# NIS2 and the Supply Chain: Where Governance Meets Contract > SwissGRC explains what NIS2 Article 21 requires for supply chain security and how IT security, risk management and procurement can share responsibility. It addresses essential and important entities and Swiss suppliers to EU customers. - URL: https://swissgrc.com/ar/nis2-supply-chain-governance-contract-obligation/ - الناشر: SwissGRC® - تاريخ النشر: 2026-09-09 - آخر تحديث: 2026-09-17 ## معلومات أساسية - Article 21(2)(d) of the NIS2 Directive lists supply chain security, including relationships with direct suppliers and service providers, among the required risk management measures. - Under Article 21(3), entities must consider the specific vulnerabilities of each supplier and the overall quality of its products and cybersecurity practices. - Under Article 34 NIS2, breaches of Article 21 can be fined with up to 10 million euros or 2 percent of worldwide annual turnover for essential entities, and at least 7 million euros or 1.4 percent for important entities. - The German NIS2 Implementation Act entered into force on 6 December 2025 and activates the fine provisions in Section 65 BSIG, which comprises 17 fine categories. - Swiss companies are affected when an EU customer passes on its Article 21 obligations through supply contract clauses, because NIS2 formally applies only within the EU. - Article 20 requires management bodies to approve risk management measures and oversee their implementation, which requires a documented allocation of responsibilities. The NIS2 Directive requires essential and important entities to actively manage the security of their supply chain, not merely document it. Organisations that ignore this obligation risk the same fine framework as for a breach of the reporting duty or the wider risk management requirements. The attention this threat generates draws focus to an open question in many organisations: which function is responsible when a supplier becomes a risk. In short Article 21 of the NIS2 Directive explicitly lists supply chain security among the risk management measures and ties violations to the same fine framework as other core obligations. Responsibility can be cleanly divided when IT security supplies the technical criteria, risk management aggregates the assessment, and procurement translates it into enforceable contract clauses. 10EUR m Maximum fine for essential entities under Article 34 NIS2 nis-2-richtlinie.com, NIS2 sanctions, 16.05.2026 86% Organisations with an ICT/OT supply chain security policy, ENISA survey 2022 CIP Association, summary of ENISA report Good Practices for Supply Chain Cybersecurity 17offences Fine offences under Section 65 BSIG secjur, NIS2 fines, 28.07.2026 ## What does Article 21 of the NIS2 Directive require for the supply chain? Article 21(2)(d) explicitly lists supply chain security, including the relationships with direct suppliers and service providers, among the required risk management measures. Paragraph 3 of the same article specifies this obligation further: when selecting appropriate measures, entities must take into account the specific vulnerabilities of each individual supplier as well as the overall quality of that supplier’s products and cybersecurity practices. At Union level, Article 22 supplements this individual obligation with coordinated risk assessments for critical supply chains. This shows that the legislator treats supply chain risk as a distinct, EU-wide relevant topic rather than an appendix to internal risk management. ## How closely is the fine tied to supply chain failure? Breaches of Article 21 are sanctioned under the same fine framework as other core obligations of the Directive, up to 10 million euros or 2 percent of worldwide annual turnover for essential entities. Article 34 of the NIS2 Directive sets out this framework and provides for important entities, in the case of breaches of Article 21 or Article 23, a maximum amount of at least 7 million euros or 1.4 percent of worldwide annual turnover. This places inadequate supplier management on the same regulatory footing, in terms of fines, as a missed notification or the absence of a contingency plan. For the governance function, this means that the assessment of supplier risk needs the same standard of evidence as the other measures under Article 21. ![Views from the TPRM module of the SwissGRC Platform: risk dashboard, service catalogue and criticality rating](https://swissgrc.com/wp-content/uploads/sites/5/2026/09/Isometric-screenshots-net-background-1024x572.png) Views from the TPRM module of the SwissGRC Platform: risk dashboard, service catalogue and criticality rating ## What does the German implementation reveal about the fine mechanism? Section 30(2) No. 4 BSIG translates the supply chain obligation into a concrete measure requirement, and Section 65 BSIG backs it with a tiered catalogue of fines. The German NIS2 Implementation Act entered into force on 6 December 2025, activating the fine provisions in Section 65 BSIG. According to secjur, the provision comprises 17 fine categories in total, ranging from 100,000 euros for negligence to 10 million euros for missing risk management measures or breaches of the reporting duty. Under Section 65(8) BSIG, the German Federal Office for Information Security can use worldwide group turnover as the basis for calculation and, in case of doubt, estimate it. This extends the assessment basis to supplier relationships within a group as well. ## Why are Swiss suppliers affected regardless? The NIS2 Directive formally applies only within the EU, yet Swiss companies fall within its sphere of influence as soon as an EU customer passes on its own security obligations to suppliers by contract. According to ncloud.swiss, Swiss businesses are not addressed by their own law, but by contract clauses that an EU customer passes down in order to fulfil its own Article 21 obligation. The revised Swiss Information Security Act is aimed primarily at federal authorities and operators of critical infrastructure and, unlike NIS2, does not provide for personal liability of executive management. For Swiss suppliers, this means that actual enforcement does not take place