In critical infrastructure, intent isn’t just a quality lever. It’s a safety one.
An AI agent with good intent architecture is a force multiplier for good judgment. An agent with shallow intent is a force multiplier for whatever you gave it. If what you gave it was vague, it will produce precise execution of a vague idea, at scale, confidently.
Europe raised those stakes. NIS2 is in force, and thousands of industrial companies across energy, manufacturing, water, and transport are legally required to implement security measures they’ve deferred for years. There aren’t enough specialists to do that work by hand, which means much of it will be done with AI. It’s part of why I built NIS2.chat: the directive is dense, and the people implementing it are operators and engineers, not compliance lawyers.
This is how it went from an idea to two working products, NIS2.chat and the NIS2INTEL tracker, as the commit history tells it.
Interface first
I started with the interface. The first version of NIS2.chat was a chat window, a home page and a login, built in React and TypeScript with coding agents. Tests were set up before the first component, and each page got a written implementation plan before an agent touched it. The API behind it was a mock, and so was the login.
A knowledge base I could defend
The answers were the hard part. A compliance tool that sounds confident and cites nothing is shallow intent with a legal deadline attached. So the next piece was a knowledge base: the directive and the regulations around it, CER, CRA and DORA, converted from PDF into markdown, with a manifest that defines what an agent is allowed to read.
On top of it I built a first agentic RAG runtime, with conversation state, policy guards, cost limits, and answers that put the evidence first. Next to every answer, the interface showed which sources it had used. I tested it against a benchmark set for Spain and Latvia, and nothing counted as done until it passed the QA gate.
From audit checklist to roadmap
The biggest change wasn’t technical. The first version talked about compliance and audits. But each EU member state transposes NIS2 differently, so I reframed NIS2.chat around jurisdiction-specific guidance and made a prioritized regulatory roadmap its main output. You start by picking your country, and the list only offers the jurisdictions the knowledge base actually covers.
Inside the product, the list of chat sessions became a sequence of compliance spaces. Each space takes one part of the directive, with its own references and file uploads, including spaces built on ENISA’s technical guidance and a first Article 21 assessment. A space is locked, active or done, and each one produces an output you review. That review is the decision gate from June, applied to compliance.
A tracker for a moving target
Guidance also has to know where each country stands, and transposition is still moving. NIS2INTEL started as that tracker: a map of where every member state is with NIS2, built on ECSO’s transposition tracker, with a feed of policy updates drawn from ECSO’s monthly digests.
One product family
Then I made the two products one family. I wrote NIS2.chat’s design system down as tokens with a live style guide, and rebuilt the tracker on it in a fixed order: a design spec, an implementation plan, and a lint check that failed because the tracker didn’t match the tokens yet. Then came the theme remap, the new header and hero, every component restyled, and a review pass that brought the muted labels up to AA contrast. It’s the same loop I use for code: write the check that fails, then make it pass.
NIS2.chat’s deployed version put the chat behind a login, and the open “Chat Now” button became “Book Demo”.
Compliance systems like these will be built either way. The question is whether the people directing the AI understand the operator’s thirty seconds, or only the regulation’s paragraph numbers.
Continues in August with Build to Learn AI.
Daniel Arevalo is a Product Architect and strategic product design leader. He helps product teams turn AI capability into trusted, adoptable workflows, with a background in industrial AI, IT/OT cybersecurity, and high-stakes enterprise software for critical infrastructure.