If you build SaaS products and serve European customers, two major EU regulations are demanding your attention right now NIS2 and DORA. But which one actually applies to you? And what happens if both do? 

This guide cuts through the legal jargon and gives developers and technical teams a clear, practical breakdown of what each regulation requires, who it covers, and exactly what you need to do next. 

What Is NIS2 And Why Should SaaS Teams Care? 

The Network and Information Security Directive 2 (NIS2) officially Directive EU 2022/2555 replaced the original NIS1 Directive in October 2024. It is the EU's broadest cybersecurity law to date, covering 18 critical sectors including energy, healthcare, transport, digital infrastructure, and critically for tech companies cloud computing services and managed service providers. 

NIS2 defines two tiers of covered organizations: 

• Essential Entities - Organizations in high-criticality sectors like energy, banking, healthcare, and digital infrastructure. 
• Important Entities - Organizations in sectors like food production, waste management, and ICT service management. 

Size threshold: Companies with more than 50 employees OR revenue exceeding €10 million in these sectors are directly in scope. Smaller companies may be indirectly affected if they serve essential or important entities. 

What NIS2 Requires From You 

If NIS2 applies to your SaaS product, here is what you must implement: 

• Risk management measures — regular risk assessments, vulnerability management, and documented security policies 
• Supply chain security — auditing vendors and third-party SaaS tools used within your organization 
• Incident reporting — a three-stage process: early warning within 24 hours, full notification within 72 hours, and a final report within 30 days 
• Executive accountability — senior management must approve cybersecurity measures and can face personal liability for failures 
• Business continuity planning — documented disaster recovery and crisis management procedures 
• Asset inventory — a complete map of all information systems, including shadow IT and SaaS applications 

Penalties for non-compliance: Up to €10 million or 2% of global annual turnover for essential entities, and €7 million or 1.4% of turnover for important entities whichever is higher.

What Is DORA And How Is It Different? 

The Digital Operational Resilience Act (DORA) Regulation EU 2022/2554 has been fully applicable since January 17, 2025. Unlike NIS2, DORA is a regulation, not a directive. This means it applies directly and uniformly across every EU member state with zero national variation. 

DORA is laser-focused on the financial sector and its ICT supply chain. It covers roughly 22,000 financial entities, including: 

• Banks and credit institutions I
• nsurance companies and reinsurers 
• Investment firms and asset managers 
• Payment institutions and e-money institutions 
• Crypto-asset service providers (CASPs) 
• Trading venues and central counterparties 

Crucially for SaaS teams: If your product serves any of these financial entities, DORA reaches you indirectly through contractual requirements your customers will push down to you. 

What DORA Requires 

DORA's requirements are stricter and more prescriptive than NIS2: 

• ICT Risk Management Framework — a formal, board-approved framework covering identification, protection, detection, response, and recovery 
• Incident Reporting — major ICT incidents must be reported within 4 hours of classification, followed by updates at 24 and 72 hours 
• Digital Operational Resilience Testing — including mandatory Threat-Led Penetration Testing (TLPT) for significant entities 
• Third-Party Risk Management — a formal Register of Information (ROI) documenting all critical ICT vendors, with contractual security clauses 
• ICT Concentration Risk — managing over-dependence on a single cloud or ICT provider 
• Information Sharing — participating in threat intelligence sharing with other financial entities 

Penalties: Up to 2% of global annual turnover, with potential daily penalties for continued non-compliance. 

In 2026, DORA enforcement has fully shifted from guidance to active supervision. National regulators including BaFin (Germany), AFM/DNB (Netherlands), and ACPR/AMF (France) are actively conducting supervisory reviews and audits.

NIS2 vs DORA: Side-by-Side Comparison

Here is the legal rule that every compliance team must know: 

Article 4 of NIS2 explicitly states that DORA takes precedence (in legal terms: DORA is lex specialis) wherever the two regulations address the same matter for financial entities. 

This means: 

• If you are a financial entity (bank, insurer, payment institution, etc.) DORA applies, full stop. NIS2 defers to DORA for overlapping requirements. 
• If you are a SaaS company serving financial entities you are subject to NIS2 directly, and DORA contractually through your customers. 
• Full DORA compliance will satisfy most equivalent NIS2 obligations, but NIS2 may add narrow additional requirements around national CSIRT coordination and certain physical security elements.

