Two EU texts now shape cyber hiring. NIS 2 sets how organisations manage cyber risk and report incidents; the AI Act sets how AI must stay robust and secure. Here is what both say, in plain language, and the skills a master’s should give you.
Why do two EU laws change what cyber employers look for?
NIS 2 and the AI Act add a new question to cyber hiring: can this person help the organisation prove to a regulator that risks are analysed, incidents handled on time and AI systems protected against attack?
ENISA, the EU cybersecurity agency, wrote in June 2025 that national transpositions of NIS 2 will affect tens of thousands of entities, many facing new legal requirements and staffing needs for the first time. It cites its NIS Investments 2024 report, where 89% of surveyed organisations said they will need additional cybersecurity staff to comply.
What is NIS 2, in plain language?
NIS 2 is Directive (EU) 2022/2555 of 14 December 2022, in force since 16 January 2023 according to ENISA. EU countries had until 17 October 2024 to write it into national law, and it replaced the first NIS directive from 18 October 2024 (European Commission). As a directive, it binds companies through national law, not directly (ENISA).
Who is covered
What they must do
Who answers for it
Which ten security measures does NIS 2 require, and who does the work?
Article 21(2) lists the minimum measures, on an “all-hazards” basis. ENISA’s June 2025 guidance maps each one to role profiles of the European Cybersecurity Skills Framework (ECSF), the EU reference for cyber roles.
| Article 21(2) | In practice | ECSF roles ENISA links to it |
|---|---|---|
| (a) Risk analysis and information system security policies | Analyse risks, then write the security policy that answers them | CISO, Cybersecurity Auditor |
| (b) Incident handling | Detect, contain and investigate attacks; keep an incident response plan | Cyber Incident Responder, CISO |
| (c) Business continuity, backups, disaster recovery, crisis management | Keep services running and restore them after an incident | CISO |
| (d) Supply chain security | Assess and manage the security of suppliers and service providers | CISO, Cybersecurity Risk Manager |
| (e) Security in acquisition, development and maintenance, incl. vulnerability handling | Secure design and configuration; handle and disclose vulnerabilities | Cybersecurity Architect, Cybersecurity Implementer, Cyber Incident Responder |
| (f) Assessing the effectiveness of the measures | Audits, risk assessment reports, remediation plans | Cybersecurity Auditor, Cybersecurity Risk Manager |
| (g) Basic cyber hygiene and cybersecurity training | Awareness programmes for staff and management | Cybersecurity Educator |
| (h) Cryptography and, where appropriate, encryption | An encryption policy that is actually applied | CISO |
| (i) HR security, access control, asset management | Role-based access, asset inventories, joiner and leaver rules | CISO |
| (j) Multi-factor authentication, secured communications | MFA and secured voice, video, text and emergency channels | Cybersecurity Architect |
The other ECSF profiles appear too: the Penetration Tester checks that measures work, the Cyber Threat Intelligence Specialist and Digital Forensics Investigator feed incident reports, and the Cyber Legal, Policy and Compliance Officer oversees compliance as a whole.
The reporting clock of Article 23
- 1Within 24 hours: early warningSay whether the significant incident looks malicious or could have a cross-border impact.
- 2Within 72 hours: incident notificationAn initial assessment of severity and impact and, where available, the indicators of compromise.
- 3Within one month: final reportA detailed description, the likely root cause, the mitigation measures and any cross-border impact. An intermediate report can be requested in between.
Technical and writing skills meet here. In ENISA’s worked example of a medium-sized organisation, incident response is outsourced to a specialist provider, yet the CISO keeps the reporting duty because it cannot be delegated.
Where does France stand on NIS 2?
As of 28 October 2026, ANSSI’s NIS 2 page states that transposition in France is still in progress. The bill on the resilience of critical infrastructure and the strengthening of cybersecurity was debated by the Senate in March 2025, and the Senate’s legislative record then shows a text adopted by a National Assembly committee, with no final vote. ANSSI expects “several thousand” entities in 18 sectors, mostly medium and large companies, local authorities and administrations.
ANSSI invites entities to start now: take its online scope test, pre-register and work through the Référentiel Cyber France (ReCyF), beginning with asset inventory, governance and a security policy, supplier mapping, access control, patching, backups and incident handling.
What does the AI Act ask of cybersecurity teams?
