NIS2 Self-Assessment with AI

𝗔 𝗯𝗶𝗸𝗲 𝗺𝗮𝗻𝘂𝗳𝗮𝗰𝘁𝘂𝗿𝗲𝗿 𝘄𝗶𝘁𝗵 𝟮𝟬𝟬 𝗲𝗺𝗽𝗹𝗼𝘆𝗲𝗲𝘀 𝗷𝘂𝘀𝘁 𝗳𝗼𝘂𝗻𝗱 𝗼𝘂𝘁 𝘁𝗵𝗲𝘆 𝗳𝗮𝗹𝗹 𝘂𝗻𝗱𝗲𝗿 𝗡𝗜𝗦𝟮.

Other transport equipment, NACE C.30, Annex II. Nobody told them — because under NIS2, nobody will. You have to figure it out yourself.

#NIS2 is what #GDPR did for personal data, but for cybersecurity. If you provide services that matter to the economy and you're above a certain size you secure your IT systems, report incidents, prove you're doing both. Across the EU, manufacturing, food, chemicals, waste management are hitting cybersecurity regulation for the first time.

That bike company now faces 10 mandatory risk management measures under Art. 21. A 24-hour incident reporting obligation — running parallel to GDPR's 72-hour track to a different authority. And management body liability: Art. 20 requires personal board engagement. Germany went further with § 38(2) BSIG: the Managing Director/CEO is personally liable. Not the company, the person.

Transposition varies wildly in the #EU. Germany in force since December 2025, no transition. Italy live since October 2024. France, Netherlands, Spain still pending.

The German Federal Office for Information Security (BSI) offers a free scope check tool. It tells you whether you're affected. But it stops there.

So I built a NIS2 Navigator - a Claude Skill that runs scope classification, gap analysis across all 10 measures, and a prioritized roadmap in ~20 minutes. Deep German integration, plus profiles for Italy, France, Netherlands, Austria, Spain. Built on the Directive, ENISA guidance, and BSI #nis2know packages.