OpenChainGraph Suite · wave 26 · compliance_mandate

NIS2 Entity Scope & Obligations

Classify an entity as Essential or Important under NIS2 Directive 2022/2555 Annex I and II using sector codes, size thresholds, and automatic carve-outs (art-141) → check all ten Article 21(2)(a)–(j) cybersecurity risk-management measures for presence and maturity with a 0–100 compliance score and grade A–F (art-142) → calculate maximum penalty exposure under Article 34 with mitigating-factor adjustment — board-ready PDF with execution_hash (art-143). Active October 2024; first enforcement wave 2026.

OpenChainGraph · 3 Steps compliance mandate NIS2 Directive 2022/2555 Annex I / II · Art. 21 · Art. 34 W3C VC §13.11 Hash-Anchored §4 chain_depth:3 · Zero PII
Chain Topology — NIS2 Entity Scope & Obligations (art-141→142→143)
art-141 NIS2 Entity Scope Classifier art-142 Art. 21 Gap Checker art-143 Penalty Exposure Calculator ⊣
§4 Execution Hash · Chain Definition Anchor
execution_hash:computing…
Chain Stages · 3 Steps
1ROOT · D0node
Entity classification and applicable penalty caps feed the Art. 21 gap checker
MCP Call · classify_nis2_entity
{
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "name": "classify_nis2_entity",
    "arguments": {
      "sector_code": "energy",
      "employee_count": 500,
      "annual_turnover_eur": 80000000,
      "is_dns_provider": false,
      "is_qualified_trust_service_provider": false,
      "is_public_electronic_comms_network": false
    }
  },
  "id": 1
}
2MIDDLE · D1node
Art. 21 compliance score and critical gaps feed the penalty exposure calculator
MCP Call · check_nis2_art21_measures
{
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "name": "check_nis2_art21_measures",
    "arguments": {
      "measures": [
        { "measure_id": "a", "implemented": true, "documented": true, "last_tested_date": "2025-12-01" },
        { "measure_id": "b", "implemented": true, "documented": true, "last_tested_date": "2025-12-01" },
        { "measure_id": "c", "implemented": false, "documented": true, "last_tested_date": "" },
        { "measure_id": "d", "implemented": false, "documented": false, "last_tested_date": "" },
        { "measure_id": "e", "implemented": true, "documented": true, "last_tested_date": "2025-11-15" },
        { "measure_id": "f", "implemented": false, "documented": true, "last_tested_date": "" },
        { "measure_id": "g", "implemented": true, "documented": true, "last_tested_date": "2025-10-01" },
        { "measure_id": "h", "implemented": false, "documented": false, "last_tested_date": "" },
        { "measure_id": "i", "implemented": true, "documented": true, "last_tested_date": "2025-12-01" },
        { "measure_id": "j", "implemented": true, "documented": true, "last_tested_date": "2025-09-01" }
      ]
    }
  },
  "id": 2
}
3TERMINAL · D2node
Maximum penalty exposure and mitigated estimate — board-ready export with execution_hash — final stage
MCP Call · calculate_nis2_penalty_exposure
{
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "name": "calculate_nis2_penalty_exposure",
    "arguments": {
      "entity_classification": "essential",
      "global_annual_turnover_eur": 80000000,
      "infringement_types": ["art21_measures_absent"],
      "mitigating_factors": ["first_offence"]
    }
  },
  "id": 3
}
Export Artifacts
Download the §4 chain definition artifact or the §13.11 W3C VC view. Each of art-141, art-142, and art-143 individually support Policy Mandate JSON and W3C VC export. art-142 and art-143 additionally export PDF reports.