When the outsourcing provider subcontracts abroad: what it costs to be wrong
When your outsourcing provider adds a subcontractor abroad without your consent, the cost shows up later. You lose oversight of who touches your data, incident timelines slip, and audit rights become unenforceable abroad. The flow-down clause in the main contract is the only guardrail; if it is silent, you inherit the subcontractor's failures without a remedy.
Foundation
Two instruments frame the exposure. Directive (EU) 2022/2555 (NIS2) extends security obligations along the supply chain, so a subcontractor operating from abroad does not sit outside your provider's duty of care. Where the outsourcing provider itself falls within the scope of that Directive, the obligation to manage supply-chain risk travels with the work, not with the desk it is performed at.
Directive 2009/24/EC governs who holds the right to reproduce, adapt, or distribute software. That right does not pass to a sub-subcontractor automatically, whatever the main contract implies. If the foreign subcontractor writes, modifies, or hosts code on your behalf, the chain of permission has to be traceable back to the original rights holder — and usually is not, unless someone checked.
Practical consequence
Three things change once subcontracting crosses a border, and none of them are cosmetic.
| Failure point | Practical exposure | Governing mechanism |
|---|---|---|
| Consent to subcontract was never sought | Contract breach; your audit rights become void by default | Flow-down clause in the main services agreement |
| Security incident at the foreign subcontractor | Notification timeline runs on a clock you cannot see | Directive (EU) 2022/2555 (NIS2), applied through national implementation |
| Subcontractor modifies or reproduces licensed software | Licence terms may not extend to the sub-subcontractor | Directive 2009/24/EC |
| Dispute over liability for the subcontractor's failure | Forum and applicable law become uncertain | Jurisdiction clause of the main contract |
The pattern repeats regardless of which task was outsourced. The moment a party you never vetted holds your data or your code, the contract's silence becomes someone else's decision, made in a jurisdiction you did not choose.
What to do
- Pull the main services agreement and locate the subcontracting clause. If it requires prior written consent, check whether that consent was ever given.
- Ask the provider, in writing, for the identity and location of every subcontractor currently performing work under the contract.
- Have your contract manager compare the subcontractor's security obligations against what NIS2 requires of the main provider, where the main provider is in scope.
- Have counsel confirm whether the subcontractor's software output is covered by a licence chain that traces back to the rights holder under Directive 2009/24/EC.
- Suspend or flag any data transfer to the subcontractor until the flow-down obligations are confirmed in writing.
- Escalate to the provider's account owner with a deadline for written confirmation, not a verbal assurance.
Who decides
Inside the relationship, the decision sits with whoever signed the main contract's escalation clause — typically the provider's account owner, then its legal or compliance function if the first answer is unsatisfactory. Outside the relationship, if the failure involves a notifiable security incident, the competent national authority designated under the NIS2 implementing act decides whether the notification was timely and adequate. Neither forum accepts a verbal assurance as evidence; both work from the contract text and the incident log.
Branches
If your contract already lists approved subcontractors by name and jurisdiction, the question is narrower: did the provider stay within that list, and did it notify you of any change within the window the contract sets.
If the contract is silent on subcontracting altogether, the default position in most drafting is that consent is required but was never formally documented — which means the provider is exposed, not you, provided you raise it before performance continues unchallenged.
If the subcontracted work touches tokenised assets rather than data or code, the same failure pattern surfaces in a different setting — When a marketplace delists the collection step by step walks through what happens when the party actually holding the asset changes without notice.
Limit
This page does not establish who the foreign subcontractor is, whether it is solvent, or whether it has been sanctioned elsewhere. It sets out the mechanism and the order of steps; establishing the facts about a specific counterparty is a separate exercise. Where the subcontractor sits in Norway, Counterparty in Norway and its limits explained sets out what can and cannot be confirmed about it.
Equally, this page does not confirm whether a specific document — a subcontracting notice, a data processing addendum, a licence assignment — is genuine or complete. Document in Norway step by step covers that separately, and it is not a substitute for the contract review above.
Verified
Checked against Directive (EU) 2022/2555 (NIS2), in force from 18 October 2024, and Directive 2009/24/EC. Both are cited by their official short reference; no article number is given because the national implementing measure, not the Directive itself, sets the operative detail in each Member State. Delivery timelines referenced elsewhere on this site follow the same discipline — see Delivery statistics, published automatically in detail for how those figures are compiled.
Related situations
A similar breakdown in accountability occurs when service levels are missed rather than delegated abroad. When an SLA credit regime is triggered and its covers the point at which the credit mechanism stops protecting you and starts protecting the provider.
FAQ
What is the first step when the outsourcing provider subcontracts abroad?
Locate the subcontracting clause in the main contract and check whether the required consent was actually given, in writing, before the subcontractor started work.
Which deadline is already running?
If the subcontractor is involved in a security incident, the notification clock set by NIS2's implementing measure runs regardless of whether you were told. The clock does not wait for internal review.
Who decides, and on what evidence?
Internally, the account owner and then legal or compliance decide, on the contract text and the incident log. Externally, the competent authority under the national NIS2 implementation decides on notification adequacy, on the same documentary basis.