The AI Act is Regulation (EU) 2024/1689, in force since 1 August 2024. As a regulation, it applies directly. It sorts AI by risk: unacceptable practices are banned, high-risk systems face obligations such as risk management, data quality, logging, documentation and human oversight, some systems carry transparency duties, and minimal-risk AI has no specific rules (European Commission).
| Date | What applies |
|---|---|
| 2 February 2025 | Banned practices and the AI literacy article |
| 2 August 2025 | Governance and obligations for general-purpose AI models |
| 2 August 2026 | General application, including transparency rules |
| 2 December 2026 | Prohibitions added by the Omnibus, such as AI nudification systems |
| 2 December 2027 | High-risk rules for Annex III uses (biometrics, education, employment and other sensitive areas) |
| 2 August 2028 | High-risk rules for AI embedded in regulated products (Annex I) |
The Digital Omnibus on AI, in force since 27 July 2026, moved the high-risk dates later but did not remove them: a 2027 master’s student graduates as they arrive.
Article 15: the cybersecurity article of the AI Act
High-risk AI systems must reach an appropriate level of accuracy, robustness and cybersecurity throughout their lifecycle, and resist attempts by unauthorised third parties to change their use, outputs or performance by exploiting vulnerabilities. Where appropriate, the measures must prevent, detect, respond to, resolve and control five kinds of AI-specific attack:
AI literacy and penalties
Article 4, as amended by the Omnibus, asks providers and deployers to take measures to support the AI literacy of their staff. Under Article 99, fines reach €35 million or 7% of worldwide turnover for banned practices and €15 million or 3% for breaches of other listed obligations, whichever is higher.
Where do NIS 2 and the AI Act meet?
An organisation that runs an essential service and uses AI in it can fall under both texts. The overlap is where the most sought-after profiles sit.
| Skill area | NIS 2 hook | AI Act hook | Typical ECSF role |
|---|---|---|---|
| Risk analysis | Art. 21(2)(a) and (f) | Risk management for high-risk AI | Cybersecurity Risk Manager |
| Detection and incident response | Art. 21(2)(b) and Art. 23 deadlines | Art. 15(5): detect and respond to attacks | Cyber Incident Responder |
| Secure architecture | Art. 21(2)(e) and (j) | Art. 15(1) and (5): security by design | Cybersecurity Architect |
| Cryptography | Art. 21(2)(h) | Art. 15(5): confidentiality attacks | Cybersecurity Architect or Implementer |
| Threat intelligence | Indicators of compromise in the 72-hour notification | Poisoning and evasion techniques | Cyber Threat Intelligence Specialist |
| Governance and training | Art. 20 management training, Art. 21(2)(g) | Art. 4 AI literacy | Cyber Legal, Policy and Compliance Officer; Cybersecurity Educator |
What should you look for in a master’s?
Use the two texts as a checklist when you read a syllabus, and ask what you will actually produce.
- 1A named risk-analysis method, used on a full caseRun a risk analysis and turn it into a policy, as Article 21(2)(a) asks.
- 2Hands-on detection and incident responseLog analysis, SIEM rules, playbooks and drafting a 24-hour early warning.
- 3Applied cryptographyKey management, PKI and TLS in practice.
- 4Secure architecture and identitySegmentation, zero trust, identity and access management, multi-factor authentication.
- 5Security of AI systemsAdversarial ML, poisoning, LLM security and prompt injection.
- 6Law and governance you can explain to a boardNIS 2, the AI Act and GDPR, and presenting risk to non-specialists.
- 7Proof an employer can checkJury-defended projects, an internship and a stated qualification level, such as RNCP level 7.
How does AI2’s cybersecurity MSc cover these skills?
AI2, the Applied Institute of Artificial Intelligence, teaches 100% in English (B2 required, no French needed) at the Hub Nikola Tesla in Écouen, 22 minutes from Paris Gare du Nord by Transilien line H. Its MSc Applied AI & Cybersecurity is the cybersecurity specialisation of its MSc Applied AI: a shared Applied AI year, then a cyber year, then a six-month internship.
| What the texts require | Where it sits in the AI2 MSc |
|---|---|
| Risk analysis (NIS 2, Art. 21) | Block “Cyber-risk analysis”: EBIOS Risk Manager, MITRE ATT&CK for ICS, NIS2, GDPR and IEC 62443 compliance |
| Secure design, access, MFA | Block “Secure architecture”: zero trust, IT/OT segmentation and the Purdue model, IAM, PKI, TLS 1.3 and mTLS |
| Incident handling and reporting | SOC, SIEM & Incident Response: log analysis, SIEM rules, playbooks, forensics basics, business continuity; cyber range exercises |
| Cryptography | Applied Cryptography: symmetric and asymmetric cryptography, key management, embedded encryption |
| AI security (AI Act, Art. 15) | Security of AI Systems: adversarial ML, LLM security, prompt injection, model and data poisoning, AI governance; block “AI for detection” |
| Threat intelligence | Threat Intelligence: threat actors, OSINT, indicators of compromise, reporting |
| Law and governance | Year 1: Industrial IS Architecture (49 h, including ANSSI and NIS, GDPR) and AI Law & Ethics (21 h, including EU AI Act risk classes and data governance) |
The programme totals 1,000 hours before the internship; each competency block and a final professional project are defended before a jury. Career directions named on the programme page: AI security engineer, detection and SOC analyst, IS and OT security architect, NIS2 compliance consultant. In 2025, five AI2 students took part in the CND Hackathon for the French Ministry of the Armed Forces, and a cryptography hackathon with the Defence Digital Commission is planned for November 2026.
