An engineer at a drinking water company is tracing a fault in a pumping station at night. He copies a section of the controller configuration and a network drawing into a chat assistant in his browser and asks what could cause the behaviour he sees. The answer is useful. The configuration of a pumping station now sits with a provider under terms that nobody at the company has read.
In the Netherlands this has been a matter for the board since 15 August 2026. On that date the Cyberbeveiligingswet entered into force, the Dutch implementation of the second Network and Information Security Directive, Directive (European Union) 2022/2555, together with the Wet weerbaarheid kritieke entiteiten. More than 8,000 organisations fall under the first law. The Netherlands was late, since the deadline of the directive was 17 October 2024. Drinking water and transport are supervised by the Inspectie Leefomgeving en Transport, energy by the Rijksinspectie Digitale Infrastructuur. An entity classed as essential is supervised proactively, which means that compliance is checked without an incident as the occasion.
The law has four parts that matter here. The organisation registers. It carries a duty of care, which means a risk analysis followed by appropriate and proportionate measures, and under Article 21 of the directive those measures include the security of the supply chain and of systems that are acquired and developed. It reports significant incidents, with an early warning within 24 hours, a notification within 72 hours and a final report within a month. And the board approves the measures and oversees how they are carried out. Executive directors have to follow training and have two years from the entry into force to show the required knowledge. The directive requires member states to provide for maximum fines of at least 10 million euros or 2 percent of worldwide annual turnover for essential entities, and Article 20 says that management bodies can be held liable.
None of the duties listed above mentions artificial intelligence, and that is why the subject gets missed. The security officer's risk analysis lists the supplier of the control system and the telemetry provider. The assistant the engineers use came in as a browser tab, without a purchase order, and is on no supplier list.
The European Union Artificial Intelligence Act, Regulation (European Union) 2024/1689, adds a second layer with later dates. Annex III lists as high risk the systems intended to be used as safety components in the management and operation of critical digital infrastructure, of road traffic, or of the supply of water, gas, heating or electricity. Those requirements apply from 2 December 2027. The amending regulation of 8 July 2026 narrowed the term safety component. A system used solely for performance optimisation, service efficiency or convenience does not qualify, while a system whose failure would endanger health and safety does. As we read it, a demand forecast that helps to plan maintenance and a model that decides when to dose chlorine stand on opposite sides of that line, and the company has to know for each model which side it is on.
The usual response is a ban on external tools. It fails for a practical reason: the engineer at night has a real problem and the tool helps him. The other usual response comes from suppliers, who say that a model on the company's own premises solves everything. It solves one thing, which is where the data goes. Operational data that never leaves a separated network cannot leak through a provider. A model inside the fence still has to come from somewhere, under a licence, and be updated along a controlled route. Someone has to decide which documents it may read. Its advice on a controller setting is as unchecked as it was before.
So decide the route for each type of work, and expect the answers to differ. Controller configurations, network drawings and vulnerability reports stay on the company's own premises, on a system with no outward connection, or are given to no model at all. For customer correspondence and procurement documents a private deployment in a European region under contract may be enough. Text that is already public can go to a provider's online interface.
Then put the same governance over all of it and add it to the file the board approves. That file holds the inventory of models, including those that suppliers have built into equipment, and the company's role under the Act for each. It holds the supplier terms and the tests on the company's own cases that come before anyone relies on an answer. It names an engineer with authority over each use, and it describes the logs, the training, and an incident route that connects to the clock of 24 hours.
The AI Guys prepares this file with technical teams and builds the on premises route where the decision calls for one. Next month the chief technology officer should be able to hand the board four things: the inventory with each model set against the safety component test, the route table by type of data, the list of model suppliers added to the supply chain register, and a proposal for the directors' training that includes the systems the company in fact runs.