Which Regulation Applies to Your SaaS Product? 

A Decision Framework Ask yourself these three questions in order: 

Question 1: Are you a financial entity as defined by DORA? Banks, insurers, payment institutions, investment firms, crypto-asset service providers if you are any of these, DORA applies directly. NIS2 defers to DORA for overlapping areas. 

Question 2: Do you serve financial entities as an ICT provider? If yes, you are not directly in DORA scope, but your customers will contractually impose DORA requirements on you. You may also fall under NIS2 as an ICT service provider depending on your size and sector. 

Question 3: Do you operate in any of NIS2's 18 sectors, or provide cloud/digital services? If yes, NIS2 applies to you directly. This catches most SaaS companies serving healthcare, energy, public administration, and digital infrastructure clients. 

The uncomfortable reality for many mid-sized SaaS companies: You may end up implementing NIS2 controls for your overall operation and DORA-aligned controls specifically for your financial sector customers. Deliberate planning is essential.

Practical Steps for SaaS Teams Starting Compliance Today 

Whether NIS2, DORA, or both apply to you, here is where to focus first: 

1. Build your asset inventory. Both regulations assume you know exactly what systems you run, who owns them, and how critical they are. Without this, everything else is theoretical. 
2. Set up incident classification and reporting workflows. DORA's 4-hour initial reporting deadline is aggressive. Build pre-approved notification templates, define escalation paths, and run tabletop exercises before an incident occurs not during one. 
3. Map your third-party dependencies. Know your critical vendors, have contracts with security clauses on file, and document your exit strategy if a vendor fails. For DORA, maintain the Register of Information in the format specified by the European Supervisory Authorities (ESAs). 
4. Get leadership formally involved. Both NIS2 and DORA attach personal accountability to senior management. Security must become a board-level conversation not just an engineering team concern. 
5. Use ISO 27001 as your compliance foundation. ISO 27001 is the single best starting point for both DORA and NIS2. Achieving ISO 27001 certification significantly reduces incremental effort for both regulations and demonstrates verifiable controls to regulators and customers alike

How VISTA InfoSec Can Help 

Navigating overlapping EU regulations is complex especially when your SaaS product serves customers across multiple sectors and geographies. At VISTA InfoSec, our compliance experts specialize in helping SaaS companies, fintechs, and digital service providers map their NIS2 and DORA obligations, build gap assessment frameworks, and achieve certification-ready postures efficiently. 

With 20+ years of experience across PCI DSS, ISO 27001, SOC 2, GDPR, and EU digital resilience frameworks, we bring the cross-regulation expertise your team needs without the overhead of building it in-house. 

Book a free compliance consultation with VISTA InfoSec

Key Takeaways 

• NIS2 is a broad EU cybersecurity directive covering 18 sectors, including cloud and SaaS providers. It requires risk management, supply chain security, 72-hour incident reporting, and executive accountability. 
• DORA is a stricter, directly applicable regulation targeting the financial sector and its ICT suppliers with a demanding 4-hour incident report requirement and mandatory penetration testing. 
• Where they overlap, DORA takes precedence for financial entities (the lex specialis principle). 
• Most SaaS companies are touched by at least one of these regulations — and many will need to satisfy elements of both. 
• Start with an asset inventory, incident response workflow, and ISO 27001 as your compliance foundation. 

The enforcement window is no longer ahead of you. It is now. The sooner your team understands its obligations, the less painful and expensive the path to compliance will be.

For the first time since the Digital Operational Resilience Act (DORA) came into force, European financial entities are receiving official notifications to undergo Threat-Led Penetration Testing (TLPT). This is not a routine compliance exercise. It is a live, regulator-mandated simulation of a real cyberattack against your organisation's most critical systems, and the results will determine how supervisors view your operational resilience for years to come.

If your organisation is a bank, insurer, asset manager, payment provider, or an ICT service provider supporting any of these, 2026 is the year DORA stops being a compliance document and starts being an operational reality. Here is exactly what is happening, what is required of you, and how to prepare.

From Guidance to Enforcement: Where DORA Stands in 2026

DORA has been fully enforceable since January 17, 2025, following a two-year transition period. Unlike NIS2, which required each EU member state to transpose it into national law, DORA is a regulation, meaning it applies directly and uniformly across all member states without national variation. This is the regulatory backbone for ICT risk management across the EU financial sector.

