves to 10 registered and none overdue. The submission is on the audit trail with her name.
“I submitted this registration on the authority's portal myself.”
Portwise Terminal Systems runs the port terminal's operating system, a critical supplier on agreement MSA-2019-044. The contract read-out finds no security obligations, no incident notification time and no vulnerability handling, but an audit right in clause 16.4. The Supplier agent says the clause is missing; the Checker agent read schedule 7 as one. Sofie reads the text — schedule 7 covers confidentiality — and decides the clause is missing, with reason C2. The count stays at 41.
“Agents disagreed; a person decided.”
For the Netherlands, a government notice says the Cyberbeveiligingswet enters into force on a date set by royal decree; a law firm tracker says it is in force from 15 August 2026. The Transposition agent puts both quotes side by side and the column reads “Counsel to confirm”. Poland has the same question. France and Spain have no adopted law yet, so their companies are assessed against the directive.
“The agent stopped here. Matthias Brenner decides which reading applies; the grid column follows the decision.”
Plan RP-26-014 has waited six days for Annelies, board member of Kestrel & Vane Logistics BV. It sends addendum KV-SEC-ADD v3 to the 9 critical suppliers by 30 November 2026 and to the other 32 by 15 December, signed by 31 January 2027; three suppliers in renegotiation get a compensating control and a risk accepted for 90 days. Each reason cites the grid cell and the evidence: Article 21(2)(d), the supplier clause read-out of 14 October.
“Your approval is recorded with your name, the time, the reason code and the version of the plan.”
Annelies chooses A1, approved as proposed, and ticks the statement before she signs. Only the named member of that company's management body can approve: working as Head of GRC, Approve and Send back are disabled, with a note that only Annelies can approve. She could equally send the plan back with R1 or R2, and a note is required to do so.
“I have read the plan, its citations and the grid cells it closes, and I approve it as a member of the management body.”
Annelies completed the 4-hour NIS2 management-body training on 9 October 2026, recorded by the HR learning system. She signs the record. Companies with their measures approved move from 15 to 16 of 19, and members trained from 52 to 53 of 64. Every step of the morning — agent runs, the decision on Portwise, the submission, the approval and the signature — is on the audit trail.
“Training record signed · 53 of 64 members trained.”
The same morning, seen by the five people who carry it — what the work looked like, and what it looks like now.
Seven agents scope, track the law, register, assess, read contracts and re-check blind; counsel and the board decide.
Classifies each legal entity in each EU country by sector activity (Annex I or II), size with linked and partner companies under Recommendation 2003/361, the size-independent cases and jurisdiction under Article 26 — essential, important or out of scope, citing every step.
Reads each country's official journal, decrees and authority guidance; keeps the dates, authorities, portals, deadlines and extra national rules; marks the grid cells where national law adds rules.
Drafts each registration in the authority's own fields from the entity register, the scoping and the IP range inventory, and watches the deadlines and the two-week change duty of Article 3(4).
Maps the ISO 27001 Statement of Applicability, 93 Annex A controls and 412 group policies to Article 21(2)(a)–(j), claims each cell's status with its confidence, and drafts missing evidence for review.
Reads every ICT supplier agreement and its schedules for the security clause measure (d) needs, scores criticality, and drafts the addendum where the clause is missing, critical suppliers first.
Re-checks every “met” claim and every critical supplier reading blind, with the same readers as the agent it checks, and disagrees out loud.
Keeps each company's 24-hour, 72-hour and one-month reporting route to the right CSIRT or authority, with its contacts and national templates, and runs drills with live clocks.
Counsel decides the law; the named board member approves. The agents propose; a named person decides.
Ask in plain words. The answer cites its sources and opens the right screen.
Which of our companies are in scope in Germany, and why?
Four classifications in Germany. K&V Data Centres GmbH is essential (data centres, Annex I), and it covers the Amsterdam site too, because its main establishment is Frankfurt (Article 26). Kestrel & Vane Maschinenbau GmbH (machinery) and K&V Spezialchemie GmbH (chemicals) are important (Annex II). The Duisburg branch of K&V Logistics BV is important (postal and courier), and its §33 BSIG registration is 75 days overdue.
What is blocking supply-chain security at the logistics company?
Contracts. The Supplier agent read all 212 ICT supplier agreements of K&V Logistics BV: 41 have no security clause, and 9 of those are critical, among them the port terminal operating system and fleet telematics. The addendum is drafted, and plan RP-26-014 waits for Annelies Vermeulen.
