Reuse Evidence Without Merging the Legal Tests
An asset inventory, access register and incident record can support several compliance activities. This is useful when the organisation knows which obligation each piece of evidence serves. A shared tool or document does not make NIS2, the AI Act and GDPR interchangeable.
First establish whether the organisation falls within the relevant national NIS2 rules, which AI systems and roles are in scope, and what personal-data processing occurs. Other sectoral requirements may also apply.
Where the Work Overlaps
Risk management. NIS2 Article 21 concerns proportionate cybersecurity measures for covered entities. AI Act Article 9 concerns lifecycle risk management for high-risk AI systems. A common inventory can support both, while distinguishing availability, integrity and confidentiality from health, safety and fundamental-rights risks.
Monitoring. Security monitoring and AI-system monitoring may share infrastructure. The events, metrics, retention and access requirements still need to be defined for each purpose. A security dashboard alone does not establish that an AI system is performing appropriately.
Documentation. Use version control, ownership and review records consistently. AI Act technical documentation under Article 11 and Annex IV has requirements that a general security policy does not replace.
Incident response. A common internal escalation process can branch into different legal classifications, recipients and deadlines. A security incident, personal-data breach and serious AI incident may overlap, but the tests are distinct.
A Useful Shared Risk Register
| Field | Why it is useful |
|---|---|
| System, data and process | Connects the risk to a real activity |
| Affected people and services | Makes the possible harm explicit |
| Applicable framework and provision | Shows which obligation is being assessed |
| Threat or failure scenario | Describes what could go wrong |
| Likelihood and impact | Records the assessment method and assumptions |
| Controls and evidence | Links mitigation to something that can be checked |
| Owner and residual risk | Assigns accountability for the decision |
| Review trigger and date | Keeps the record connected to changes |
Choose review frequency according to the risk and applicable requirements. A quarterly meeting or annual audit is an operational choice, not a universal statutory schedule for every register.
DPIA and FRIA Need Their Own Conclusions
A GDPR DPIA is required when the processing is likely to result in a high risk to people’s rights and freedoms, taking account of Article 35 and relevant supervisory guidance. The controller is responsible; advice from the data protection officer is required where one has been designated.
AI Act Article 27 applies a different fundamental-rights assessment to specified deployers and uses. Scope and exclusions matter. Reuse descriptions of the process, affected people and controls, but document how each assessment meets its own criteria. An extended DPIA template is not automatically a valid FRIA.
Build an Incident Process with Separate Branches
Record detection, assessment, decisions and communication in one timeline. Assign responsibility for deciding which legal reporting duties apply, including any GDPR, NIS2 or AI Act notification. Keep the correct authority, recipient and time limit attached to each branch. Do not assume the same report can be sent to one authority for every regime.
The NIS2 reporting guide explains the directive’s reporting sequence and why national implementation matters.
Choose Tools Around the Work
A controlled spreadsheet and document repository may be sufficient for a small, well-defined process. A dedicated governance platform can help with permissions, evidence collection and multiple owners at greater complexity. Headcount or an arbitrary number of AI systems alone does not decide the choice.
Test whether people can find the current record, identify an owner, attach evidence and show the history of a decision. Ensure the storage location and access controls are suitable for the information, including personal or confidential data.
A Practical Implementation Sequence
Inventory systems and existing evidence; assess scope with the relevant specialists; identify gaps; assign owners and deadlines; implement controls; test incident and review procedures; and revisit the results. Set the timeline from the actual obligations and work required rather than assuming every organisation can complete the programme in the same number of months.
From the Inventory to an Implementation Plan
Q-Journey includes AiP Express and Platinum, with Lean and Muda consulting in Platinum. The agreed project scope determines which processes and technical gaps are examined. A technical review does not itself certify legal compliance; legal classification and any required assessment need the appropriate accountable specialists.
Primary Sources
NIS2 Directive (EU) 2022/2555, especially Articles 20–23; GDPR; and the AI Act. Check the current national implementation, competent authority and any sector-specific rules for the organisation concerned.
GLOSSARY
Terms in this article
Clear explanations of the terms you may want to revisit.
Explore the glossary