What makes 2026 distinct is that European Supervisory Authorities, the EBA, EIOPA, and ESMA, have now finalised the detailed Regulatory and Implementing Technical Standards that specify exactly how compliance must be demonstrated. Supervisors are no longer issuing guidance. They are conducting audits, scrutinising ICT third-party contracts, and issuing the first formal TLPT notifications to in-scope entities.

What Is Threat-Led Penetration Testing (TLPT) Under DORA?

TLPT is DORA's most advanced testing requirement. It mandates that designated financial entities undergo a controlled, intelligence-led simulated cyberattack against their live production systems, replicating the tactics of real threat actors rather than running a standard vulnerability scan.

Entities that receive a TLPT notification have a defined timeline to respond: three months to submit initiation documents, followed by six additional months to deliver a detailed scope specification before testing begins. This is a significant undertaking that touches threat intelligence, red-team execution, and senior management sign-off, not something that can be arranged in the final weeks before a deadline.

The first wave of TLPT notifications is being issued in late 2026, with subsequent waves continuing into 2027. Entities should not assume they are out of scope simply because they have not yet been notified. Designation criteria consider systemic importance, and the list of in-scope entities is expected to expand.

The Register of Information: Your Most Urgent 2026 Deadline

While TLPT is the headline-grabbing requirement, the Register of Information (RoI) under Article 28 of DORA is the obligation affecting every single financial entity in scope, right now. The RoI is a comprehensive register documenting all contractual arrangements with ICT third-party service providers, covering everything from your cloud infrastructure provider to your data analytics vendor.

National competent authorities must consolidate and forward these registers to the European Supervisory Authorities by March 31, 2026, using a reference date of December 31, 2025. Individual countries have set their own internal submission windows ahead of this backstop date. For example, German entities submit to BaFin between March 9 and 30, Dutch entities submit to DNB or AFM by March 20, and Irish entities submit to the Central Bank of Ireland between March 2 and 31.

This is widely regarded as the most data-intensive obligation under DORA. During the European Supervisory Authorities' 2024 dry-run exercise, only a small fraction of nearly 1,000 participating firms successfully passed all data quality checks on their first attempt, underscoring just how easy it is to get this wrong. Submissions must follow a strict xBRL-CSV format, and errors trigger a resubmission cycle that can quickly eat into your remaining time.

Why ICT Third-Party Providers Should Pay Close Attention Too

DORA's reach extends well beyond banks and insurers. If your organisation provides software, cloud hosting, cybersecurity services, or any technology service to a financial entity operating in the EU, you are part of the ecosystem DORA regulates, even if you are not directly supervised.

The European Supervisory Authorities have already published an official list of Critical ICT Third-Party Providers, including major hyperscale cloud providers and global technology and telecom firms. These designated providers face direct oversight from Joint Examination Teams. Financial entities relying on any of these providers must document the dependency in their Register of Information and assess concentration risk accordingly. In practice, this means your financial sector clients will increasingly demand proof of your own security posture, incident response capability, and resilience testing before renewing contracts.

DORA vs NIS2: Understanding the Overlap

Many organisations operating in regulated sectors are now navigating both DORA and NIS2 simultaneously, and the relationship between the two matters. DORA acts as lex specialis to NIS2 for the financial sector, meaning that where the two frameworks overlap, DORA's more specific and stringent requirements take precedence for in-scope financial entities.

If your organisation has already built NIS2 compliance processes around incident reporting, risk management, and supply chain oversight, you have a meaningful head start. However, DORA introduces requirements that go further, particularly around the Register of Information and Threat-Led Penetration Testing, which have no direct equivalent under NIS2. Equally, a strong ISO 27001 information security management system provides a solid foundation, since a large proportion of ISO 27001 controls map directly onto DORA's ICT risk management pillar.