The MSc final year awards the AI2 diploma and prepares the professional title RNCP39978 « Architecte des systèmes d’information dans les processus industriels », recognised by the French State at level 7 (master’s level, EQF 7) and certified by DATAKOO, AI2’s parent company. See RNCP level 7 qualification explained. For the six-month placement, read internships in France for international students; work-study may be possible from Year 2 with an employer contract (AI2 work-study programme).
Formats, fees and dates
| Format | For whom | Tuition 2027 |
|---|---|---|
| 2-year MSc | Three-year bachelor’s, ideally in computing or networks | Year 1: €12,500, from €10,500 after scholarship. Year 2: €13,000 |
| 18-month direct entry into Year 2 | Related four- or five-year degree; Python and ML checked at interview | €13,000, from €11,300 after scholarship |
Intakes: February, May and September 2027; for February, the priority deadline is 30 November 2026. The 11-month Fast-Track is offered on the Data Science MSc only. Visa resources to show: €877.50 a month (Service-Public). Details on AI2 tuition fees 2027 and the AI2 visa guidance page.
📘 Related guide: Industrial IoT and Industry 4.0: the skills employers need.
Frequently asked questions
What is the difference between NIS 2 and the AI Act?
NIS 2 (Directive 2022/2555) sets cybersecurity duties for organisations in 18 sectors: risk management, incident reporting, management accountability. The AI Act (Regulation 2024/1689) regulates AI systems by risk level, including cybersecurity for high-risk AI. NIS 2 goes through national law; the AI Act applies directly.
Does NIS 2 already apply in France?
Not yet in full. As of 28 October 2026, ANSSI states that transposition is in progress; the bill on resilience and cybersecurity has passed the Senate and awaits the National Assembly. ANSSI invites entities to prepare now.
What are the NIS 2 incident reporting deadlines?
For a significant incident: an early warning within 24 hours of becoming aware of it, an incident notification with an initial assessment within 72 hours, and a final report no later than one month after the notification.
Which cybersecurity skills does the AI Act call for?
Article 15 requires high-risk AI to resist attacks that exploit its vulnerabilities, naming data poisoning, model poisoning, adversarial examples or model evasion, confidentiality attacks and model flaws.
Which cyber roles does ENISA link to NIS 2?
All 12 ECSF role profiles: CISO, Cyber Incident Responder, Cyber Legal, Policy and Compliance Officer, Cyber Threat Intelligence Specialist, Cybersecurity Architect, Auditor, Educator, Implementer, Researcher and Risk Manager, Digital Forensics Investigator and Penetration Tester, each mapped to NIS 2 tasks in ENISA’s June 2025 guidance.
Do I need a law degree to work in NIS 2 compliance?
NIS 2 sets no degree requirement. ENISA treats the Cyber Legal, Policy and Compliance Officer as a cyber role, and its worked example shows a legal officer upskilled into it. A technical master’s covering NIS 2, GDPR and the AI Act gives you both sides.
Does AI2’s cybersecurity MSc cover NIS 2 and the AI Act?
Yes. The MSc Applied AI & Cybersecurity includes NIS2 and GDPR compliance in its cyber-risk analysis block, EU AI Act risk classes in AI Law & Ethics, and a Security of AI Systems module on adversarial ML, LLM security and poisoning. Year 1 is €12,500, from €10,500 after scholarship.
Sources consulted on 28 October 2026: ENISA: Cybersecurity roles and skills for NIS2 essential and important entities (June 2025), reproducing NIS 2 Articles 21 and 23 · ENISA: European Cybersecurity Skills Framework · ENISA: NIS Directive 2 · European Commission: NIS2 Directive (updated 2 July 2026) · European Commission: NIS2 Directive FAQs · ANSSI, MesServicesCyber: directive NIS 2 · Sénat: legislative record of the resilience and cybersecurity bill · European Commission: AI Act (updated 19 October 2026) · AI Act Service Desk: Article 4 · AI Act Service Desk: Article 15 · AI Act Service Desk: Article 99 · AI Act Service Desk: Article 113 · Service-Public: student visa (verified 1 August 2026) · AI2: MSc Applied AI & Cybersecurity · AI2: tuition fees 2027
Apply online for the February, May or September 2027 intake. AI2’s admissions team reviews your transcripts, holds an online interview and confirms your entry year, tuition and any scholarship in your admission letter.
