Key takeaways
- AI in compliance management handles three kinds of work: drafting (policies, questionnaires, documentation), mapping evidence to requirements, and monitoring controls continuously. Approvals, risk acceptance, and the scope stay with people.
- ISO 27001 assigns the key decisions to people by name: top management establishes the information security policy under clause 5.2, and under clause 6.1.3 the risk owners approve the risk treatment plan and accept the residual risks.
- Under Article 20 of the NIS2 Directive, management bodies must approve the cybersecurity risk-management measures, oversee their implementation, and can be held liable for infringements. No tool can take that duty over.
- A policy is not evidence. An audit tests whether the documented process actually happens, using logs, tickets, spot checks, and interviews with employees.
- AI shortens the preparation, not the audit. The audit-time table in ISO/IEC 27006 sets 10 audit days for an initial certification with 46 to 65 people in scope, however much of the groundwork was automated.
AI in compliance management mostly changes who writes the first draft. A consultant or IT lead used to spend weeks building policies, the risk register, and the Statement of Applicability from scratch; today an AI assistant produces a draft tailored to your company in a fraction of that time. What has not changed: ISO 27001, NIS2, and the GDPR require named people to review, approve, and answer for those drafts.
This article draws the line along the text of the standards rather than along vendor promises. We cover which compliance processes you can automate overall, what a platform costs, and how to measure success in our guide to compliance automation.
What AI handles in compliance management today
AI handles the compliance tasks where it can derive a result from existing information and a person can then check it. In practice, that comes down to three kinds of work.
Drafting. An AI assistant takes your company size, industry, systems, and scope and produces policies, procedures, and answers to customer security questionnaires. For ISO 27001, that runs from the top-level information security policy down to the mobile device policy.
Mapping evidence. One piece of evidence, such as an access list from your identity provider, often satisfies requirements in several frameworks at once. AI spots the overlaps between the 93 controls in ISO 27001 Annex A, the ten measures in Article 21(2) of the NIS2 Directive, and the technical and organizational measures under Article 32 GDPR, and links the evidence to every requirement it meets.
Monitoring controls. Instead of sampling once a year, a platform checks the state of your systems continuously and flags deviations: an account without multi-factor authentication, a failed backup, a new hire who has not finished security training.
Kertos customers mostly describe this part as a gain in structure:
"Kertos helps us carry out the ISO 27001 certification in an organized and structured way. It defines clear tasks and offers AI-supported suggestions tailored to our company structure."
Martin S., Agentic AI Engineer, Small Business (50 or fewer employees), G2, translated from German
A common misconception: AI replaces the consultant. What AI replaces is the blank page. It can suggest whether a policy fits your business model, whether a control applies to you, and which risk you might accept, but it cannot decide any of them.
Where accountability stays with people: what ISO 27001, NIS2, and the GDPR require
All three frameworks assign the decisions that carry weight to specific roles: top management, risk owners, management bodies, or the controller. An AI system cannot hold any of those roles. The overview below shows the split for the tasks companies most often hand to AI.
| Task | What AI can do | What people decide | Reference |
|---|---|---|---|
| Information security policy and topic-specific policies | Draft from the company profile and scope | Content review and approval by management | ISO 27001 clause 5.2 and Annex A 5.1 |
| Risk assessment | Suggest threats, vulnerabilities, and ratings | Risk acceptance criteria, ratings, approval of the treatment plan, and acceptance of residual risks | ISO 27001 clauses 6.1.2 and 6.1.3 |
| Statement of Applicability (SoA) | Prefill the 93 Annex A controls with suggested justifications | Which controls are excluded and why | ISO 27001 clause 6.1.3 d |
| Monitoring and evidence | Continuous checks of system states, mapping of evidence | Assessment of deviations and corrective action | ISO 27001 clauses 9.1 and 10.2 |
| Internal audit and management review | Prepare checklists, metrics, and documents | Performed by independent auditors, reviewed by top management | ISO 27001 clauses 9.2 and 9.3 |
| NIS2 risk-management measures | Gap analysis against the ten measures, documentation | Approval and oversight by the management body | NIS2 Directive Articles 20 and 21 |
| Data protection impact assessment (DPIA) | Draft the description, risks, and measures | Decision by the controller after seeking the DPO's advice | Article 35(2) GDPR |
ISO 27001: management approves, risk owners accept
ISO 27001 leaves no room here. Top management establishes the information security policy (clause 5.2), Annex A 5.1 requires management to approve policies, and top management also carries out the management review under clause 9.3. Until that approval, an AI draft is only a draft. Our guide to ISO 27001 certification walks through the full process, from gap analysis to surveillance audit.