Your DORA 2026 Compliance Checklist

• Confirm your in-scope status: Determine whether your organisation, or your role as an ICT provider to financial entities, falls within DORA's regulatory perimeter.
• Build and validate your Register of Information: Document every ICT third-party contractual arrangement at entity, sub-consolidated, and consolidated level, formatted correctly for xBRL-CSV submission.
• Map your national submission window: Confirm your country's specific RoI deadline ahead of the March 31, 2026 ESA backstop date.
• Run internal data quality checks: Validate LEI and entity identifiers, check for duplicate records, and confirm consistency across all contracts before submission.
• Prepare for TLPT readiness: Even without a notification yet, establish threat intelligence capability, red-team processes, and senior management sign-off procedures.
• Review your ICT risk management framework: Ensure it is documented, board-approved, and reviewed on an ongoing basis as DORA requires.
• Strengthen incident reporting workflows: DORA requires major incidents to be reported within hours, not days, so test your detection and escalation timelines.
• Reassess critical ICT third-party dependencies: Identify any reliance on designated Critical ICT Third-Party Providers and document concentration risk.
• Align with existing ISO 27001 or NIS2 programmes: Avoid duplicating effort by mapping shared controls across frameworks.

How Vista Infosec Can Help

DORA compliance is technically demanding and time-sensitive, but it does not have to be navigated alone. Vista Infosec is a CREST-accredited global cybersecurity and compliance consulting firm with over 20 years of experience helping financial entities and ICT providers across the US, UK, Singapore, India, and the Middle East meet rigorous regulatory standards.

Our team can help you:

• Conduct a DORA gap assessment and build or validate your Register of Information ahead of national deadlines.
• Design and execute penetration testing aligned withTLPT methodology and audit expectations.
• Strengthen your ICT risk management framework and incident reporting processes.
• Map DORA requirements against your existing ISO 27001, SOC 2, or NIS2 controls to streamline compliance and reduce audit fatigue.

Do not wait for a TLPT notification to discover gaps in your resilience. Get assessed now and walk into your next regulatory audit with confidence.

Book a free 30-minuteconsultation with Vista Infosec today.

For years, organisations deploying artificial intelligence operated in a comfortable grey zone innovating freely while regulators struggled to keep pace. That era is definitively over. The EU Artificial Intelligence Act (EU AI Act) is now in active enforcement, and August 2026 marks a critical deadline for businesses using high-risk AI systems to demonstrate full compliance. If your organisation has not yet assessed its AI exposure, the clock is no longer ticking it has already run out for some obligations.

This article cuts through the regulatory noise and gives you a clear, practical picture of what the EU AI Act demands from a cybersecurity and compliance standpoint, and what steps to take right now.

What Is the EU AI Act and Why Does It Matter for Cybersecurity?

The EU AI Act is the world's first comprehensive legal framework for artificial intelligence. It applies to any organisation that develops, deploys, imports, or uses AI systems within the European Union regardless of where the organisation is headquartered. This means a company based in Singapore, the US, or India that serves EU customers or uses EU personal data must still comply.

The regulation adopts a risk-based approach, categorising AI systems into four tiers: unacceptable risk (banned outright), high risk (tightly regulated), limited risk (transparency obligations), and minimal risk (largely unregulated). The most critical category for most businesses is high-risk AI which includes systems used in HR and recruitment, credit scoring, biometric identification, access to critical services, law enforcement, and more.

From a cybersecurity lens, the EU AI Act is not just an ethics or transparency law. It mandates rigorous technical and organisational security controls for high-risk systems making it directly relevant to your information security posture, data protection programme, and compliance frameworks like ISO 27001, SOC 2, and GDPR.

Key Cybersecurity Requirements Under the EU AI Act

If your organisation develops or deploys high-risk AI systems, the Act mandates specific technical and governance controls. Here is what compliance looks like in practice:

1. Robustness, Accuracy, and Cybersecurity (Article 15)

High-risk AI systems must be resilient against attempts by unauthorised third parties to alter their outputs. They must maintain consistent performance and include protections against adversarial attacks, model poisoning, and data integrity manipulation. This is not a vague aspiration it requires documented, tested controls.

2. Data Governance and Quality (Article 10)

Training, validation, and testing datasets must be managed with rigorous data governance practices. Organisations must demonstrate data quality, relevance, and freedom from harmful biases. This aligns closely with existing data protection obligations under GDPR, creating a dual compliance requirement that many organisations have yet to map.

3. Technical Documentation (Article 11)

Providers of high-risk AI must maintain comprehensive technical documentation covering system architecture, training methodology, performance metrics, and risk management processes. This documentation must be available to regulators on request and kept up to date throughout the system's lifecycle.

4. Logging and Traceability (Article 12)

High-risk AI systems must have automatic logging capabilities that allow regulators and auditors to trace system decisions. This is a significant operational requirement for any organisation currently relying on black-box AI models without audit trails.

