{
  "object_type": "agent_pack",
  "schema_version": 1,
  "id": "agent-pack:eu:nis2",
  "act": "nis2",
  "count": 3,
  "pack_hash": "3dfd79b75079220b1a18ee811bc0d0f50826a4642458c58e9d77591fd50c48aa",
  "usage": "Use each card directly in an answer: applies, risk, do, deadline, authority, source. Follow next_questions for the user's likely follow-up. Missing facts are not_in_register. Not legal advice.",
  "cards": [
    {
      "id": "card:eu:article:nis2--art-20",
      "applies": [
        "management-body: Approve the risk-management measures and follow training."
      ],
      "risk": "medium",
      "do": [
        "Approve the risk-management measures and follow training."
      ],
      "deadline": "not_in_register",
      "authority": [
        "National competent authority"
      ],
      "source": "https://eur-lex.europa.eu/eli/dir/2022/2555/oj",
      "core_hash": "69ec414689c8015b8cf8c99a1a5cd3f27534e45b8b53f56cc982491c47aa4817",
      "next": [
        "obligation:eu:nis2-art-20-management-body",
        "sanction:eu:nis2-art-32-5",
        "authority:eu:national-competent-authority",
        "action_kit:eu:nis2--art-20",
        "card:eu:article:amlr--art-11"
      ],
      "next_questions": [
        {
          "q": "What does Article 11 AMLR require?",
          "card": "card:eu:article:amlr--art-11"
        },
        {
          "q": "What does Article 9 AMLR require?",
          "card": "card:eu:article:amlr--art-9"
        },
        {
          "q": "What does Article 11 DORA require?",
          "card": "card:eu:article:dora--art-11"
        },
        {
          "q": "What does Article 5 DORA require?",
          "card": "card:eu:article:dora--art-5"
        },
        {
          "q": "What does Article 6 DORA require?",
          "card": "card:eu:article:dora--art-6"
        }
      ],
      "attribution": "Source: NovaCopilot"
    },
    {
      "id": "card:eu:article:nis2--art-21",
      "applies": [
        "essential-entity: Take appropriate cybersecurity risk-management measures."
      ],
      "risk": "high",
      "do": [
        "Take appropriate cybersecurity risk-management measures."
      ],
      "deadline": "not_in_register",
      "authority": [
        "National competent authority"
      ],
      "source": "https://eur-lex.europa.eu/eli/dir/2022/2555/oj",
      "core_hash": "dd7f77423327c611ca69b6eb33e7d661a059985950db6d1614ecd84e4403bef4",
      "next": [
        "obligation:eu:nis2-art-21-essential-entity",
        "sanction:eu:nis2-art-34-4",
        "sanction:eu:nis2-art-34-5",
        "authority:eu:national-competent-authority",
        "action_kit:eu:nis2--art-21"
      ],
      "next_questions": [
        {
          "q": "What does Article 13 AI-ACT require?",
          "card": "card:eu:article:ai-act--art-13"
        },
        {
          "q": "What does Article 4 AI-ACT require?",
          "card": "card:eu:article:ai-act--art-4"
        },
        {
          "q": "What does Article 50 AI-ACT require?",
          "card": "card:eu:article:ai-act--art-50"
        },
        {
          "q": "What does Article 24 GDPR require?",
          "card": "card:eu:article:gdpr--art-24"
        },
        {
          "q": "What does Article 25 GDPR require?",
          "card": "card:eu:article:gdpr--art-25"
        }
      ],
      "attribution": "Source: NovaCopilot"
    },
    {
      "id": "card:eu:article:nis2--art-23",
      "applies": [
        "essential-entity: Report significant incidents within the set deadlines."
      ],
      "risk": "high",
      "do": [
        "Report significant incidents within the set deadlines."
      ],
      "deadline": "24 h early warning, 72 h incident notification, final report within one month.",
      "authority": [
        "National competent authority"
      ],
      "source": "https://eur-lex.europa.eu/eli/dir/2022/2555/oj",
      "core_hash": "893ac669eb8b2f3312830cd3958dae50a28a64b8877e732d4a28346eb526fc4e",
      "next": [
        "obligation:eu:nis2-art-23-essential-entity",
        "sanction:eu:nis2-art-34-4",
        "sanction:eu:nis2-art-34-5",
        "authority:eu:national-competent-authority",
        "action_kit:eu:nis2--art-23"
      ],
      "next_questions": [
        {
          "q": "What does Article 73 AI-ACT require?",
          "card": "card:eu:article:ai-act--art-73"
        },
        {
          "q": "What does Article 69 AMLR require?",
          "card": "card:eu:article:amlr--art-69"
        },
        {
          "q": "What does Article 19 DORA require?",
          "card": "card:eu:article:dora--art-19"
        },
        {
          "q": "What does Article 33 GDPR require?",
          "card": "card:eu:article:gdpr--art-33"
        },
        {
          "q": "What does Article 20 NIS2 require?",
          "card": "card:eu:article:nis2--art-20"
        }
      ],
      "attribution": "Source: NovaCopilot"
    }
  ],
  "index": "/api/public/v1/agent-pack",
  "concept": "/api/public/v1/agent",
  "attribution": "Source: NovaCopilot",
  "access_class": "decision",
  "access_view": "public"
}