Security, business and technology belong together. Those who think of them together lead their business into the future.

The term and its delimitation

The term “artificial intelligence” is used differently in everyday language, in law and in official statistics. Where the levels are mixed, misjudgements arise as to the extent of one’s own obligations.

In everyday language, “AI” usually denotes a text-based chat system such as ChatGPT. This usage is widespread, but has neither legal nor statistical significance.

In law, the definition in Article 3(1) of the AI Act applies. Under that provision, an AI system is a machine-based system that is operated with varying degrees of autonomy, that may be adaptive after deployment and that infers, from the input it receives, how to generate outputs — predictions, content, recommendations or decisions that can influence physical or virtual environments.

The decisive element of the definition is inference. A system that derives from inputs how it is to respond falls within the definition. A system that executes exclusively rules laid down in advance does not, as a rule.

Official statistics, in turn, measure technologies: text analysis, image recognition, speech recognition, language generation, machine learning. The survey unit is enterprises with ten or more employees. This classification is not a legal definition and was never intended as one.

What a set of rules can achieve and what it cannot

A set of usage rules does not change what an AI tool can do. It changes who uses it for what, which information goes into it, and who bears the consequences.

It makes visible what is happening anyway. The German data protection supervisory authorities describe the starting position unusually directly: without clear rules there is a risk that employees will use AI applications “on their own initiative and without control”, and it must be assumed that this is “currently the reality in many companies and public bodies”. Rules that name the tools provided by the company and open up reporting channels bring that use out of the invisible.

It moves decisions to where they belong. Without rules, each member of staff decides case by case whether a customer’s address may go into an external system. With rules, the company decides that — once, in advance, and the same way for everyone. The Austrian Economic Chamber puts the same thought in terms of tool selection: it is for company management alone to decide whether an application is permissible.

It can itself be a protective measure to which legal consequences attach. Under Union law, information is a trade secret only if, among other things, “it has been subject to reasonable steps under the circumstances, by the person lawfully in control of the information, to keep it secret”. Protection therefore depends on an act of the holder, not on the value of the information alone.

Written rules that are made known and enforced, governing what may be entered into external services, are in substance such a step. No court decision was found that expressly brings a set of AI usage rules under that point, or that treats their absence as causing the loss of trade secret protection. The connection therefore remains a question each company must answer for itself, and not an established legal consequence (Section 13).

Three laws, one mechanism

The questionnaire does not arrive because your customer distrusts you, and not because a law obliges you to anything. It arrives because your customer has to demonstrate something they cannot demonstrate without you: that they know the security risks emanating from their suppliers, and that they manage them. This section shows the mechanism using the NIS 2 Directive, because it is formulated most clearly there. The two other legal acts — DORA for financial customers, the Cyber Resilience Act for manufacturer customers — follow the same pattern and are dealt with in Sections 3 and 4.

Directive (EU) 2022/2555 addresses the Member States and, through them, "essential and important entities". These are companies and organisations from certain sectors above a certain size, plus some kinds of entities regardless of their size. Which ones is the subject of Section 2. For this section one sentence suffices: as a rule, your customer is such an entity, and you are not.

The central provision is Article 21. Its first paragraph reads:

"Member States shall ensure that essential and important entities take appropriate and proportionate technical, operational and organisational measures to manage the risks posed to the security of network and information systems which those entities use for their operations or for the provision of their services, and to prevent or minimise the impact of incidents on recipients of their services and on other services."

The addressee of every sentence is the entity. Nowhere in Article 21 is there a sentence that obliges a supplier of that entity. What you receive is the effect of someone else's obligation — and that is the first sentence you should keep in mind for every conversation with your customer: the requirement has an addressee, and it is not you.

Why basic protection comes before AI

Anyone who looks into the use of artificial intelligence in a business quickly runs into an order that is not negotiable: first the foundation of the information technology, then the risks that new tools bring with them. Volume 1 of this series said so in one sentence and set it out in five points. This handbook is the execution of those five points at the depth a business without an IT department needs in order to implement them itself — or to check whether its contractor has implemented them.

Volume 1 states in Section 12, "Information security", that "the sequence is dictated by the subject matter: first the basic foundation of information technology, then the AI-specific risks. Not as a substitute." Before any AI-specific measure, five points are to be put in order, which are "unspectacular" and cover "the predominant part of the incidents which actually occur":

Data backup, held separately from the network, with restoration successfully tested at least once. — Up-to-date software on all devices — operating systems, browsers, servers, including rarely used devices. — Accounts: accounts tied to individuals, two-factor login, immediate blocking upon departure. — Responsibility: a person designated by name as responsible, even where external support is called in. — Emergency arrangement: established contact points for the event of an outage.

These five points are the structure of Parts II and III of this handbook: access (Sections 4 and 5), backups (6), current software and devices (7), responsibility (9), emergency (10 and 11). To these is added a point that Volume 1 lists among the AI-specific risks but which affects every business whether it uses AI or not: e-mail and fraud (8).