On 2 August 2026 the bulk of the EU AI Act becomes applicable. NIS2 has been working its way into Spanish and national law across the EU for months. DORA is already mandatory for anyone who touches the financial sector. Three different rules, one shared message for your board: cybersecurity and AI governance have stopped being a technical matter you delegate to a corner of the org chart and forget.
The trouble is that most mid-market companies receive that message without the structure to process it. They know something is coming, they hear the acronyms at every conference and webinar, but they have no CIO with weight in the leadership committee to translate a regulatory obligation into an economic decision. That is where the rule stops being a legal problem and becomes a governance one.
Regulation stopped being a distant warning
For years, the compliance conversation in the mid-market was a vague promise about a future that never arrived. That grace period is over. The convergence analysts flag for 2026, with automated cybersecurity and architectural modernization advancing in parallel with regulation, is not a background trend. It is the calendar already sitting on your desk.
What changes the game is who answers for the acronyms. NIS2 makes the management body accountable for approving and overseeing cybersecurity risk-management measures, and it provides for personal liability where that oversight is absent. The AI Act obliges anyone deploying AI systems to demonstrate controls, traceability and human oversight. Neither one leaves room for the old alibi of "IT handles that."
For a CEO or CFO without a robust IT department, the operational question is simple and unpleasant: if an inspector walks in tomorrow, or a large client asks for evidence of compliance before renewing the contract, do you have anything to show beyond an antivirus and good intentions?
What NIS2 actually requires (and why it reaches you even if you're not "essential")
NIS2 is Directive (EU) 2022/2555, the European rule that replaces the original NIS and dramatically widens the perimeter of who is covered. It leaves behind the logic of protecting only a handful of critical infrastructures and now reaches medium and large companies across a long list of sectors deemed essential or important, from energy, transport and healthcare to manufacturing, food, waste management and digital service providers.
The mid-market's first mistake is to read that list, not see itself in it, and file the matter away. It is an expensive mistake for two reasons. The first is the supply-chain effect: NIS2 requires covered entities to demand security from their suppliers, so if you sell to a company in scope, the obligation flows down to you through the contract even if the law never names you. The second is that the threshold is lower than people assume, because crossing fifty employees or ten million in turnover inside a covered sector is enough to be fully caught.
And what exactly does it require when it applies? Three blocks worth keeping clear at board level:
Risk management with board approval. Risk analysis, supply-chain security, encryption, access control, business continuity and vulnerability management. The management body must approve those measures and be trained to oversee them.
Incident reporting on tight deadlines. An early warning within 24 hours and a fuller notification within 72 hours to the national response team. Whoever has not rehearsed the process discovers those deadlines at the worst possible moment.
Penalties that stop being symbolic. For essential entities, up to 10 million euros or 2% of annual worldwide turnover, whichever is higher. For important ones, up to 7 million or 1.4%. Management accountability turns compliance into something a CFO can no longer treat as a minor technical line item.
On top of this sits DORA for anyone operating in the financial ecosystem, with its demand for operational resilience and control over technology providers, and the AI Act for anyone deploying artificial intelligence. Different doors, the same corridor: the demand to prove real risk management, beyond merely declaring it.
Zero Trust in plain English: stop trusting by default
This is where boards tend to switch off, because the jargon arrives. Let's strip it out. Zero Trust is an architecture principle that boils down to "never trust by default, always verify." The traditional model assumed everything inside the corporate network was trustworthy and focused on hardening the perimeter. With hybrid work, the cloud and accounts compromised by phishing, that perimeter ceased to exist.
The Zero Trust approach starts from an uncomfortable but realistic assumption: the attacker may already be inside. As a result, every access is verified continuously, every user and device gets only the minimum permissions it needs, and the network is segmented so that an incident in one corner does not spread across the whole company.
For an executive, the point is that Zero Trust is a posture that steers investment, rather than a product you buy in a box. It shows up in concrete decisions: robust identity with multi-factor authentication as the first priority, network segmentation, and continuous verification instead of one password that opens every door. Starting with identity is usually the investment with the best ratio of cost to risk reduction, because most breaches enter through a stolen credential.
