NIS2 and the Supply Chain: Where Governance Meets Contract

The NIS2 Directive requires essential and important entities to actively manage the security of their supply chain, not merely document it. Organisations that ignore this obligation risk the same fine framework as for a breach of the reporting duty or the wider risk management requirements. The attention this threat generates draws focus to an open question in many organisations: which function is responsible when a supplier becomes a risk.

What does Article 21 of the NIS2 Directive require for the supply chain?

Article 21(2)(d) explicitly lists supply chain security, including the relationships with direct suppliers and service providers, among the required risk management measures.

Paragraph 3 of the same article specifies this obligation further: when selecting appropriate measures, entities must take into account the specific vulnerabilities of each individual supplier as well as the overall quality of that supplier’s products and cybersecurity practices.

At Union level, Article 22 supplements this individual obligation with coordinated risk assessments for critical supply chains. This shows that the legislator treats supply chain risk as a distinct, EU-wide relevant topic rather than an appendix to internal risk management.

How closely is the fine tied to supply chain failure?

Breaches of Article 21 are sanctioned under the same fine framework as other core obligations of the Directive, up to 10 million euros or 2 percent of worldwide annual turnover for essential entities.

Article 34 of the NIS2 Directive sets out this framework and provides for important entities, in the case of breaches of Article 21 or Article 23, a maximum amount of at least 7 million euros or 1.4 percent of worldwide annual turnover.

This places inadequate supplier management on the same regulatory footing, in terms of fines, as a missed notification or the absence of a contingency plan. For the governance function, this means that the assessment of supplier risk needs the same standard of evidence as the other measures under Article 21.

What does the German implementation reveal about the fine mechanism?

Section 30(2) No. 4 BSIG translates the supply chain obligation into a concrete measure requirement, and Section 65 BSIG backs it with a tiered catalogue of fines.

The German NIS2 Implementation Act entered into force on 6 December 2025, activating the fine provisions in Section 65 BSIG. According to secjur, the provision comprises 17 fine categories in total, ranging from 100,000 euros for negligence to 10 million euros for missing risk management measures or breaches of the reporting duty.

Under Section 65(8) BSIG, the German Federal Office for Information Security can use worldwide group turnover as the basis for calculation and, in case of doubt, estimate it. This extends the assessment basis to supplier relationships within a group as well.

Why are Swiss suppliers affected regardless?

The NIS2 Directive formally applies only within the EU, yet Swiss companies fall within its sphere of influence as soon as an EU customer passes on its own security obligations to suppliers by contract.

According to ncloud.swiss, Swiss businesses are not addressed by their own law, but by contract clauses that an EU customer passes down in order to fulfil its own Article 21 obligation.

The revised Swiss Information Security Act is aimed primarily at federal authorities and operators of critical infrastructure and, unlike NIS2, does not provide for personal liability of executive management. For Swiss suppliers, this means that actual enforcement does not take place through a statute, but through the supply contract with the EU customer.

How can responsibility be divided between procurement, risk management and IT security?

None of the sources reviewed prescribes a division as a normative requirement, but the structure of Article 21 suggests a division of labour along the process chain.

IT security assesses the technical criteria named in Article 21(3): a supplier’s specific vulnerabilities and the quality of its cybersecurity practices. Risk management brings these individual assessments together as part of Third-Party Risk Governance and places them within the overall risk appetite. Procurement translates the result into contract clauses that are enforceable in a dispute, such as audit rights or reporting deadlines for security incidents.

Article 20 requires management bodies to approve risk management measures and oversee their implementation. Without a documented allocation of the three functions, this oversight duty can hardly be demonstrated credibly. A first, verifiable step is for risk management to compile, within the next three months, a register of direct suppliers that documents the criteria from Article 21(3) for each supplier, and to hand this register to procurement as the basis for the next contract negotiation.