Provider (Art. 16)
Vendor of AI system for critical infrastructure: CE marking + NIS2 vendor-side compliance.
AI Assurance — Critical Infrastructure
AI operating critical infrastructure: high-risk + NIS2
AI systems controlling or assisting critical infrastructure (energy, transport, water, telecom) are high-risk under Annex III §2 and essential entities under NIS2. Assurance is continuous and multi-framework.
What we see in this sector
Vendor risk of AI models entering critical supply chains without operational traceability.
NIS2 + EU AI Act + ISO 27001 on the same systems, lacking a unified dashboard.
Incident reports with different definitions per framework — risk of inconsistent communication to the regulator.
Typical use cases
- Load prediction and optimisation in the power grid
- Predictive maintenance in rail and airport operations
- Anomaly detection in telecom networks
- AI-assisted air traffic control
Applicable regulatory frameworks
Primary frameworks
Reglamento (UE) 2024/1689 — Reglamento de Inteligencia Artificial
Reg. (UE) 2024/1689 · Official source →
EU AI Act. Applies whenever the system operates in the EU.
NIS2 — Ciberseguridad de infraestructuras críticas
Directiva (UE) 2022/2555 · Official source →
Cybersecurity obligations for essential sectors and telco.
ISO/IEC 27001 — Sistema de Gestión de Seguridad de la Información
ISO/IEC 27001:2022 · Official source →
ISMS framework; relevant if the organisation is already certified.
Cross-cutting frameworks
ISO/IEC 42001:2023 — Sistema de Gestión de IA
ISO/IEC 42001:2023 · Official source →
Voluntary AI management framework, alignable with the EU AI Act.
GDPR Art. 22 — Decisiones automatizadas
Reg. (UE) 2016/679 Art. 22 · Official source →
Automated individual decisions with legal effects on people.
AI supply chain — your role determines your obligations
The EU AI Act distributes obligations by role (Arts. 16, 24, 26). In this sector each role contributes a different piece to assurance.
Integrator (Art. 24)
Integrator connecting AI with SCADA or OT: joint responsibility for conformity and operational resilience.
Deployer (Art. 26)
Infrastructure operator: continuous oversight, NIS2-aligned incident response plan and full traceability before the sectorial regulator.