NIS2: the management body approves and oversees
Article 20(1) of the NIS2 Directive requires the management bodies of essential and important entities to approve the cybersecurity risk-management measures under Article 21, oversee their implementation, and answer for infringements. Article 20(2) adds mandatory training for members of those bodies. In Germany, the rewritten BSI Act has applied since December 6, 2025, and Section 38 BSIG requires management to implement the measures and oversee their implementation. Many managing directors assume that buying a tool discharges this duty. The tool provides the groundwork; the duty stays with them.
We explain how to split the roles between IT, quality management, and executive management in our article on NIS2 responsibility.
GDPR: the controller decides
Under Article 24 GDPR, the controller is responsible for making sure processing complies with the regulation, and Article 5(2) requires the controller to be able to demonstrate it. For a data protection impact assessment, Article 35(2) requires the controller to seek the advice of the data protection officer. AI can prepare the description of the processing and the risk analysis; a person weighs them. Our GDPR guide covers the full set of obligations.
Why an AI-generated policy is not yet evidence
An AI-generated policy can be complete on paper and still fail the audit, because the auditor does not check whether a document exists but whether the process it describes takes place. Miriam Mindt, Information Security Expert at Kertos, prepares companies for ISO 27001 audits and names exactly this as the most common misconception:
"I think a general misconception for many customers or many auditees is that it's enough to have a policy in place instead of evidence that you are actually living the process that you're documenting in your policy."
Auditors draw on five types of evidence: documentary (policies, records, contracts), confirmative (a vendor or supplier attesting to something), technical (logs and system output), analytical or verbal (interviews with employees), and physical (on-site checks). AI helps with the first three. Your employees sit the interviews themselves, and they need to know the process the policy describes.
A typical scenario: a 60-person software company has an AI assistant draft its ISO 27001 policies and quickly has a full set of drafts. In the Statement of Applicability, the AI suggests excluding some physical controls because the team works remotely. Whether that exclusion holds depends on how the company handles laptops, home offices, and its provider's office, and someone who knows the company has to write that justification. For the audit itself, the ISO/IEC 27006 audit-time table sets 10 audit days for an initial certification with 46 to 65 people in scope, and in practice the certification body may adjust that by up to 30 percent. Automation shortened the preparation, not the audit.
The mistake most teams make here: they generate the policies, file them, and train nobody on them. An AI draft is most valuable as the starting point for a conversation with the teams who will have to live the process.
Risk assessment and incidents: where AI suggests and people decide
In risk assessment, AI makes suggestions and the risk owner makes the call. ISO 27001 clause 6.1.2 requires the company to set risk acceptance criteria, and clause 6.1.3 requires risk owners to approve the treatment plan and accept the residual risks. AI can suggest typical threats to a cloud infrastructure and prefill ratings for likelihood and impact. Whether a company carries a residual risk is a business decision.
A second misconception: using AI lets you pass part of the accountability to the vendor. Legally, a tool changes nothing about the duties of the management body under Article 20 NIS2 or of the controller under Article 24 GDPR. The contract governs what the vendor commits to; the statutory duty stays with the company. We look at how AI changes risk assessment methodology itself in our article on how AI is transforming risk management practices.
Incidents make the line even clearer. Article 23 of the NIS2 Directive requires an early warning within 24 hours of becoming aware of a significant incident, an incident notification within 72 hours, and a final report within one month of that notification. Under Article 33 GDPR, a personal data breach goes to the supervisory authority within 72 hours. AI can prepare the notification, preserve timestamps, and track deadlines. A person who understands the incident decides whether it is significant and the clock is running.
What changed in 2026, and what it means for AI in compliance management
Four things have shifted since late 2025: NIS2 now applies in Germany, the EU AI Act has pushed back its high-risk deadlines, the Cyber Resilience Act has switched on its first reporting duties, and the GDPR's substance has not changed. The overview reflects the position in October 2026.