through a statute, but through the supply contract with the EU customer. ## How can responsibility be divided between procurement, risk management and IT security? None of the sources reviewed prescribes a division as a normative requirement, but the structure of Article 21 suggests a division of labour along the process chain. IT security assesses the technical criteria named in Article 21(3): a supplier’s specific vulnerabilities and the quality of its cybersecurity practices. Risk management brings these individual assessments together as part of Third-Party Risk Governance and places them within the overall risk appetite. Procurement translates the result into contract clauses that are enforceable in a dispute, such as audit rights or reporting deadlines for security incidents. Article 20 requires management bodies to approve risk management measures and oversee their implementation. Without a documented allocation of the three functions, this oversight duty can hardly be demonstrated credibly. A first, verifiable step is for risk management to compile, within the next three months, a register of direct suppliers that documents the criteria from Article 21(3) for each supplier, and to hand this register to procurement as the basis for the next contract negotiation. Related ### Capture and steer supplier risk in a structured way Third-Party Risk Management brings together vulnerability assessment and contract status for each supplier. It makes visible where risk management and procurement assess the same supplier differently. [Third-Party Risk Management](https://swissgrc.com/ar/tprm-software/) For practice ## Key points - Article 21(2)(d) makes supply chain security a core obligation of NIS2 risk management, not a voluntary addition. - A breach of the supply chain obligation is sanctioned under the same fine framework as a breach of other risk management measures. - Swiss suppliers are captured not by their own law, but by contract clauses imposed by EU customers. - A sensible division of labour assigns the technical assessment to IT security, risk aggregation to risk management, and contractual implementation to procurement. - Without documented responsibility, the oversight duty of management bodies under Article 20 can hardly be demonstrated. FAQ ## Frequently asked questions What happens if a company breaches the supply chain obligation under NIS2? A breach of the supply chain obligation under Article 21 is sanctioned under the same fine framework as other core obligations of the NIS2 Directive. Essential entities face fines of up to 10 million euros or 2 percent of worldwide annual turnover, important entities at least 7 million euros or 1.4 percent. Does NIS2 also apply to Swiss companies without an EU presence? The NIS2 Directive formally applies only within the EU. Swiss suppliers nonetheless fall within its sphere of influence when an EU customer passes on its own Article 21 obligations by contract. Enforcement then takes place not through a statute, but through contract clauses in the supply contract with the EU customer. What level of fine is threatened for breaches of Article 21? Article 34 of the NIS2 Directive provides for essential entities fines of up to 10 million euros or 2 percent of worldwide annual turnover, and for important entities at least 7 million euros or 1.4 percent. The German implementation in Section 65 BSIG comprises 17 tiered fine offences ranging from 100,000 euros to 10 million euros. Who within a company should be responsible for assessing supplier risk? A sensible division of labour assigns the technical assessment of vulnerabilities and cybersecurity practices to IT security. Risk management aggregates these assessments and places them within the overall risk appetite. Procurement translates the result into enforceable contract clauses such as audit rights or reporting deadlines. What does Article 22 of the NIS2 Directive mean for critical supply chains? Article 22 supplements the individual supply chain obligation from Article 21 with coordinated risk assessments at Union level for critical supply chains. This shows that the legislator treats supply chain risk as a distinct, EU-wide relevant topic, not merely as part of the internal risk management of individual entities. Sources 1. [Article 21 NIS2 Directive: risk management measures](https://nis2-umsetzung.com/nis2-richtlinie/artikel-21-risikomanagementmassnahmen-im-bereich-der-cybersicherheit/)nis2-umsetzung.com 2. [Fine offences under Section 65 BSIG](https://www.secjur.com/blog/nis2-strafen)secjur ## الأسئلة الشائعة ### What does Article 21 of NIS2 require for the supply chain? Article 21(2)(d) lists supply chain security, including relationships with direct suppliers and service providers, among the required risk management measures. Paragraph 3 adds that entities must consider each supplier's specific vulnerabilities and the quality of its products and cybersecurity practices. ### What fines apply if a company breaches the NIS2 supply chain obligation? Breaches of Article 21 fall under the same fine framework as other core obligations. Essential entities face up to 10 million euros or 2 percent of worldwide annual turnover, important entities at least 7 million euros or 1.4 percent. ### Does NIS2 apply to Swiss suppliers? NIS2 formally applies only within the EU. Swiss suppliers are still affected when an EU customer passes on its Article 21 obligations through contract clauses, so enforcement takes place through the supply contract and not through a statute. ### Who is responsible for supplier risk under NIS2? The text suggests a division of labour along the process chain. IT security assesses the technical criteria, risk management aggregates the assessments, and procurement turns the result into enforceable contract clauses such as audit rights or incident reporting deadlines. No source prescribes this division as a normative requirement. ### What is a first step to document supplier risk? Risk management compiles within three months a register of direct suppliers that documents the Article 21(3) criteria for each supplier. It then hands the register to procurement as the basis for the next contract negotiation.