5. Human Oversight (Article 14)

Organisations must implement measures enabling meaningful human oversight of AI-driven decisions, particularly where those decisions have significant impacts on individuals. This has direct implications for how AI tools are embedded in business workflows and what controls are placed around automated decision-making.

The August 2026 Deadline: What Changes Now?

Phase two of the EU AI Act enforcement applies from August 2, 2026. This phase brings the full weight of compliance obligations for high-risk AI systems into force. Organisations in scope face:

• Fines of up to €30 million or 6% of global annual turnover for violations involving prohibited AI practices.
• Fines of up to €20 million or 4% of global annual turnover for non-compliance with high-risk AI requirements.
• Reputational damage, loss of EU market access, and potential suspension of AI system operations.
• Mandatory registration of high-risk AI systems in the EU's public database.

Cyber insurance carriers are already factoring AI governance into their underwriting criteria, requiring documented adversarial testing, model-level risk assessments, and alignment with recognised AI risk management frameworks. Organisations without demonstrable AI security controls may face higher premiums or coverage exclusions.

How the EU AI Act Overlaps With GDPR, ISO 27001, and SOC2

One of the most important and often overlooked aspects of EU AI Act compliance is how heavily it overlaps with existing cybersecurity and data protection frameworks. This is both a challenge and an opportunity.

If your organisation is already compliant with GDPR, ISO 27001, or SOC 2, you are not starting from zero. Many of the controls these frameworks require access management, data minimisation, incident response, audit logging, vendor oversight directly support EU AI Act compliance. A well-structured compliance programme can address all three frameworks without duplicating effort.

For example, ISO 27001's Annex A controls around information classification, system security, and supplier relationships map directly to the EU AI Act's requirements for data governance and third-party AI provider oversight. Similarly, SOC 2's availability and confidentiality criteria support the Act's requirements for AI system robustness and access controls.

However, gaps remain. Most organisations' existing frameworks do not yet cover AI-specific risks such as model drift, adversarial inputs, or bias monitoring. These gaps must be identified and addressed before audit exposure increases.

Your EU AI Act Compliance Checklist for 2026

• Conduct an AI inventory audit: Identify all AI systems in use, classify them by risk tier, and flag any high-risk systems that require immediate attention.
• Map EU AI Act requirements to your existing compliance frameworks (ISO 27001, SOC 2, GDPR) to identify gaps and avoid duplicating effort.
• Implement technical documentation for all high-risk AI systems, covering architecture, training data, performance baselines, and risk management.
• Enable logging and audit trail capabilities across all high-risk AI deployments.
• Conduct adversarial testing and red-team exercises to validate AI system robustness against manipulation and attacks.
• Review your data governance processes for training and validation datasets to ensure GDPR and AI Act dual compliance.
• Establish human oversight workflows for AI-driven decision-making in HR, finance, access control, or any high-stakes domain.
• Update vendor contracts and supplier risk assessments for any third-party AI providers.
• Register applicable high-risk AI systems in the EU AI Act public database before the August 2026 deadline.

How Vista Infosec Can Help

Navigating the EU AI Act alongside your existing compliance obligations is genuinely complex but it does not need to be overwhelming. Vista Infosec is a CREST-accredited global cybersecurity and compliance consulting firm with over 20 years of experience helping organisations across the US, UK, Singapore, India, and the Middle East achieve and maintain compliance with the world's most demanding frameworks.

Our team of certified experts can help you:

• Perform an AI risk assessment and map your current controls to EU AI Act requirements.
• Design and implement technical documentation, logging, and human oversight frameworks.
• Integrate EU AI Act compliance into your existing ISO 27001, SOC 2, or GDPR programme to minimise cost and duplication.
• Prepare for regulatory audits and maintain ongoing compliance as the regulatory landscape evolves.

Do not wait for an enforcement action to drive your compliance programme. Get ahead of the curve now.

Book a free 30-minuteconsultation with Vista Infosec today.

We are barely halfway through 2026, and the cybersecurity landscape has already been turned on its head. Ransomware? Still a threat. Phishing? Evolving fast. But there is a new challenger at the top of the threat rankings one that most businesses are not even remotely prepared for.

Agentic AI.

According to a 2026 Dark Reading poll, 48% of cybersecurity professionals now rank agentic AI as the top attack vector of the year outranking deepfakes, ransomware variants, and supply chain breaches. This is not a future concern. It is happening right now, inside your organisation, possibly without your knowledge.

