Library
White paperMichael Clark
Two Clocks, One Incident
An essential-service operator running AI in its operational estate answers to NIS2 and Article 73 of the AI Act, which differ in trigger, clock, recipient and duty-holder, and an AI malfunction with no attacker can fall within both while setting off neither process. A utility running a third party's system is usually a deployer with an information duty, and the facts both duties need often sit with the vendor. The remedy is one incident record with two assessment gates, a detection route for model degradation, supplier terms and a tabletop exercise.
Key findings
- NIS2 and Article 73 of the AI Act differ in trigger, clock, recipient and duty-holder, and many incident runbooks carry only NIS2.
- An AI malfunction with no attacker can fall within both regimes and set off neither process.
- A utility running a third party's high-risk system is usually a deployer that informs the provider first, and Article 73 applies to it directly only if it cannot reach the provider.
In the paper
- The NIS2 clock
- The AI Act clock
- The failure mode
- Energy thresholds come from national law
- The facts sit with the vendor
- One record, two gates
- Where to start
Michael Clark
Chief Executive Officer, Standard Intelligence
Your next step