Does NIS2 or Germany's BSIG specifically regulate AI-generated code?

Neither the cited NIS2 provisions nor BSIG sections 28, 30, and 38 name AI coding tools or AI-generated code. They establish entity scope, cybersecurity risk-management measures, documentation, and management duties. Applying those categories to an AI-assisted development workflow is an editorial risk mapping, not quoted law.

Does the BSIG apply to our company?

This article cannot decide that. BSIG section 28 uses entity types, sectors, size thresholds, special inclusions, exclusions, and interactions with sector-specific regimes. Corporate structure and activities matter. Use the current law and obtain qualified legal advice for a scope determination.

What does BSIG section 38 say about management?

For particularly important and important entities, section 38 requires management to implement the section 30 risk-management measures and oversee implementation, and to attend regular training. It also addresses liability to the entity for culpably caused damage through the applicable corporate-law rules, with a statutory fallback. That text does not decide liability for a particular AI-code incident.

Does a verification report prove NIS2 or BSIG compliance?

No. It can record selected checks and observed results for one change. The organization still needs an appropriate, proportionate, effective risk-management system and documentation across the applicable scope. Authorities, auditors, counsel, and courts make their own determinations under the relevant process.

What is a bounded AI-coding implementation example?

Treat the assistant, model endpoint, repository context, generated change, dependencies, and review path as inputs to the organization's existing risk assessment. Define owners, allowed configurations, checks, exceptions, evidence, and review cadence. This is an implementation example under the law's general risk categories, not a statutory safe harbour.

Compliance

NIS2, Germany's BSIG, and AI Code

Last updated: 2026-07-173 min read

NIS2 and Germany’s BSIG do not name AI coding. For in-scope entities they establish cybersecurity risk-management and management duties. Treating an AI-assisted workflow as a development or supplier-risk input is an editorial mapping-not a legal scope, compliance, breach, or liability decision.

Contents

The current German legal baseline

Germany’s consolidated BSI Act took effect on 6 December 2025 and records amendments through 11 March 2026. Section 28 defines particularly important and important entities with sector, entity-type, threshold, inclusion, and exclusion rules. Those rules are more detailed than a generic employee or revenue shortcut. Legal status checked 17 July 2026; this page is orientation, not legal advice.

Section 30 requires in-scope entities to take suitable, proportionate, effective technical and organizational measures and document compliance with that duty. Its categories include supply-chain security and security in acquisition, development, and maintenance. AI coding is not named. Whether a particular workflow creates a material risk, which measure is suitable, and whether it is effective depend on the organization and facts.

Legal-source and applicability boundary

Scope: Directive (EU) 2022/2555 and the German BSIG consolidated as amended through 11 March 2026, focusing on sections 28, 30, and 38.
As of: 17 July 2026
Method: State the legal text's layer first, label AI-code connections as editorial examples, and separate organizational evidence from authority, auditor, counsel, or court determinations.
Primary sources: EU directive: NIS2 Articles 20 and 21 address management-body oversight and cybersecurity risk-management measures for essential and important entities.Directive (EU) 2022/2555 · 2026-07-17A directive is read with national implementation and applicable sector-specific Union law; this article does not determine scope.
German risk measures: BSIG § 30 requires suitable, proportionate, effective measures and documentation; its list includes supply-chain security and security in acquisition, development, and maintenance.BSIG § 30 · 2026-07-17The section does not name AI coding or prescribe the examples used on this page.
German management duty: BSIG § 38 requires management of in-scope entities to implement § 30 measures, oversee implementation, and attend regular training.BSIG § 38 · 2026-07-17The provision's liability text concerns culpably caused damage to the entity and applicable corporate-law rules; concrete outcomes require legal analysis.
Not determined: No determination that an organization is in scope
No compliance, breach, fine, causation, or liability conclusion
No claim that an AI tool or evidence workflow is required by the cited law
Limitations: Entity type, sector, size, group structure, exceptions, and sector-specific law can change the analysis
Regulatory guidance, administrative decisions, and case law may develop
Qualified counsel should assess the facts and current legal text

Primary law establishes general duties and decision makers; AI-coding examples in this article are editorial mappings, not legal conclusions.

Management duty is not an automatic AI-liability result

BSIG § 38 says management of particularly important and important entities must implement the § 30 measures, oversee their implementation, and attend regular training. Its liability paragraph concerns culpably caused damage to the entity through applicable corporate-law rules, with a statutory fallback. It does not say that an executive is automatically liable whenever AI-generated code contributes to damage, and this article does not predict that outcome.