So what exactly is agentic AI, why is it so dangerous, and more importantly what can your business do about it? Let us break it all down.

What Is Agentic AI, and Why Should You Care?

Traditional AI tools think chatbots, recommendation engines, or auto-fill assistants respond to prompts. They wait for instructions and produce outputs. Agentic AI is fundamentally different.

Agentic AI systems are autonomous. They can pursue goals through multi-step workflows, coordinate with other tools, take actions, and adapt plans as new information arrives. They do not just answer questions they do things. They can open pull requests in your code repository, query internal databases, trigger cloud workflows, book services, and interact with other AI agents all with minimal human involvement.

In business environments, this sounds like incredible productivity. And it is. But it also introduces a category of security risk that legacy cybersecurity frameworks were simply never designed to handle.

The Hidden Threat: Shadow AI and Non-Human Identities

Here is where things get particularly alarming for IT and security teams.

Employees across organisations are importing unsanctioned AI tools into work environments often without any security oversight. This is called Shadow AI, and it is one of the fastest-growing blind spots in enterprise security today. Research shows that more than one-third of all data breaches now involve unmanaged shadow data much of it generated or accessed by AI agents operating outside monitored channels.

Compounding this is the rise of non-human identities (NHIs). Every AI agent deployed within an organisation requires API access, machine-to-machine authentication, and elevated permissions. The Huntress 2026 data breach report identified NHI compromise as the fastest-growing attack vector in enterprise infrastructure this year. Developers often hardcode API keys in configuration files or leave them in version control repositories. A single compromised agent credential can provide attackers access equivalent to that agent's permissions for weeks or months, completely undetected.

Now multiply that across a complex multi-agent system, where one orchestration agent holds credentials for five downstream agents. If that orchestration layer is compromised, an attacker gains access to every one of those downstream systems simultaneously.

This is not hypothetical. In 2026, a supply chain attack on the OpenAI plugin ecosystem resulted in compromised agent credentials being harvested from 47 enterprise deployments.

Specific Risks Your Security Team Needs to Know

Agentic AI introduces several distinct attack surfaces that require targeted security strategies:

1. Prompt Injection and Manipulation

2. Tool Misuse and Privilege Escalation

3. Memory Poisoning

4. Cascading Failures in Multi-Agent Systems

5. Agent-to-Agent Impersonation

What Does This Mean for Compliance?

If your organisation operates under ISO 27001, SOC 2, GDPR, HIPAA, NIS2, or DORA, the arrival of agentic AI creates immediate compliance implications that cannot be ignored.

Governance frameworks built even two or three years ago simply did not anticipate AI agents as participants in business processes. Today, these agents are accessing sensitive data, triggering transactions, and generating audit trails or failing to generate them, which may itself constitute a compliance breach.

Gartner has flagged global regulatory volatility as one of the top cybersecurity trends of 2026, advising security leaders to formalise collaboration across legal, business, and procurement teams to establish clear accountability for AI-driven risk. Rapid incident reporting requirements sometimes within 24 hours are already live under frameworks like DORA and NIS2. Manual, human-only processes are unlikely to keep pace.

The good news? Agentic compliance systems are emerging that can monitor regulatory changes, identify impacted policies, update internal workflows, and create a complete audit chain bringing compliance closer to continuous control management. But deploying these systems safely requires expertise.

How Should Businesses Respond? A Practical Framework

Whether you are a startup, an SME, or an enterprise, the following steps are non-negotiable in 2026:

Step 1: Conduct an AI Asset Inventory
Step 2: Audit Non-Human Identities
Step 3: Include AI Systems in Your Penetration Testing Scope
Step 4: Update Your Incident Response Playbook
Step 5: Align with a Recognised Security Framework
Step 6: Train Every Employee, Not Just the Security Team

You cannot secure what you cannot see. Begin by mapping every AI tool sanctioned or otherwise in use across your organisation. Include third-party integrations, developer-side tools, and any system with API access to internal data.

Review every machine identity, service account, and API key in your environment. Implement the principle of least privilege rigorously no agent should have more access than it absolutely needs to perform its defined function.

Traditional penetration testing focuses on applications, networks, and infrastructure. In 2026, your penetration testing engagement must explicitly include AI agents, their integration points, and their associated credentials as part of the test scope. If your current vendor is not doing this, it is time to ask why.

