Which organisations must comply with NIS2 supply chain requirements?

NIS2 draws a fundamental distinction between essential entities and important entities, both of which are subject to supply chain security obligations — albeit with differing supervisory intensities.

What does Article 21 require for supply chain security?

Article 21(2)(d) mandates that entities adopt risk management measures addressing supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers. This deceptively short provision carries substantial operational weight.

What are the minimum contractual requirements for ICT suppliers under NIS2?

Whilst NIS2 does not publish a statutory clause list equivalent to DORA Article 30, ENISA's NIS2 Implementation Guidance (2024) and the underlying recitals make clear that contracts with material ICT suppliers must address five categories of provision:

Does NIS2 supply chain security apply to non-EU suppliers?

Yes. Article 21(2)(d) makes no distinction based on the geographical location of the supplier. A US, Indian or Israeli cloud provider that delivers ICT services material to your NIS2-regulated operations is an in-scope supplier. You must impose equivalent contractual obligations on them as you would on an EU-based vendor. Where a non-EU supplier refuses to accept NIS2-compliant clauses, this itself constitutes a risk factor that must be recorded and escalated.

What penalty applies for non-compliance with NIS2 supply chain obligations?

For essential entities, national competent authorities may impose administrative fines of up to €10 million or 2% of total global annual turnover, whichever is higher. For important entities, the maximum is €7 million or 1.4% of global annual turnover. These penalties apply to the overall NIS2 obligations under Article 21 — supply chain security is one component. Member States have discretion to set specific fine levels within these maxima, and several (including Germany and the Netherlands) have already published enforcement guidance suggesting supply chain failures will be treated as significant breaches.

Must we audit all suppliers or only critical ones?

Article 21 requires a proportionate approach — risk management measures must be "appropriate and proportionate" to the risks posed. This means a tiered model is not only permissible but expected. Suppliers providing non-critical services with no access to your core systems or data may be managed through self-attestation. Tier 1 suppliers — those critical to your regulated service delivery — should be subject to annual structured assessments and, where warranted, direct audits. Document your tiering rationale, as supervisory authorities may review it.

How does NIS2 supply chain relate to DORA supply chain requirements?

There is significant overlap for financial entities that fall under both regimes. DORA Article 28 sets out ICT third-party risk management obligations, and Article 30 specifies mandatory contract clauses — both of which substantially replicate and in some areas exceed the NIS2 supply chain requirements. DORA is the lex specialis for financial entities: where a financial entity is subject to DORA, its DORA ICT third-party risk management obligations are deemed to satisfy the equivalent NIS2 requirements (Article 4 NIS2). However, entities should verify this with their national competent authority, as implementation varies across Member States.

What is a "significant incident" under NIS2 for supply chain purposes?

Article 23(3) defines significant incidents as those causing severe operational disruption, financial loss, or affecting other natural or legal persons. Supply chain incidents are significant if a supplier's compromise causes or is likely to cause service disruption to your NIS2-regulated operations, a data breach, or cross-border impact. ENISA's sector-specific thresholds (published in sector guidance) provide quantitative criteria — for example, energy entities may trigger significance at disruptions affecting defined percentages of supply capacity. The practical threshold for supply chain incidents is whether the supplier's failure would trigger your own Article 23 reporting obligation.

Do SMEs in the supply chain of essential entities need to comply with NIS2?

Not directly, unless they independently meet the size thresholds and operate in a covered sector. However, the practical effect of NIS2 supply chain obligations is to impose de facto compliance pressure on SME suppliers: an essential entity must include security clauses in its supplier contracts, require evidence of security standards, and exercise audit rights. An SME that cannot demonstrate adequate security posture may find itself excluded from contracts with essential entities. Several Member States are developing SME guidance and subsidised support programmes to address this "trickle-down" compliance challenge.

RegTech

NIS2 y Seguridad de la Cadena de Suministro: Obligaciones para Empresas EU

IgeraSolutions Compliance Team

14 de junio de 2026

9 min read

Digital supply chain network representing NIS2 cybersecurity obligations for EU entities

#NIS2 supply chain security#NIS2 Article 21 suppliers#NIS2 ICT supply chain obligations#supply chain cybersecurity EU#NIS2 Directive 2022 2555 supply chain

COMPARTIR

Comparte el conocimiento con tu red

NIS2 y Seguridad de la Cadena de Suministro: Obligaciones para Empresas EU

COMPARTIR

Artículos relacionados

NIS2 Notificación de Incidentes: La Regla de 24 Horas Explicada (2026)

DORA para Entidades Financieras: Guía Práctica de Cumplimiento 2026