What NIS2 and the Cybersecurity Act mean for your AI tools
With the Cybersecurity Act, security requirements have tightened for many organisations. An AI tool becomes part of the same responsibility. Here are the questions to ask before you choose.
iSearch
Contents
On 15 January 2026 the Swedish Cybersecurity Act entered into force. It implements the EU NIS2 Directive in Swedish law and replaces the earlier NIS Act. The act covers organisations in a wide range of sectors, including energy, transport, health care, digital infrastructure, manufacturing and public administration. Those covered must register with their supervisory authority, take risk-based security measures, make sure management is trained and report significant incidents.
Who is covered depends on sector and size, and several regulations are being issued in stages. The Swedish Civil Defence Agency gathers information about the act and the timetable. This article is not legal advice. It describes what the act means when you choose an AI tool.
An AI tool is part of the chain
The act sets requirements for security across the whole supply chain, including services you buy in. An AI tool that reads your documents often handles a large share of the organisation’s collected knowledge. That makes it part of the information systems your security work has to cover.
So ask the supplier where the data is processed, which subcontractors are involved and how you will be told if something changes. The fewer parties that handle the data, the simpler both the risk analysis and the follow-up become. A solution that can run in your own environment keeps the chain short, because the data stays in systems you already control and monitor.
Access, logging and incidents
Three areas deserve particular attention. The first is access. Sign-in should use the accounts and two-factor authentication you already use, and permissions should follow the principle of least privilege. Changes that affect security should require approval from two people.
The second is logging. When something has happened, you need to see who did what and when. The log has to be trustworthy, which means it cannot be altered afterwards without that being visible. It should also be possible to connect it to the security monitoring you already have.
The third is incident handling. The act requires significant incidents to be reported within short time frames. You therefore need to know how the supplier detects and reports incidents, and who does what when it happens. If the tool runs in your own environment, it is covered by your existing routines for monitoring and incidents, and you depend less on an outside party getting in touch in time.
Management’s responsibility
The Cybersecurity Act places clear responsibility on management. Management is responsible for making sure security measures are taken and must receive training in cybersecurity. An AI tool should therefore be part of the same risk analysis and the same decisions as other systems, with a clear owner in the organisation.
It also makes procurement easier. When the requirements for access, logging and incidents are included from the start, it becomes clear which solutions fit, and which would need special measures.
How it works in iSearch
iSearch does not make an organisation compliant on its own. It is built to fit into security work of the kind the act describes. The whole chain can run in your own environment, with no public AI services. If we run it for you, you get a separate installation of your own.
Sign-in uses SSO and MFA, role-based access controls who sees what and the four-eyes principle applies to sensitive changes. The audit log is tamper-evident and can be connected to your security monitoring. Documents and content are encrypted both in transit and at rest.
Read more in the AI procurement checklist, about offline AI in your own environment and about security in iSearch, or book a walkthrough.
Want to see how it would work for you?
We’ll show you iSearch with your own documents.