Draft a board summary for Annelies Vermeulen
K&V Logistics BV is essential in Belgium and important in Germany. Two things need the board: the German registration is overdue, and 41 of 212 ICT suppliers have no security clause, so measure (d) is a gap in both countries. Plan RP-26-014 sends the addendum to the 9 critical suppliers by 30 Nov and to all 41 by 31 Jan 2027. Her training record is ready to sign.
Can we report an incident in Germany within 24 hours?
Not yet for the logistics branch. Six of eight country routes are ready, but the BSI reporting portal gives the Duisburg branch an account only after its §33 registration, which is missing. Record the registration, then set the route; the other German companies report today.
13 screens from the working solution, on its sample data. Pick one to see it large.
The floors that send work to people, the rules every cell is held to and the reason codes are settings. Only the Head of GRC changes them, and each save is a new version of the settings.
| Setting | Default | Choose from |
|---|---|---|
| Scoping confidence floor | 0.85 | Below this the Scoping agent sends the company to counsel |
| Gap confidence floor | 0.90 | Below this a cell goes to a person |
| Evidence counts for | 12 months | Penetration tests: 6 months |
| Critical supplier | Services that stop operations within 24 h | Used to order the supplier work |
| Registration reminders | 30, 14 and 7 days before | To the Head of GRC |
| Checker agent re-checks | Every “met” claim | And every critical supplier reading |
| Rules | A cell is met only with current evidence and the Checker agent's agreement | A partial needs a reason code, an owner and a date · every plan for an essential company needs its management body's approval · conflicting legal sources always go to counsel |
| Reminders and SLAs | Board approval waiting more than 10 days | Registration overdue: same day · evidence expiring: 30 days · early-warning clock at 12 hours: incident manager and CISO by phone and SMS |
Every figure is labelled: a target the solution is built to, an estimate, a typical published result, or a proven one.
“demo” = seen in the working solution, on its sample data · “target” = the design goal, measured in the live solution · “estimated” = our estimate · “typical” = published figures (CyberSmart NIS2 survey of 670 leaders, April 2026 — 16% fully compliant; Directive (EU) 2022/2555, Articles 20, 21, 23 and 34 — management body duties, the ten measures, the 24-hour early warning and fines of at least €10M or 2% of worldwide turnover for essential entities). National authorities and laws are named as context. People, companies and suppliers named on this page are fictional — characters and sample data in the working solution.
NIS2 Compliance is software for NIS2 scoping, gap assessment and Article 21 evidence for EU essential and important entities. Seven agents classify every company in every country, track each country's law, draft the registrations, map existing ISO 27001 controls to the ten measures, read every ICT supplier contract and keep the incident reporting routes ready. Legal counsel decides the law, the Head of GRC submits, and the named board member approves.
The Gap agent starts from what the group already has — the ISO 27001 Statement of Applicability, group policies and the evidence store — and maps it to Article 21(2)(a)–(j) in every country. Each cell is met, partial or a gap, with its evidence and confidence. A Checker agent re-checks every “met” claim blind, and the missing evidence is drafted for review.
The Transposition agent reads each country's official journal, decrees and authority guidance, keeps the dates, authorities, portals and deadlines, and marks the cells where national law adds rules. When two sources disagree, as on the Dutch entry-into-force date in the demo, it stops and puts both quotes in front of legal counsel.
Yes, by reading the contracts rather than sending questionnaires. The Supplier agent reads every ICT supplier agreement and its schedules for a security clause, ranks the missing ones by criticality and drafts the addendum. Procurement sends it only after the plan is approved.
No. The Registration agent drafts each registration in the authority's fields and the Incident readiness agent keeps the routes and templates ready, but a person submits on the authority's portal and records the reference. Drills are simulated and nothing is sent.
Each plan goes to the named board member of that company, who reads it with its citations and approves or sends it back with a reason code and a signed statement. Only that member can approve. Training records from the HR learning system are signed the same way, so Article 20 approval and training are on the record per company.
Yes. Confidence floors send borderline scoping and uncertain cells to people, counsel decides the law, agent disagreements are decided by a person, and the agents never submit, send or approve. Every action is on an audit trail that cannot be edited.
The Agentic Solution Engine builds and deploys it from your requirements and documents — your entity register, Statement of Applicability, policies and a sample of supplier contracts — and it goes live once every quality gate has passed. We will walk you through it on your own group first.
Exceptions found before the auditor finds them, and one evidence set for both audits.
1-min demoCyber Incident ReportingEvery regulator clock met, from one cited set of facts the committee signed.
1-min demoCMMC ComplianceEvery one of the 320 objectives proven before an executive signs the affirmation.
1-min demoWe'll run NIS2 Compliance on your own entity register, Statement of Applicability and a sample of your ICT supplier contracts.