Artificial intelligence is rapidly entering healthcare and research institutions — from medical image analysis to genomic data processing. For companies and institutions already working on NIS2/ISO 27001 compliance, the message is clear: AI systems in healthcare and research fall within the same regulatory framework as the rest of the IT infrastructure.
For directors of hospitals, health centres and clinics, this question is not abstract — it directly concerns the institution’s day-to-day work: electronic patient records, scheduling systems, networked diagnostic equipment and, increasingly, AI tools that help interpret findings or triage patients.
Healthcare Is Already an “Essential” Sector — and Was Before AI
The new Law on Information Security, adopted on 22 October 2025 to align with the EU NIS2 Directive, extends its scope to sectors that were not previously covered — and healthcare is among them. The law itself has been adopted, but key implementing regulations (which will specify criteria for operators, mandatory protective measures and the incident classification procedure) have not yet been issued, so detailed application of the law in practice is not yet fully defined.
This is not just a European trend on paper. Analyses show that NIS2 treats a hospital as an “essential” entity, which means that all incidents and controls relating to AI systems automatically fall within the scope of the law — regardless of whether the institution sees its AI tool as an “IT system” or a “research tool”.
Where AI Specifically Fits into NIS2 Requirements
According to analyses of the alignment between the NIS2 Directive and the EU AI Act, sectors such as healthcare that introduce AI/ML tools can expect concrete requirements:
- Cataloguing of AI/ML systems and risk documentation (similar to the SBOM approach for software)
- Special treatment in reporting incidents involving attacks on the models themselves (e.g. data poisoning, adversarial manipulation)
- Formal third-party risk assessment of suppliers of AI tools and models
A particularly sensitive point is the integrity of the data used for training or for queries to an AI system. Manipulation of clinical or research data that “feeds” an AI agent can lead to wrong recommendations without any visible trace in traditional log files — which NIS2 treats as a regulatory, not merely technical, problem.
The Supply Chain: Your AI Tool Supplier Is Also Your Responsibility
One of the major innovations of the NIS2 framework is that an institution must assess the security of its suppliers — not just its own systems. A concrete example: a hospital using external software to analyse radiology images must formally assess that supplier’s security practices and build this into the contract. The same principle applies to AI tools — if an institution uses an external LLM service or a third-party model to analyse medical or research data, that relationship becomes part of the compliance scope, not an exception to it.
A Practical Approach for Research Institutions
For institutions just starting to introduce AI tools into work with sensitive data, a practical sequence of steps follows naturally from the existing ISO 27001 approach:
- Inventory of AI systems and the data they process
- Risk assessment — including the risk of model misuse, not just data leakage
- Access control by user authorisation level
- Usage logging and regular audits
Only after these steps does it make sense to consider formal certification or alignment with specific sector standards.
Conclusion
NIS2 is being introduced in Serbia as a horizontal framework for ICT systems “of special importance”, and healthcare is among the priority sectors. Introducing AI tools into healthcare and research institutions does not create a new, parallel regulatory problem — it enters the existing risk management framework, only with additional, specific risks (data poisoning, model misuse) that need to be recognised in good time, before an inspection recognises them or, worse, an incident does.
What This Means for Your Healthcare Institution
Whether you run a hospital, health centre, private clinic or medical laboratory, the questions to ask yourself are concrete:
- Do we know which AI/ML tools are already being used in our institution, and who introduced them?
- Can our suppliers of medical software and equipment demonstrate their security practices?
- Who is responsible for reporting an incident if patient data is leaked or manipulated?
- Does the institution’s management understand that NIS2 carries personal liability for management, not just for the IT department?
If you do not know the answer to at least one of these questions, it is time for an initial gap analysis — before it becomes an obligation under pressure from an inspection or, worse, after an incident.
Sources: Kinstellar – “NIS2 and the New Serbian Law on Information Security” (July 2026); Zunic Law – “Novi Zakon o informacionoj bezbednosti 2026”; PC Press – “Novi Zakon o informacionoj bezbednosti i usklađivanje sa NIS 2 direktivom”; ISMS.online – “Will NIS 2 Regulate AI and Machine Learning?” (October 2025); TrueScreen – “NIS2 and AI Data Integrity” (March 2026); Plan Be Eco – “NIS2 for Healthcare – Guide 2026” (April 2026).