AI answer written only from the numbered passages below
According to the passages, a self-employed professional or small supplier working on an in-scope client's site or systems usually does not fall under NIS2 in their own right, because NIS2 generally applies from medium-company size — roughly 50 employees — in a listed sector 1. Meeting the measures your client asks for is then a contractual condition of keeping the assignment rather than a direct legal duty, and refusing can mean the contract goes to a professional or supplier who can demonstrate the requested measures 1. The reason clients pass such requirements down is that NIS2 Article 21 names supply-chain security among the risk-management measures an in-scope 'essential' or 'important' entity must take, including the security aspects of its relationships with direct suppliers and service providers 2. That legal duty on the client is why security requirements are increasingly passed down contractually even to suppliers not directly in scope 2.
Not in the sources: The passages do not say which specific measures or proof a client may request, nor how your own situation maps to the size and sector thresholds.
Cited passages
Passage 1: Contractual, not always statutory, for the contractor
A self-employed professional or small supplier working on an in-scope client's site or systems usually does not fall under NIS2 in their own right (NIS2 generally applies from medium-company size, roughly 50 employees, in a listed sector). Meeting the client's requested measures is then a contractual condition of keeping the assignment, not a direct legal duty — but refusing can mean losing the contract to a professional or supplier who can demonstrate the requested measures.
NIS2 supply-chain security: what it means for contracted professionalsAdapted from trusq's NIS2 supply-chain explainer · eur-lex.europa.eu · retrieved 18 Sep 2026
Passage 2: Why a client passes requirements down the chain
NIS2 Article 21 explicitly names supply-chain security among the risk-management measures an in-scope 'essential' or 'important' entity must take, including the security aspects of its relationships with direct suppliers and service providers. An energy client that is itself in scope of NIS2 is legally required to manage that risk, which is why such clients increasingly pass security requirements down contractually to contracted technical professionals and suppliers, even when those suppliers are not themselves directly in scope of the law.
NIS2 supply-chain security: what it means for contracted professionalsAdapted from trusq's NIS2 supply-chain explainer · eur-lex.europa.eu · retrieved 18 Sep 2026
Sources consulted
- NIS2 supply-chain security: what it means for contracted professionalsAdapted from trusq's NIS2 supply-chain explainer · eur-lex.europa.eu · retrieved 18 Sep 2026 · cited
General information from public sources, not legal advice. Passages are our own-words summaries of the linked publications; follow the link for the authoritative text.