Automating Your NIS2 Compliance Checklist with n8n Before October 2026

October 17, 2026 is the date to remember if your company, or one of your clients, falls within the scope of the EU's NIS2 directive. In France, transposition happens through the Résilience law, expected to pass in September 2026, taking effect four months later. The scale of the change is substantial: the pool of regulated entities grows from roughly 300 under the old NIS directive to 15,000-18,000 companies directly in scope, on top of the cascade effect on their subcontractors. For many French SMEs and mid-sized companies, the question is no longer "am I affected?" but "where do I start, and how do I keep up without dedicating a full-time team to it?" That's exactly the kind of structured, timestamped, partially automatable tracking n8n is built for.

What NIS2 actually changes

The directive requires eleven categories of measures from regulated entities (Article 21): risk analysis and management, incident handling, business continuity, supply-chain security, security in the acquisition and maintenance of systems, assessing the effectiveness of measures, cyber hygiene and training, cryptography, human resources security and access control, multi-factor authentication, and secured communications. Since March 2026, France's cybersecurity agency ANSSI has published an operational framework, the ReCyF (Référentiel Cyber France), to help companies translate these obligations into concrete measures.

The often-underestimated point: even a company outside NIS2's direct scope (fewer than 50 employees, unlisted sector) can end up exposed through the cascade effect. Regulated entities must verify the security of their vendors, which translates very concretely into increasingly common security questionnaires in tenders and contracts. Documenting your security posture in a structured way becomes a commercial advantage, not just a regulatory burden.

Why automation is no longer optional

A systematic review of the academic literature on NIS2 by Jukka Ruohonen, A Systematic Literature Review on the NIS2 Directive (2024), finds that research on the directive's practical implementation still lags well behind the text itself, with little work on methods that are genuinely workable for smaller organizations. In plain terms: there are few ready-made recipes, and improvising a NIS2 file with shared spreadsheets is the surest way to lose the thread by the second quarter.

A study published in the Journal of Cybersecurity and Privacy (MDPI), Identifying and Modeling Barriers to Compliance with the NIS2 Directive: A DEMATEL Approach, models the most influential barriers to compliance and identifies financial and human constraints, along with perceived technical complexity, as the barriers that trigger the most cascading blockers. Manual tracking, scattered across emails and spreadsheets, makes precisely these two constraints worse: it burns scarce human time and makes the technical complexity even harder to follow. Structuring and automating part of the tracking doesn't eliminate the compliance workload, but it removes the avoidable friction.

Building the NIS2 self-assessment in n8n

The principle mirrors the guided questionnaire bot from the Compliance & Audit Pack (€149): a conversational agent walks through a protocol question by question rather than a static form that gets abandoned half-filled.

1. Adapt the protocol to the eleven measures of Article 21: the pack ships a simplified 8-question GDPR protocol as a starting point, entirely rewritten in its system message — you replace the questions with the eleven NIS2 domains, one to three closed questions per domain ("is multi-factor authentication enabled for all privileged accounts?").
2. Chat Trigger + Chain LLM node — the agent asks each question in turn, rephrases ambiguous answers, and only moves to the next once validated, exactly as described in our n8n Chat Trigger guide.
3. Supabase logging — every validated answer is written to an audit_responses table with the record, domain, answer, and server-side timestamp, following the Supabase audit logging workflow. It's this timestamped trail, not the simple "yes" someone declared, that forms the real starting point of an evidence file in the event of an inspection.
4. Automatic follow-ups — the incomplete-record follow-up workflow closes the loop: a weekly cron identifies domains still left blank and follows up with the person responsible, without a human having to track a spreadsheet in parallel.

Automating incident notification within 24 hours

NIS2 imposes a strict notification timeline for significant incidents: an early warning within 24 hours, a full notification within 72 hours, and a final report within one month. That 24-hour window is untenable if detection depends on someone reviewing logs the next morning.

An n8n Error Workflow wired into your critical workflows, combined with a secured webhook receiving alerts from your SIEM or cloud provider, can automatically trigger a Slack alert as soon as an incident crosses a defined severity threshold, then route the qualification decision to human validation with a Wait node — the model or workflow detects and alerts, the person responsible for security qualifies the incident and triggers the official notification to ANSSI. The goal isn't to replace this human decision, but to make sure it happens within 24 hours rather than 48, because the alert wasn't missed.

Securing the supply chain

If you're a regulated entity, you'll need to question your vendors about their own security posture. If you're a subcontractor to a regulated entity, you'll be the one receiving those questionnaires. Either way, the same automatic follow-up workflow applies: send the vendor questionnaire, automatically follow up on incomplete records after a few business days, and centralize responses in the same audit table. For companies that also need to technically prove some of their claims (MFA actually enabled, backups actually tested), our article on automating ISO 27001 / SOC 2 compliance evidence covers how to pair this declarative tracking with technical collection via API, using a Structured Output Parser to pre-qualify each piece of evidence without ever deciding ambiguous cases alone.

Generating the compliance report

Once the audit table is continuously fed, the pack's AI-generated summary report workflow produces a structured document: status by domain, identified non-conformities, prioritized action plan. That report, updated in a few clicks rather than rebuilt by hand every quarter, becomes the basis for discussion with an external CISO or consultant ahead of the October deadline.

Common pitfalls

• Waiting for the final version of the Résilience law before starting — the text may still shift on points of detail, but the eleven measure categories in Article 21 are fixed at the EU level and won't move. Starting the self-assessment now saves weeks.
• Confusing declarative answers with technical evidence — answering "yes, MFA is enabled" in the questionnaire doesn't replace an export of the actual configuration. Both layers need to coexist, as detailed in our article on ISO 27001 / SOC 2 evidence above.
• A poorly calibrated incident alert threshold — too low, and it drowns the security team in false positives, burying the real signal; too high, and a significant incident slips under the 24-hour radar. Tune it progressively based on real incidents from recent months.
• Neglecting subcontractors — your own organization's compliance isn't enough if your critical vendors have no record of their own security posture. The follow-up workflow needs to cover your supply chain, not just your internal teams.

Going further

The October 17, 2026 deadline still leaves a few months to build a NIS2 file without rushing. The Compliance & Audit Pack (€149) provides the conversational building block, the timestamped audit trail, and automatic follow-ups to get started; for companies also juggling GDPR, ISO 27001, or other frameworks in parallel, the FlowKit Complete Bundle (€269) bundles every FlowKit pack, including Inbox AI so you never miss a vendor alert or regulatory notification in the daily flood of email.