NIS2 Directive Design Status

1. Essential Entity Status

Under the NIS2 Directive (Directive (EU) 2022/2555), supercomputing facilities providing critical AI capabilities to governments, grid operators, and healthcare providers may be classified as "Essential Entities." AGICY is designing to embrace this classification and implement the directive's security and reporting mandates from Day 1 of operations — design status for a pre-construction programme, not a present-tense certification.

1.1 Scope of Classification

When operational, AGICY may fall under NIS2 Annex I, Sector 8 ("Digital Infrastructure") as a provider of cloud computing services, data centre services, and trust services. This would trigger the highest tier of obligations, including:

• Mandatory risk management measures (Article 21).
• Incident reporting to the competent authority within 24 hours (Article 23).
• Supply chain security obligations (Article 21(2)(d)).
• Board-level accountability for cybersecurity governance (Article 20).

2. Cyber Incident Reporting

AGICY plans a direct line to the Cypriot National CSIRT (Computer Security Incident Response Team). Our AGIOS operating system is designed for automated threat intelligence sharing. In the event of a sophisticated attack, early-warning data is intended to propagate to EU cybersecurity authorities.

2.1 Reporting Timeline

• Within 24 hours: Early warning notification to the Cypriot CSIRT, including initial assessment of whether the incident was caused by unlawful or malicious action.
• Within 72 hours: Incident notification with severity assessment, impact scope, and initial countermeasures.
• Within 1 month: Final report including root cause analysis, cross-border impact, and measures applied.

3. Supply Chain Security

NIS2 mandates strict control over the supply chain. AGICY's design target is that no critical infrastructure components (silicon, networking gear, cooling controllers) contain unauthorized firmware. All hardware is planned to be audited up to the transistor level by independent European security firms prior to installation.

3.1 Hardware Provenance

• Silicon: Tenstorrent Blackhole chips manufactured at Samsung Foundry (South Korea) and TSMC (Taiwan). Full Bill of Materials (BOM) audited by independent EU security laboratory.
• Networking: 800 GbE Ethernet mesh using SwarmX protocol — no proprietary NVLink dependency. All firmware open for inspection.
• Firmware: RISC-V open-source ISA — auditable down to the instruction set. No black-box proprietary microcode.

4. Risk Management Framework (Article 21)

AGICY plans the following technical and organisational measures as required by Article 21:

• Policies on risk analysis and information system security.
• Incident handling procedures with automated triage and escalation.
• Business continuity and crisis management — including diesel backup, N+1 cooling, and geo-redundant control plane.
• Supply chain security — including vendor vetting, firmware attestation, and hardware integrity monitoring.
• Security in network and information systems acquisition, development, and maintenance.
• Policies and procedures to assess the effectiveness of cybersecurity risk management measures.
• Basic cyber hygiene practices and cybersecurity training for all staff.
• Policies and procedures regarding the use of cryptography and encryption.
• Human resources security, access control policies, and asset management.
• Multi-factor authentication (MFA) and secured voice, video, and text communications.

5. Board-Level Accountability (Article 20)

AGICY's planned Board of Directors would be directly responsible for approving and overseeing the implementation of cybersecurity risk management measures. Board members would undergo mandatory cybersecurity training annually. The CISO would report directly to the Board, not through the CTO, ensuring independent oversight.

6. Cooperation with Authorities

AGICY plans cooperation protocols with:

• The Cypriot Digital Security Authority (DSA) — designated competent authority under NIS2.
• ENISA (EU Agency for Cybersecurity) — for cross-border coordination and threat intelligence sharing.
• Europol EC3 — for incidents with criminal nexus.
• CERT-EU — for incidents affecting EU institutional clients.