My client is in scope of NIS2 and asks me for measures — is that required?

Short answer: Your client, being in scope of NIS2, is legally required to manage the security of its supply chain and may set requirements on you to do so. As an ordinary supplier you usually do not fall directly under NIS2 yourself, but the requirements reach you through the contract. Complying is therefore not a legal obligation for you, but it is often a condition for keeping the client.

What NIS2 asks of your client

NIS2 — Directive (EU) 2022/2555 — requires essential and important entities to take appropriate and proportionate measures to manage the risks to their network and information systems. Article 21 expressly lists supply-chain security, including security-related aspects of the relationships between the entity and its direct suppliers or service providers. The directive therefore asks the in-scope organisation to look at its own supply-chain risks and account for them — including in its procurement and contracting decisions.

That is the legal basis behind the request you receive: your client is passing its own obligation down the chain. The directive places that duty on the entity itself, not directly on every supplier.

Are you in scope of NIS2 yourself?

NIS2 applies to organisations in the sectors listed in the annexes to the directive (such as energy, transport, digital infrastructure, food and certain manufacturing) that exceed the threshold for medium-sized enterprises. If you, as a supplier, fall within those sectors and above that size, you may be directly in scope — with obligations of your own. The directive is transposed into national law by each Member State; the precise scope and exemptions follow from that national implementation and its supervision.

If you are not in scope, your obligation arises not from the law but from the contract. Your client's requirement is then a commercial, contractual one — not a direct legal duty on you.

What this means in practice

Three sober conclusions. First, the request is legitimate and will recur, because your client is itself held accountable for it. Second, assess whether you fall under NIS2 yourself — this changes whether "required" is legal or contractual. Third, even without a legal duty of your own, cooperating is often wise, because refusing can lead the client to choose a supplier who can demonstrate the requested measures. Which measures are reasonable and proportionate depends on your role in the chain and the nature of the service; the directive calls for proportionality, not identical requirements for everyone.

Read more: Transport & Logistics. Take the scan.