NIS2-compliant AI for critical infrastructure.
Supply chain cybersecurity with the model in Intel TDX. Attestation of the serving instances for your incident file. A French contracting party.
Who NIS2 covers
Essential and important entities.
The transposition deadline (17 October 2024) is passed. Most Member States have published national implementing legislation through 2025 and are enforcing in 2026. NIS2 broadens scope dramatically compared to NIS1: now most mid-market companies in critical sectors are in scope, plus their cybersecurity supply chain, which includes AI inference vendors.
Essential entities
- Energy (electricity, gas, oil, hydrogen)
- Transport (air, rail, water, road)
- Banking and financial market infrastructures
- Health (hospitals, manufacturers of medical devices)
- Drinking water and wastewater
- Digital infrastructure (DNS, TLD, cloud, data centres)
- ICT service management (B2B)
- Public administration
- Space
Important entities
- Postal and courier services
- Waste management
- Chemicals manufacturing and distribution
- Food production, processing, distribution
- Manufacturing (medical devices, electronics, machinery, motor vehicles)
- Digital providers (online marketplaces, search engines, social platforms)
- Research organisations
Article 21, supply chain security
AI inference is part of your cybersecurity supply chain.
Article 21(2)(d) requires essential and important entities to manage supply chain security including security-related aspects of relationships with direct suppliers and service providers, which include AI/ML services that support critical workflows. The entity must assess vendor cybersecurity practices, contractually require security measures, and verify them on an ongoing basis. Attestation of the machine that runs the model is one piece of verifiable evidence for that assessment.
Verifiable confidentiality
Inside the TDX enclave the model's memory is encrypted, so a breach of the inference host does not expose prompts in plaintext. Our relay still handles them in clear while forwarding them.
Verifiable integrity
an Intel TD Quote on request. Tampering with model version, enclave or compute environment shows up as a quote mismatch.
Public TCB and signed measurements
Intel TDX has a public TCB recovery process and signed measurements you can check in the attestation.
French contracting party
VOLTAGE EI is based in France, so a European CSIRT reaches the contracting party directly. Our inference provider and hosting are US companies, listed at /legal/subprocessors.
Article 23, incident reporting
24h, 72h, one month, evidence ready in minutes.
NIS2 incident reporting timelines are tight: 24h early warning, 72h notification, one month final report. When the incident touches an AI workflow, your responders need to know which prompt ran, on which model, and on which machine. The first two come from your own logs; the third comes from the attestation of the serving instances, which you fetch from GET /v1/attestation on your own nonce and keep with your logs.
24h early warning
Your own request logs, for a first classification.
72h notification
Attestation of the serving instances fetched during the incident window, severity assessment, indication of cross-border impact and IoCs.
1 month final report
Root cause analysis with the measurements in the attestation, and the mitigations applied.
NIS2 FAQ
Questions critical infrastructure teams ask.
Who is in scope of NIS2?
Essential entities (energy, transport, banking, financial market infrastructures, health, drinking water, wastewater, digital infrastructure, ICT service management, public administration, space) and important entities (postal, waste management, chemicals, food production, manufacturing, digital providers, research). Member States had to transpose by 17 October 2024 and many enforcement timelines are now active in 2026.
Is an AI vendor part of my supply chain under Article 21?
Yes, when the AI service supports a workflow that touches the cybersecurity posture of an essential or important entity. You must assess vendor cybersecurity practices, contractually require measures, and verify them on an ongoing basis.
How does VoltageGPU support NIS2 incident reporting?
The timeline of each AI invocation comes from your own logs, and there is no attestation per request. What we add is the attestation of the serving instances, fetched on your own nonce during the incident window, to show which machine served the model. VOLTAGE EI, the contracting party, is in France; our inference provider and hosting are US companies.
What about management body accountability under Article 20?
NIS2 makes management bodies personally responsible for cybersecurity risk-management measures. We provide attestation evidence and contractual provisions that map directly to Article 21 measures, so your CISO and management body can demonstrate due diligence to the national authority.
What about the Cyber Resilience Act?
The CRA covers products with digital elements. AI services delivered as a service are not in CRA scope, but customers integrating AI into a CRA-regulated product can use the attestation of the model's host as one piece of evidence of cybersecurity by design.
Related compliance pages
Article 12, 14, 15 and 32 obligations enforceable from 2 August 2026.
Article 28 native DPA, Article 32 confidentiality.
ICT third-party risk for banks, insurers and investment firms.
Sample attestation log JSON, retention and API access.
Vertical agents for legal, finance, regulated professionals.
Verify any request against the public attestation root.
Intel TDX trust domains with the GPU attached inside, as raw compute.
Full agent line-up across legal, finance, healthcare and operations.
Add an NIS2-aligned AI vendor to your supply chain.
Model in Intel TDX. Attestation on request. A French contracting party.