Your incident response plans need to account for AI-driven incidents including scenarios where an agent has been operating maliciously for days or weeks before detection. Define clear escalation paths, containment procedures, and communication protocols specific to AI-related breaches.

Adopt or review your alignment with OWASP's Top 10 for LLM Applications and the MITRE ATLAS framework, both of which address AI-specific threats. These sit alongside your existing ISO 27001 or SOC 2 programme and provide targeted guidance for agentic system security.

AI governance is an enterprise-wide responsibility. Every employee from entry-level staff to board members needs to understand what data can and cannot be used in AI tools, and how to recognise social engineering attacks that are now enhanced by AI-generated content.

The Bigger Picture: Cybersecurity Is No Longer Just an IT Problem

Gartner's analysis of 2026 trends makes one thing crystal clear: cybersecurity has become a board-level business risk, with regulators increasingly holding executives and directors personally liable for compliance failures. Inaction is no longer defensible it carries substantial penalties, operational restrictions, and irreversible reputational damage.

The organisations that will thrive in this environment are not necessarily those with the largest security budgets. They are the ones with the clearest governance structures, the most rigorous testing protocols, and the right advisory partnerships to help them navigate an increasingly complex threat and compliance landscape.

Secure Your AI-Driven Future With Expert Guidance

The cybersecurity challenges of 2026 are real, evolving, and consequential. But they are also manageable with the right expertise on your side.

At Vista Infosec, we help organisations across Singapore, the United States, the United Kingdom, and India navigate the intersection of emerging threats and compliance requirements. From VAPT (Vulnerability Assessment and Penetration Testing) that now covers AI systems, to GDPR, NIS2, and ISO 27001 compliance consulting our team of CREST-accredited security professionals brings the depth of experience your organisation needs to stay secure and audit-ready in 2026 and beyond.

Do not wait for an incident to find the gaps. Get a security assessment today.

Contact Vista Infosec

For the past two years, "NIS2" has been a looming deadline on most compliance calendars something to prepare for "soon." In 2026, that moment is here. Regulators across EU member states are no longer in guidance mode. They are in enforcement mode. If your organisation hasn't moved from awareness to action on NIS2 compliance, the window you've been banking on is closing fast.

This blog cuts through the noise and gives you a plain-English picture of where NIS2 stands right now, what it actually demands from your business, and the practical steps that separate organisations that will survive an audit from those that will face multi-million euro consequences.

The state of NIS2 enforcement in 2026 what's actually happening

As of mid-2026, 21 of 27 EU member states have formally transposed the NIS2 Directive into national law. Germany's NIS2 Implementation Act came into force in December 2025. Several others followed in early 2026. The European Commission has even referred non-transposing member states to the Court of Justice of the EU.

What this means in practice: national regulatory authorities are no longer waiting. They are initiating supervisory inspections, reviewing incident reports, and flagging gaps in compliance documentation. The first wave of NIS2 compliance audits has a deadline of June 30, 2026 and that date falls right now.

For organisations classified as essential entities energy, transport, healthcare, water, banking, digital infrastructure the stakes are as high as €10 million or 2% of global annual turnover, whichever is higher. For important entities, penalties reach €7 million or 1.4% of global turnover.

Who does NIS2 actually apply to? (More organisations than you think)

One of the most significant changes NIS2 made compared to the original NIS1 directive is scope. The updated regulation now covers 18 critical sectors, and the definition of "in scope" has been deliberately broadened to capture previously unregulated parts of the digital economy.

If your organisation operates in energy, transport, banking, financial market infrastructure, health, drinking water, wastewater, digital infrastructure, ICT service management, public administration, or space you are almost certainly in scope. But it doesn't stop there. Manufacturers of medical devices, chemicals, food, and digital providers of online marketplaces, cloud computing, and managed services have all been added under NIS2.

Even more critically: if you are a supplier to a regulated entity, you may be pulled into scope through contractual requirements. NIS2 supply chain security is not a footnote it is one of the directive's most disruptive provisions.

The 5 NIS2 requirements that most organisations underestimate

1. Board-level personal accountability

Article 20 of the directive is blunt: management bodies meaning boards and senior executives must personally approve cybersecurity risk management measures, oversee their implementation, and receive cybersecurity training. In the event of gross negligence during a significant incident, individual executives can be held personally liable. This is not a delegatable IT task anymore. It is a governance obligation at the highest level.

