# NIS2 and the Supply Chain: Where Governance Meets Contract

> Der Beitrag von Swiss GRC erklärt, was Artikel 21 der NIS2-Richtlinie für die Lieferkette verlangt und wie Bussgelder daran geknüpft sind. Er richtet sich an wesentliche und wichtige Einrichtungen sowie an Schweizer Zulieferer und zeigt eine Aufteilung der Verantwortung.

- URL: https://swissgrc.com/en/nis2-supply-chain-governance-contract-obligation/
- Publisher: SwissGRC®
- Published: 2026-09-09
- Last updated: 2026-09-17

## Key facts

- Artikel 21 Absatz 2 Buchstabe d der NIS2-Richtlinie nennt die Sicherheit der Lieferkette ausdrücklich als Risikomanagementmassnahme.
- Verstösse gegen Artikel 21 fallen unter denselben Bussgeldrahmen wie andere Kernpflichten: bis 10 Millionen Euro oder 2 Prozent des weltweiten Jahresumsatzes bei wesentlichen Einrichtungen.
- Für wichtige Einrichtungen sieht Artikel 34 bei Verstössen gegen Artikel 21 oder 23 einen Höchstbetrag von mindestens 7 Millionen Euro oder 1,4 Prozent des weltweiten Jahresumsatzes vor.
- Das deutsche NIS2-Umsetzungsgesetz ist am 6. Dezember 2025 in Kraft getreten. Paragraf 65 BSIG enthält laut secjur 17 Bussgeldtatbestände von 100 000 Euro bis 10 Millionen Euro.
- Schweizer Unternehmen werden nicht durch ein eigenes Gesetz erfasst, sondern durch Vertragsklauseln, die EU-Kunden zur Erfüllung ihrer Pflichten nach Artikel 21 weitergeben.
- Artikel 20 verpflichtet Leitungsorgane, Risikomanagementmassnahmen zu genehmigen und deren Umsetzung zu überwachen.

The NIS2 Directive requires essential and important entities to actively manage the security of their supply chain, not merely document it. Organisations that ignore this obligation risk the same fine framework as for a breach of the reporting duty or the wider risk management requirements. The attention this threat generates draws focus to an open question in many organisations: which function is responsible when a supplier becomes a risk.

In short

Article 21 of the NIS2 Directive explicitly lists supply chain security among the risk management measures and ties violations to the same fine framework as other core obligations. Responsibility can be cleanly divided when IT security supplies the technical criteria, risk management aggregates the assessment, and procurement translates it into enforceable contract clauses.

10EUR m

Maximum fine for essential entities under Article 34 NIS2

nis-2-richtlinie.com, NIS2 sanctions, 16.05.2026

86%

Organisations with an ICT/OT supply chain security policy, ENISA survey 2022

CIP Association, summary of ENISA report Good Practices for Supply Chain Cybersecurity

17offences

Fine offences under Section 65 BSIG

secjur, NIS2 fines, 28.07.2026

## What does Article 21 of the NIS2 Directive require for the supply chain?

Article 21(2)(d) explicitly lists supply chain security, including the relationships with direct suppliers and service providers, among the required risk management measures.

Paragraph 3 of the same article specifies this obligation further: when selecting appropriate measures, entities must take into account the specific vulnerabilities of each individual supplier as well as the overall quality of that supplier’s products and cybersecurity practices.

At Union level, Article 22 supplements this individual obligation with coordinated risk assessments for critical supply chains. This shows that the legislator treats supply chain risk as a distinct, EU-wide relevant topic rather than an appendix to internal risk management.

## How closely is the fine tied to supply chain failure?

Breaches of Article 21 are sanctioned under the same fine framework as other core obligations of the Directive, up to 10 million euros or 2 percent of worldwide annual turnover for essential entities.

Article 34 of the NIS2 Directive sets out this framework and provides for important entities, in the case of breaches of Article 21 or Article 23, a maximum amount of at least 7 million euros or 1.4 percent of worldwide annual turnover.

This places inadequate supplier management on the same regulatory footing, in terms of fines, as a missed notification or the absence of a contingency plan. For the governance function, this means that the assessment of supplier risk needs the same standard of evidence as the other measures under Article 21.

![Views from the TPRM module of the SwissGRC Platform: risk dashboard, service catalogue and criticality rating](https://swissgrc.com/wp-content/uploads/sites/2/2026/09/Isometric-screenshots-net-background-1024x572.png)

Views from the TPRM module of the SwissGRC Platform: risk dashboard, service catalogue and criticality rating

## What does the German implementation reveal about the fine mechanism?

Section 30(2) No. 4 BSIG translates the supply chain obligation into a concrete measure requirement, and Section 65 BSIG backs it with a tiered catalogue of fines.

The German NIS2 Implementation Act entered into force on 6 December 2025, activating the fine provisions in Section 65 BSIG. According to secjur, the provision comprises 17 fine categories in total, ranging from 100,000 euros for negligence to 10 million euros for missing risk management measures or breaches of the reporting duty.

Under Section 65(8) BSIG, the German Federal Office for Information Security can use worldwide group turnover as the basis for calculation and, in case of doubt, estimate it. This extends the assessment basis to supplier relationships within a group as well.

## Why are Swiss suppliers affected regardless?

The NIS2 Directive formally applies only within the EU, yet Swiss companies fall within its sphere of influence as soon as an EU customer passes on its own security obligations to suppliers by contract.

According to ncloud.swiss, Swiss businesses are not addressed by their own law, but by contract clauses that an EU customer passes down in order to fulfil its own Article 21 obligation.

