What "critical infrastructure" means under §2
Annex III §2 captures three sub-categories of safety-related AI:
- Critical digital infrastructure. Including DNS, top-level domain registries, internet exchange points — the assets named in NIS2 Annex I.
- Road traffic and the supply of water, gas, heating, and electricity. Grid-management AI, traffic-control AI, water-treatment process AI.
- Safety components in those services. The AI must perform a safety function — a non-safety AI used by the same operator is not §2 high-risk.
Provider obligations
- Article 9 risk management — explicitly addressing the consequences of failure on physical safety. The risk profile is materially higher than most other Annex III sectors.
- Article 15 accuracy, robustness, and cybersecurity — essential for operating environments that are themselves NIS2 entities.
- Article 13 instructions for use written for control-room operators, including the safe-stop and degraded-mode procedures.
- Conformity assessment under Annex VI for stand-alone systems; integrated assessment under existing sector law (Machinery Regulation, Railway Interoperability Directive, RED) when the AI is embedded.
Operator (deployer) obligations
- Article 26(1) intended-purpose use; Article 26(2) competent human oversight in the control room.
- Article 26(6) automatically generated logs for at least six months — and longer if NIS2 incident-investigation requirements apply.
- Article 73 serious-incident reporting to the AI Act market surveillance authority.
- NIS2 Article 23 incident reporting in parallel: early warning within 24 hours, incident notification within 72 hours, final report within one month.
- For designated critical entities under the CER Directive: Article 13 resilience-enhancing measures, Article 15 disruption reporting, Article 18 background checks for personnel with sensitive access.
Where AI Act, NIS2, and CER overlap
The three regimes do not conflict in substance, but the operator is subject to all three simultaneously. In practice:
- NIS2 Article 21(2) cybersecurity risk management directly governs the AI system's security: access control, supply-chain security, incident handling, business continuity. Compliance with NIS2 21(2) is not the same as Article 15 robustness — both apply.
- Incident reporting clocks differ: NIS2 has a 24h early warning, the AI Act has a 15-day window for serious incidents (Article 73). The 24h NIS2 clock controls when both apply.
- The CER Directive Article 11 risk assessment for critical entities should reference the AI Act conformity assessment as part of the operational continuity analysis.
Enforcement landscape
Sector regulators are likely to be the AI Act market surveillance authority — for example BNetzA (Germany) and CRE (France) for energy; ART and ANSF for rail in France; ACM in the Netherlands. NIS2 competent authorities (BSI, ANSSI, NCSC-NL) will coordinate. Cross-border critical infrastructure cases will involve the European AI Office and ENISA.