2. The 24-72-30 incident reporting timeline

Article 23 introduces one of the strictest incident reporting obligations in any cybersecurity regulation worldwide. When a significant incident occurs, your organisation must issue an early warning within 24 hours, submit a detailed notification within 72 hours, and deliver a full incident report within 30 days. Missing any of these windows even by hours is a reportable failure. Most organisations that have never practised incident response under this kind of clock underestimate how demanding it is operationally.

3. Supply chain risk management — not a tick-box

NIS2 requires you to assess, document, and actively manage the cybersecurity posture of your critical suppliers and service providers. Regulators expect contractual clauses, supplier assessments, and evidence that you have acted on known risks. An organisation with strong internal controls but no supplier security programme will fail an NIS2 audit.

4. Continuous monitoring — not annual review

The era of annual compliance reviews is over under NIS2. Supervisory authorities want to see real-time behavioural evidence: logs, telemetry, monitoring dashboards, and incident records. Documentation is foundational, but it must be underpinned by live operational controls. If your compliance programme produces paperwork but no active detection and response capability, you are not NIS2-ready.

5. Vulnerability management and VAPT

NIS2 expects technical evidence that your systems are actually secure not just documented as such. This means regular vulnerability assessment and penetration testing (VAPT), remediation tracking, and proof that known vulnerabilities are addressed within defined timeframes. A CREST-certified cybersecurity audit partner can provide the technical assurance that regulators expect to see.

ISO 27001 gives you a head start — but it's not enough on its own

If your organisation is already ISO 27001 certified, you are ahead of many peers. The frameworks overlap significantly on risk management, access controls, incident management, and supplier security. However, NIS2 goes further in several areas particularly around incident notification timelines, board accountability, and the mandatory 10 risk management measures specified in the directive. ISO 27001 and NIS2 together create a powerful compliance foundation. Separately, neither fully satisfies the other.

The same applies to organisations with existing GDPR compliance programmes. GDPR and NIS2 share principles around data protection and incident reporting, but NIS2's technical security requirements go considerably deeper into operational resilience and network security.

The NIS2 compliance roadmap for mid-2026 — what to do now

If your organisation is still in the preparation phase, here is the priority sequence that experienced compliance advisors recommend for rapid-track NIS2 readiness:

Step 1 — Establish scope and classification. Confirm whether your organisation qualifies as essential or important under your country's NIS2 transposition law. Different thresholds apply in different member states.

Step 2 — Conduct a gap assessment. Map your existing controls against the 10 mandatory NIS2 risk management measures. Identify critical gaps in areas like incident response, supply chain, and monitoring.

Step 3 — Implement the 10 mandatory measures. These include policies on risk analysis, incident handling, business continuity, supply chain security, network security, access control, cryptography, and human resources security, among others.

Step 4 — Build your incident response capability. Rehearse the 24-72-30 reporting cycle. Assign roles, establish communication trees, and test your detection and response pipeline end to end.

Step 5 — Engage board and senior leadership. Present a compliance status briefing to the board and document their approval of cybersecurity measures. This is both a regulatory requirement and your evidence trail if questions arise later.

Step 6 — Commission a NIS2 compliance audit. An independent, CREST-accredited assessor can validate your controls, identify residual gaps, and generate the audit documentation that regulators expect.

The cost of doing nothing is not hypothetical anymore

Across the EU, regulators have made clear that enforcement action will follow patterns of systemic weakness not just individual incidents. Organisations that cannot demonstrate continuous monitoring, adequate documentation, and governance-level oversight are at the highest risk. The penalties are financial, reputational, and in cases of personal executive liability career-ending.

The organisations that come through 2026 audits cleanly will be those that treated NIS2 not as a bureaucratic exercise, but as a genuine operational programme. They will have invested in technical controls, built real incident response capability, and engaged an experienced NIS2 compliance consultant who could translate regulatory language into working systems.

The window for preparation has not fully closed but it is narrow. The most important step you can take today is to know exactly where you stand.

Vista InfoSec is a CREST-accredited, globally recognised cybersecurity compliance firm with deep expertise in NIS2, GDPR, ISO 27001, PCI DSS, and a wide range of international frameworks. If you want to know your NIS2 readiness position, get in touch with the Vista InfoSec team today.