The revised Swiss Information Security Act is aimed primarily at federal authorities and operators of critical infrastructure and, unlike NIS2, does not provide for personal liability of executive management. For Swiss suppliers, this means that actual enforcement does not take place through a statute, but through the supply contract with the EU customer.

## How can responsibility be divided between procurement, risk management and IT security?

None of the sources reviewed prescribes a division as a normative requirement, but the structure of Article 21 suggests a division of labour along the process chain.

IT security assesses the technical criteria named in Article 21(3): a supplier’s specific vulnerabilities and the quality of its cybersecurity practices. Risk management brings these individual assessments together as part of Third-Party Risk Governance and places them within the overall risk appetite. Procurement translates the result into contract clauses that are enforceable in a dispute, such as audit rights or reporting deadlines for security incidents.

Article 20 requires management bodies to approve risk management measures and oversee their implementation. Without a documented allocation of the three functions, this oversight duty can hardly be demonstrated credibly. A first, verifiable step is for risk management to compile, within the next three months, a register of direct suppliers that documents the criteria from Article 21(3) for each supplier, and to hand this register to procurement as the basis for the next contract negotiation.

Related

### Capture and steer supplier risk in a structured way

Third-Party Risk Management brings together vulnerability assessment and contract status for each supplier. It makes visible where risk management and procurement assess the same supplier differently.

[Third-Party Risk Management](https://swissgrc.com/en/tprm-software/)

For practice

## Key points

- Article 21(2)(d) makes supply chain security a core obligation of NIS2 risk management, not a voluntary addition.
- A breach of the supply chain obligation is sanctioned under the same fine framework as a breach of other risk management measures.
- Swiss suppliers are captured not by their own law, but by contract clauses imposed by EU customers.
- A sensible division of labour assigns the technical assessment to IT security, risk aggregation to risk management, and contractual implementation to procurement.
- Without documented responsibility, the oversight duty of management bodies under Article 20 can hardly be demonstrated.

FAQ

## Frequently asked questions

What happens if a company breaches the supply chain obligation under NIS2?

A breach of the supply chain obligation under Article 21 is sanctioned under the same fine framework as other core obligations of the NIS2 Directive. Essential entities face fines of up to 10 million euros or 2 percent of worldwide annual turnover, important entities at least 7 million euros or 1.4 percent.

Does NIS2 also apply to Swiss companies without an EU presence?

The NIS2 Directive formally applies only within the EU. Swiss suppliers nonetheless fall within its sphere of influence when an EU customer passes on its own Article 21 obligations by contract. Enforcement then takes place not through a statute, but through contract clauses in the supply contract with the EU customer.

What level of fine is threatened for breaches of Article 21?

Article 34 of the NIS2 Directive provides for essential entities fines of up to 10 million euros or 2 percent of worldwide annual turnover, and for important entities at least 7 million euros or 1.4 percent. The German implementation in Section 65 BSIG comprises 17 tiered fine offences ranging from 100,000 euros to 10 million euros.

Who within a company should be responsible for assessing supplier risk?

A sensible division of labour assigns the technical assessment of vulnerabilities and cybersecurity practices to IT security. Risk management aggregates these assessments and places them within the overall risk appetite. Procurement translates the result into enforceable contract clauses such as audit rights or reporting deadlines.

What does Article 22 of the NIS2 Directive mean for critical supply chains?

Article 22 supplements the individual supply chain obligation from Article 21 with coordinated risk assessments at Union level for critical supply chains. This shows that the legislator treats supply chain risk as a distinct, EU-wide relevant topic, not merely as part of the internal risk management of individual entities.

Sources

1. [Article 21 NIS2 Directive: risk management measures](https://nis2-umsetzung.com/nis2-richtlinie/artikel-21-risikomanagementmassnahmen-im-bereich-der-cybersicherheit/)nis2-umsetzung.com
2. [Fine offences under Section 65 BSIG](https://www.secjur.com/blog/nis2-strafen)secjur

## Frequently asked questions

### Was droht bei einem Verstoss gegen die Lieferkettenpflicht nach NIS2?

Ein Verstoss gegen Artikel 21 fällt unter denselben Bussgeldrahmen wie andere Kernpflichten der Richtlinie. Wesentliche Einrichtungen riskieren bis zu 10 Millionen Euro oder 2 Prozent des weltweiten Jahresumsatzes, wichtige Einrichtungen mindestens 7 Millionen Euro oder 1,4 Prozent.

### Gilt NIS2 auch für Schweizer Unternehmen ohne Präsenz in der EU?

Die Richtlinie gilt formal nur in der EU. Schweizer Zulieferer geraten aber in ihren Einflussbereich, wenn ein EU-Kunde seine Pflichten aus Artikel 21 vertraglich weitergibt. Die Durchsetzung erfolgt dann über den Liefervertrag und nicht über ein Gesetz.

### Wer ist im Unternehmen für die Bewertung von Lieferantenrisiken zuständig?

Der Text schlägt eine Arbeitsteilung entlang der Prozesskette vor: IT-Sicherheit bewertet die technischen Kriterien, das Risikomanagement bündelt die Bewertungen, und der Einkauf setzt sie in durchsetzbare Vertragsklauseln um. Keine der geprüften Quellen schreibt diese Aufteilung verbindlich vor.

### Was regelt Artikel 22 der NIS2-Richtlinie für kritische Lieferketten?

Artikel 22 ergänzt die Einzelpflicht aus Artikel 21 durch koordinierte Risikobewertungen für kritische Lieferketten auf Unionsebene. Der Gesetzgeber behandelt Lieferkettenrisiken damit als eigenes, EU-weit relevantes Thema.