AI TRiSM: governing AI without slowing it down
While the board digests cybersecurity, its teams are already using AI. Copilots, writing assistants, analysis tools. Governing that adoption has its own name in the analysts' vocabulary: AI TRiSM, short for AI Trust, Risk and Security Management. It is the set of policies, controls and processes that let you use artificial intelligence with guarantees without losing control over what it does.
The framework covers what pilot-project euphoria tends to ignore: model explainability, monitoring behavior over time, protecting the data going in and out, and defending against AI-specific attacks such as prompt injection or the leakage of sensitive information through a prompt. In practice, it is the governance layer that makes the AI Act tractable, because it translates its requirements into operational controls.
Does your board know what corporate data is flowing right now into the AI tools your teams use? In many mid-market companies the honest answer is no, and that opacity is exactly the risk the AI Act is designed to close. AI adoption multiplies your exposure surface, and its real risks rarely live in the model: they live in the data, the vendors and the operation, as we set out in AI's invisible dependencies.
Paper compliance protects no one
Here is the heart of our position, and it deserves to be said plainly. The biggest danger for a smaller company is not breaking the rule out of ignorance, but complying in name only. There is an entire market of templates, shop-window certificates and PDF policies that leave the file immaculate and the company just as exposed as on day one.
A security policy document does not stop a phishing email. A well-formatted risk register does not keep an untrained employee from clicking the wrong link on a Tuesday afternoon. Real compliance is fought on two layers that have to move together: the technical one, with controls that work and get tested, and the human one, with training, a security culture and a rehearsed incident response. Neglecting the second is why companies with perfect documentation still end up in the headlines.
"Passing the audit on paper and being genuinely protected are two different things. The first saves you from the fine; only the second saves you from the breach."
That is why we keep insisting that cybersecurity is not optional and admits no shortcut through the paperwork. A sound strategic framework, one that connects the regulatory obligation to measures that genuinely reduce risk, is the best guarantee in front of both the inspector and the attacker. It is also the only version of compliance a CFO can defend as an investment rather than a sunk cost.
How a board prioritizes: six investment decisions
The good news is that a board does not need to understand cryptography to govern this well. It needs to ask the right questions and order the spending with a risk-and-return lens. These are the six decisions that separate investing well from buying smoke.
1. Treat cybersecurity as a board decision, not an IT one. NIS2 already imposes this by making the management body accountable, so the smart move is to get ahead of it. Give security a fixed slot on the committee agenda, with a named owner and a budget that does not depend on what is left over at year-end.
2. Start with the exposure map, not the product catalogue. Before buying anything, you need to know which data, processes and suppliers concentrate the business's real risk. Investing without that map is spending budget blind and confusing activity with protection.
3. Apply Zero Trust in layers, starting with identity. Multi-factor authentication and access management are the investment with the best immediate return, because they close the door most attacks come through. Segmentation and continuous verification come later, in digestible phases.
4. Put governance around AI before scaling the pilots. An AI TRiSM-style framework, with clear policies on which data can be used and which tools are approved, keeps adoption from turning into a silent data leak. Governing AI means having visibility and control over what happens. Banning, by contrast, only pushes usage into the shadows.
5. Invest in the human layer with the same rigor as the technical one. Continuous training, phishing drills and a culture where reporting a mistake is not punished. Technology stops part of the attacks, but the human link decides the rest, and that link can be trained.
6. Document and rehearse incident response. The 24 and 72-hour deadlines under NIS2 cannot be improvised. Having a written plan, with assigned roles and at least an annual rehearsal, is the difference between managing a crisis and suffering it while the notification clock runs.
The next ninety days
None of this demands a monumental project or a new department. It demands order and judgment. In a single quarter, a mid-market company can build its exposure map, close identity with multi-factor authentication, define a basic AI-usage policy and put its incident-response plan in writing. It falls short of the final destination, but it is the foundation everything else rests on, and it places the board on the right side of both the law and the risk.
Regulation will keep tightening, and intelligent, automated cybersecurity will be the norm rather than the exception. The competitive edge will belong to whoever turns a regulatory burden into an economically sensible investment decision before their peers, because having everything perfect is a goal that does not exist. That is where an independent advisory, one that sits at the strategy table and does not sell boxes, earns its place: helping a board without a strong CIO prioritize through a risk-and-return lens. If you want to see how we approach it, start with our advisory programs.
