EU AI compliance, written for the people who have to evidence it

Editor's pick

Directive (EU) 2022/2555: Which Articles Bind an AI Vendor

Directive (EU) 2022/2555, known as NIS2, runs to 46 articles, and most of them are addressed to member states and supervisors rather than to companies. If you sell AI systems into European organisations, only about nine articles ever touch you. Two bind you directly when you are in scope yourself: Article 21 on risk-management measures and Article 23 on incident reporting. Five reach you through your customer's obligations, which is where most vendor work actually comes from. Two more decide whether you are in scope at all. This piece walks each one in plain language and names the artefact it turns into on your side.