Five layers, four questions

The existence of a policy or evidence artifact does not answer legal scope, adequacy, breach, causation, or liability.
	Legal scope	Organizational policy	Technical or organizational measure	Evidence artifact	Regulatory or liability outcome
AuthorityWho defines or decides this layer?	Legislature, current law, competent authority, and ultimately courtsDecision-layer mapping · 2026-07-17Plain-language orientation; current law and competent decision makers control.	The accountable organizationDecision-layer mapping · 2026-07-17Plain-language orientation; current law and competent decision makers control.	The organization, within applicable legal and risk requirementsDecision-layer mapping · 2026-07-17Plain-language orientation; current law and competent decision makers control.	The process records an observed fact; reviewers assess relevanceDecision-layer mapping · 2026-07-17Plain-language orientation; current law and competent decision makers control.	Authority, court, or agreed dispute processDecision-layer mapping · 2026-07-17Plain-language orientation; current law and competent decision makers control.
DecisionWhat is actually being decided?	Whether the entity and activity fall within the relevant regimeDecision-layer mapping · 2026-07-17The exact question varies with the facts and process.	Which tools, data, identities, checks, exceptions, and owners are approvedDecision-layer mapping · 2026-07-17The exact question varies with the facts and process.	How a selected risk is treated and effectiveness evaluatedDecision-layer mapping · 2026-07-17The exact question varies with the facts and process.	What happened in one configuration, change, test, approval, or exceptionDecision-layer mapping · 2026-07-17The exact question varies with the facts and process.	Breach, enforcement, damage, causation, fault, remedy, or liabilityDecision-layer mapping · 2026-07-17The exact question varies with the facts and process.
AI-code connectionHow AI coding enters the analysis	Tool and code use are facts in the organization, not a shortcut to scopeAI-coding exampleAI coding is not named in the cited provisions.	AI-specific rules can implement part of risk treatmentAI-coding exampleAI coding is not named in the cited provisions.	Review gates, access restrictions, supplier review, and testing are examplesAI-coding exampleAI coding is not named in the cited provisions.	A verification report can record task and selected check resultsAI-coding exampleAI coding is not named in the cited provisions.	AI-code facts may be evidence if relevantAI-coding exampleAI coding is not named in the cited provisions.
Residual limitWhat remains unresolved?	Sector, size, structure, exceptions, and facts require analysisLegal claim boundary · 2026-07-17Not legal advice or an outcome prediction.	A policy does not prove operation, effectiveness, or complianceLegal claim boundary · 2026-07-17Not legal advice or an outcome prediction.	Suitability, proportionality, effectiveness, and full coverage remain contextualLegal claim boundary · 2026-07-17Not legal advice or an outcome prediction.	It does not decide legal adequacy, causation, or organization-wide operationLegal claim boundary · 2026-07-17Not legal advice or an outcome prediction.	No blog or tool can pre-decide the outcomeLegal claim boundary · 2026-07-17Not legal advice or an outcome prediction.

The existence of a policy or evidence artifact does not answer legal scope, adequacy, breach, causation, or liability.

A bounded implementation example

Feed one AI-assisted development path into the existing risk process: record assistant and model endpoints, repository context and data classification, supplier and access decisions, required tests and review gates, exception authority, evidence retention, and effectiveness-review cadence. This can make oversight reviewable. It is not a statutory safe harbour and does not replace the broader measures that may apply.

Where Reality Graph fits

Reality Graph can record the written task, selected checks, changed files, observed outcomes, and operator decision for a governed run. That last item is a gate rather than a log line: the product is built so that a run stops in front of a named person instead of writing or committing on its own. That evidence may be relevant to an internal control owner, auditor, authority, counsel, or court, but each evaluates it within a different scope. Reality Graph does not determine entity status, prescribe the complete risk program, certify compliance, or decide who is liable. See also what an evidence report contains.

A bounded record can show

The task, approved rule, owner, and selected checks for one run
Observed results, changed files, exceptions, and operator decision
When and under which source revision the evidence was captured

It cannot decide

Whether the organization is a particularly important or important entity
Whether all suitable, proportionate, and effective measures exist and operate
Breach, causation, fault, fine, remedy, or management liability in a concrete matter

A governed development record can support oversight; it does not determine NIS2 or BSIG scope, compliance, breach, or liability.

FAQ

Does NIS2 or Germany's BSIG specifically regulate AI-generated code?: Neither the cited NIS2 provisions nor BSIG sections 28, 30, and 38 name AI coding tools or AI-generated code. They establish entity scope, cybersecurity risk-management measures, documentation, and management duties. Applying those categories to an AI-assisted development workflow is an editorial risk mapping, not quoted law.
Does the BSIG apply to our company?: This article cannot decide that. BSIG section 28 uses entity types, sectors, size thresholds, special inclusions, exclusions, and interactions with sector-specific regimes. Corporate structure and activities matter. Use the current law and obtain qualified legal advice for a scope determination.
What does BSIG section 38 say about management?: For particularly important and important entities, section 38 requires management to implement the section 30 risk-management measures and oversee implementation, and to attend regular training. It also addresses liability to the entity for culpably caused damage through the applicable corporate-law rules, with a statutory fallback. That text does not decide liability for a particular AI-code incident.
Does a verification report prove NIS2 or BSIG compliance?: No. It can record selected checks and observed results for one change. The organization still needs an appropriate, proportionate, effective risk-management system and documentation across the applicable scope. Authorities, auditors, counsel, and courts make their own determinations under the relevant process.
What is a bounded AI-coding implementation example?: Treat the assistant, model endpoint, repository context, generated change, dependencies, and review path as inputs to the organization's existing risk assessment. Define owners, allowed configurations, checks, exceptions, evidence, and review cadence. This is an implementation example under the law's general risk categories, not a statutory safe harbour.

Keep reading

ComplianceAI Coding in Regulated IndustriesDORA, IEC 62304/MDR, ISO 26262/ASPICE regulate process and evidence, not code authorship. What each sector demands when AI writes code - and the one base setup that fits all three.GovernanceAI Coding GovernanceThe controls, workflows, approvals, and evidence a team needs to adopt AI coding tools without losing engineering accountability - and where each building block has limits.All articlesThe whole collection - 58 cited, dated guides on verifying AI-generated code.

Sources

Want to see what your last agent run would have looked like?

Request access