When security duties reach you as a supplier: what it costs to be wrong
If your client answers to Directive (EU) 2022/2555 (NIS2) as an essential or important entity, its security duties reach you through the supply contract, not through direct regulation of your business. Getting the response wrong costs the contract, the incident window, and your own evidence trail. The clock starts when the client's obligation is triggered, often before you are told.
Basis
Directive (EU) 2022/2555 (NIS2) requires essential and important entities to manage cybersecurity risk across their supply chain, including through contractual security requirements imposed on suppliers and service providers. The directive does not create a direct duty on you as a supplier. It obliges your client to write one into the contract it signs with you, and the strength of that clause depends entirely on how the contract was drafted, not on how careful your own security programme is.
This matters for a simple reason: you cannot answer the question "does NIS2 apply to me" in the abstract. It applies to you only through a specific clause, in a specific contract, that your client's own risk assessment produced. Two suppliers doing identical work for two different clients can face entirely different obligations, because the clauses differ.
Practical consequence
Once the clause sits in your contract, three things change in practice. The incident-notification deadline your client owes to its own regulator becomes a shorter deadline you owe to your client, because your client needs time to assess your facts and forward them on. Evidence you would ordinarily keep for internal purposes becomes evidence your client can demand on short notice, in a specific format, within a specific window. And a breach of the security clause can trigger a financial consequence that sits outside the ordinary damages regime altogether.
That last point is worth sitting with. A defined trigger releasing a defined remedy, without a separate finding of fault, is a mechanism you will recognise from When an SLA credit regime is triggered in practice. Security clauses in supply contracts are increasingly built the same way: the trigger fires, the consequence follows, and intent is irrelevant.
What to do
- Locate the security or incident-notification clause in the client contract — the contract owner pulls the current signed version, not a draft.
- Identify the trigger definition precisely: suspicion, confirmation, or actual impact — compliance checks the exact wording against what actually happened.
- Confirm the deadline the clause sets for you, separately from any deadline the client owes its own regulator — the account manager gets this confirmed in writing, not by phone.
- Preserve logs, tickets and internal communications from the moment of suspicion, not from confirmation — the security team secures the record before anything is edited.
- Check whether the clause names sub-processors or subcontractors further down your own chain — procurement maps who else the deadline actually reaches.
- Notify the client's designated contact within the contractual window, in writing, with a timestamp — the account manager sends the notice and keeps proof of sending.
Who decides
Your client decides first. Under Directive (EU) 2022/2555 (NIS2), the entity assesses whether an incident meets its own significant-impact threshold, and only then decides whether to escalate to its national competent authority. You do not make that assessment yourself; you supply the facts the client needs in order to make it, on the timetable the contract sets.
If the client's own escalation is later refused or downgraded by its regulator, the consequence for your contract can look similar to what happens in When a listing is refused and its limits: a decision made by someone else still resets your own deadlines and your own options, whether or not you agree with how it was made.
Forks
If you are a direct supplier named in the client's risk assessment, the security clause is almost certainly already sitting in your contract, and the open question is whether you read it correctly the first time. If you are several tiers removed, as a sub-supplier to a supplier, the duty may not have reached you yet.
It typically arrives at the next renewal, sometimes without a dedicated negotiation at all, in much the same way a term can arrive without discussion in When a distributor claims an implied licence explained. If your obligation under the same contract covers only part of the services you provide, treat that scope boundary with the same care as a claim limited to part of a product range: see When the claim covers only part of the range, where the boundary itself, not the general rule, decides the outcome.
What it costs to be wrong
| Scenario | Immediate cost | Longer-term cost |
|---|---|---|
| Missed contractual deadline | Breach notice from the client | Loss of the contract at renewal |
| Incomplete evidence trail | Client cannot forward your facts to its own regulator on time | Your own liability exposure widens |
| Unclear trigger definition | Dispute over whether the clock had already started | Precedent set against you in future incidents |
| Untracked sub-supplier chain | Client discovers a gap during its own audit | Security clause tightened unilaterally at renewal |
Limit
This page does not read your specific contract clause, and it does not decide whether Directive (EU) 2022/2555 (NIS2) applies to your client at all. It does not assess whether a separate AI-related duty sits alongside the cybersecurity duty in the same commercial relationship. Those questions need the actual contract, and the client's own registration status, in front of a reader before an answer is possible.
Verified
Checked 4 March 2025. Source: Directive (EU) 2022/2555 (NIS2), consolidated text as published on the official EU network.
Related publications
See also When an incident report deadline is running: what it for the notification clock itself, once the trigger described on this page has already fired.
Frequently asked questions
What is the first step when security duties reach you as a supplier?
Locate and read the actual clause in the signed contract, not a summary of what NIS2 requires in general. The clause, not the directive, sets your specific obligation.
Which deadline is already running?
Usually the deadline your client's contract sets for you, which is shorter than the deadline the client owes its own regulator and often starts before you are formally told.
Who decides, and on what evidence?
The client decides first, based on its own significant-impact threshold under Directive (EU) 2022/2555 (NIS2). It decides on the logs, tickets and timestamped communications you supply within the contractual window.