NIS2 Directive

The NIS2 Directive is the European Union's updated Network and Information Systems directive, expanding cybersecurity obligations to more sectors and requiring organizations to address supply chain security practices. NIS2 compliance is driving third-party cyber risk management investment across EU-regulated industries and their global supplier networks.

Which Organizations Does NIS2 Apply To?

NIS2 applies to essential and important entities across 18 sectors, from energy and healthcare to digital infrastructure and public administration. The directive splits covered organizations into two tiers. Essential entities include energy, transport, banking, health, drinking water, and digital infrastructure providers, and they face the strictest oversight. Important entities, including postal services, waste management, and manufacturers of certain products, face lighter but still mandatory supervision.

NIS2 replaced the original 2016 NIS Directive to close gaps regulators found in the first version. Member states had until October 2024 to transpose NIS2 into national law, though implementation has been uneven. Fines reach 10 million euros or 2% of global annual turnover, whichever is higher, and personal liability can extend to management. For organizations that depend on EU-regulated vendors, NIS2 raises the bar for what adequate third-party oversight looks like.

Size works differently here than in most regulations. NIS2 generally exempts organizations with fewer than 50 employees and under 10 million euros in revenue, but membership in a critical sector can pull smaller organizations into scope regardless of headcount. A mid-sized hospital network or a regional water utility can find itself squarely inside NIS2's reach without meeting typical large enterprise thresholds, and that same logic extends to the vendors those organizations rely on.

What Does Article 21 Require for Supply Chain Security?

Article 21 makes supply chain security one of ten mandatory risk management measures every in-scope entity must implement. Unlike voluntary vendor security frameworks, this provision carries the same legal weight as encryption or incident response planning. In-scope organizations need to:

Map direct vendors and service providers

Article 21(2)(d) specifically calls out the security of relationships with third parties, alongside internal controls.

Build security requirements into vendor contracts

A signed agreement that never gets checked against reality doesn't satisfy the obligation.

Maintain ongoing oversight

Article 21(3) requires entities to take into account each supplier’s specific vulnerabilities and the overall quality of its cybersecurity practices, which a once-a-year review can quickly leave out of date.

Assign accountability to management

NIS2 places responsibility for these measures on the entity's management body, which can face personal liability for serious failures.

Fines for noncompliance reach 10 million euros or 2% of global annual turnover for essential entities, whichever is higher. Important entities face somewhat lower caps. National competent authorities and CSIRTs enforce these rules.

Enforcement has moved from paper warnings to real consequences. On July 8, 2026, the European Commission referred Ireland, Spain, France, and the Netherlands to the Court of Justice of the EU for failing to fully transpose the directive into national law, a sign the Commission is now treating late transposition as an enforcement matter, not a paperwork delay.

When Does NIS2 Start Binding Companies?

NIS2 obligations reach an organization through its member state’s transposing law, so the timing depends on when that law takes effect, but Article 21’s core measures are consistent across every national version. Transposition has been uneven since the October 17, 2024 deadline, and the European Commission’s enforcement track now runs through formal court referrals for the member states still lagging. Germany’s implementation applied from December 2025 with no transition period, while Italy built its own national cybersecurity framework around the directive and several other member states remain mid-process. Companies in lagging states should still plan to the directive’s text, since national laws must implement the same minimum measures.

That unevenness is a genuine limitation of NIS2 as a compliance target. A company can't point to NIS2 compliance as a single, portable status the way it might point to an ISO 27001 certificate, since the specific documentation, audit timing, and reporting windows a vendor needs depend on where that vendor is headquartered.

How Did a Single Vendor Breach Expose NIS2's Supply Chain Risk?

The 2025 breach at Swedish IT vendor Miljödata showed exactly what Article 21's supply chain duty is meant to prevent. Black Kite's 2026 European Third-Party Cyber Risk Report documented how the compromise pulled in reached around 200 Swedish municipalities and regions, 8 universities, and named companies including SAS, Volvo Group, and Axfood. None of those downstream organizations was breached directly. Their exposure came entirely through a shared vendor, the exact scenario Article 21 was written to force entities to plan for in advance.

How Does NIS2 Relate to DORA and GDPR?

NIS2 governs cybersecurity risk management, DORA governs ICT resilience specifically for financial entities, and GDPR governs personal data protection, and the three obligations can apply to the same vendor relationship at once. A cloud provider serving an EU bank might need to satisfy DORA (Digital Operational Resilience Act)'s continuous ICT monitoring duty, NIS2's Article 21 measures if the bank also qualifies as an essential or important entity outside financial services, and GDPR's processor obligations if that same provider touches personal data. Teams that treat these as one undifferentiated EU compliance bucket usually end up duplicating audit work that could otherwise be reused. NIS2 sits closest to regulatory risk for the broader question of how any named regulation should shape a TPRM program for cyber risk.

How Does Black Kite Support NIS2 Supply Chain Obligations?

Black Kite correlates vendor findings against NIS2 alongside frameworks including NIST, ISO 27001, SOC 2, and DORA, so one vendor assessment can answer more than one regulator's question. Vendor compliance management handles that correlation automatically, well beyond manual due diligence reviews done vendor by vendor. Compliance Rating then turns that output into a single view, replacing a stack of framework-specific spreadsheets. Continuous monitoring keeps that supplier picture current between point-in-time reviews, and The Bridge™ gives teams a direct channel for pushing vendor remediation well ahead of an annual reassessment cycle.

None of this makes the underlying transposition patchwork simpler. It does mean a vendor's NIS2-relevant posture shows up within Black Kite’s regular scan cycle, well before the once-a-year questionnaire comes due.