Abstract:Cyber security capabilities must be designed to mitigate attacks and threats to key network and information systems and ensure continuity in service provision, contribute to the security and effective functioning of economies and societies, and the Network and Information Security 2 Directive (NIS2) seeks to strengthen the European Union (EU) approach to this. Advances in artificial intelligence (AI) have revolutionised industries including banking (FinTech), law (RegTech), insurance (InsureTech), charities (CharityTech) and health (HealthTech). The EU understands this and has therefore introduced the requirement for member states to embrace AI, as a cyber security tool used to protect against and prevent cyber security attacks/threats. The purpose of this paper is to review the NIS2 and the changes it makes to the European approach to cyber security including the use of AI, and the implications for businesses subject to the new rules. The subject is explored through an analysis of literature, EU law and policy documentation. This paper critically reviews a significant advent in European cyber security and technology law: the advances created by the NIS2 Directive, which are considered alongside other key legislation that came into force in January 2023. In addition, the UK’s contrasting evolving position is also critically reviewed. The paper concludes with several practical suggestions on the, if any, steps for businesses as at April 2023. The NIS2 makes some significant inroads to close security gaps that existed in the EU cyber security-related legislative framework; importantly, it creates a requirement for the use of AI in the EU’s cyber security defence armoury. Businesses need to undertake several steps in preparation for full implementation of the NIS2. This research is among the first to review key advances made in EU cyber security and technology law, and to contrast that with the UK position as at April 2023. It is also the first to discuss the likely powers of competent authorities, and the potential results of breaching other EU legislation such as the General Data Protection Regulation (GDPR).

Singapore’s Cybersecurity Act 2018: A New Generation Standard for Critical Information Infrastructure Protection

Legal regulation of the use of distributed ledger technologies in financial sector of Singapore

An Analysis of Network Information Management Mechanisms in Singapore

US-Singapore cooperation on tech and security: defense, cyber, and biotech

A Survey of Digital Privacy Rights Under CISA

Cyberspace security: How to develop a security strategy

The Opportunity to Regulate Cybersecurity in the EU (and the World): Recommendations for the Cybersecurity Resilience Act

Getting Critical: Making Sense of the EU Cybersecurity Framework for Cloud Providers

Cybersecurity Law and Regulation in China: Securing the Smart State

Virtual Government in Singapore

Good governance and COVID‐19: The digital bureaucracy to response the pandemic (Singapore as a model)

Protection Profile of Personal Information Security System: Designing a Secure Personal Information Security System

Cyber–Information Security Compliance and Violation Behaviour in Organisations: A Systematic Review

European cyber security law in 2023: A review of the advances in the Network and Information Security 2 Directive 2022/2555

Cybersecurity law of the People’s Republic of China as a key instrument for ensuring information security of the banking and finance system

Cybersecurity Law Exploration: Personal Data Protection in 2023

Towards Comprehensive Legislative Requirements for Cyber Physical Systems Testing in the European Union

Evolution, Implementation and Practice of Internet Self-regulation, Co-regulation and Public–Private Collaboration

Cybersecurity Information Sharing Governance Structures: An Ecosystem of Diversity, Trust, and Tradeoffs

The Future of Cybersecurity in Southeast Asia along the Maritime Silk Road

Penal Provisions in the Personal Data Protection Law: A Comparative Legal Study between Indonesia and Singapore