| Framework | Status in October 2026 | What it means for AI in compliance management |
|---|---|---|
| NIS2 | Most member states have transposed it; the Commission referred Ireland, Spain, France, and the Netherlands to the CJEU on July 8, 2026. In Germany, the rewritten BSI Act has applied since December 6, 2025, with no transition period, and the authorities' grace period for late registration ended July 31, 2026. | More companies have to evidence the ten measures in Article 21. AI speeds up the gap analysis; the duty under Article 20 stays with the management body. |
| EU AI Act | Prohibitions since February 2, 2025, obligations for general-purpose AI models since August 2, 2025, Article 50 transparency obligations since August 2, 2026. High-risk obligations pushed back to December 2, 2027 (Annex III) and August 2, 2028 (Annex I). | Companies that use AI have to classify their systems. Annex III does not list compliance tools as a category of their own; classification depends on the use case. |
| Cyber Resilience Act | Reporting obligations for manufacturers of products with digital elements have applied since September 11, 2026, through ENISA's Single Reporting Platform. The remaining obligations apply from December 11, 2027. | One more reporting clock next to NIS2 and the GDPR, starting with an early warning within 24 hours. AI can track the deadlines; people make the call. |
| GDPR | Procedural Regulation (EU) 2025/2518 in force since January 1, 2026, applicable from April 2027. The Digital Omnibus amendments to the GDPR are a proposal at first reading; neither Parliament nor the Council has adopted a position. | The substantive obligations are unchanged, including Article 24 and Article 35(2). |
| ISO 27001 and ISO 42001 | The transition period for ISO 27001:2013 ended October 31, 2025; valid certificates are based on the 2022 edition with 93 Annex A controls. ISO/IEC 42001:2023 is the certifiable standard for AI management systems. | Companies that use AI for compliance can govern that use under ISO 42001 and have it certified. |
A third misconception that has stuck around in 2026: the Digital Omnibus has already relaxed the GDPR. What passed in July 2026 was only the AI Act omnibus, Regulation (EU) 2026/1744, which moves the high-risk deadlines. The GDPR part is still going through the legislative process.
We explain which AI systems fall into which risk class, and who enforces the rules, in our guide to the EU AI Act.
AI and certified experts at Kertos
Kertos combines a compliance platform with KAIA, its AI assistant, and certified experts, and is itself ISO 42001 certified. The platform collects evidence from your existing systems, monitors controls continuously, and maps ISO 27001, the GDPR, NIS2, SOC 2, TISAX, and C5 onto a shared evidence base. KAIA drafts policies tailored to your company structure and suggests the next tasks. You then manage those policies in the platform's policy management.
How much work stays with your team depends on the package. In Essential, your team works with the platform and KAIA; in Pro, KAIA supports you as a virtual CISO; and in Premium, an appointed external CISO works alongside the company. In every package, management stays accountable under NIS2. Asked what they like best about Kertos, one customer on G2 named the support, not the AI:
"The Personal support when going through the certification process"
Verified User in Computer Software, Small Business (50 or fewer employees), G2
In practice, this cuts manual compliance effort by around 80 percent, and the audit pass rate is 100 percent. AskUI reached ISO 27001 certification this way in 8 to 10 weeks without external consultants. To see how the split between AI, experts, and your team would look for your scope, book a demo.
Frequently asked questions
What compliance tasks can AI take over?
AI in compliance management can draft policies and documentation, prefill security questionnaires, map evidence to the requirements of several frameworks, and monitor controls continuously. It cannot take over approvals, scoping, acceptance of residual risks, or the audit verdict. ISO 27001, NIS2, and the GDPR assign those decisions to specific people.
Can AI replace a compliance consultant?
AI replaces the part of consulting that consists of writing first drafts and collecting evidence. Judging whether a policy fits the company, whether a control may be excluded, and how an auditor will read a justification still takes experience. That is why most approaches combine a platform with certified experts.
Can you use AI to write ISO 27001 policies?
Yes. The standard does not prescribe how a policy is written. Clause 5.2 requires top management to establish the information security policy, and Annex A 5.1 requires policies to be approved by management, published, and communicated. An AI draft is fine as long as someone reviews it, approves it, and the company actually puts it into practice.
Who is liable if an AI compliance tool makes a mistake?
The statutory duties stay with the company: under Article 20 NIS2, the management body approves and oversees the risk-management measures, and under Article 24 GDPR, the controller is responsible for compliance. The contract governs what the vendor takes on for errors in its tool. For a specific liability question, get legal advice.
Do people need to review AI output in compliance?
Yes, wherever a framework requires an approval or an assessment. In ISO 27001, that includes the policy under clause 5.2, the risk treatment plan under clause 6.1.3, and the management review under clause 9.3. Reviewing pays off even where no approval is required, because the auditor will ask in interviews whether your employees know the documented process.
Legal status: October 20, 2026
