NIS2 for Suppliers: Are You Indirectly Affected?

Written by the NIS2Compass editorial team / As of: November 2026

As a supplier, you are only affected by NIS2 yourself if your own activity and size fall under § 28 BSIG. Otherwise you are only indirectly affected: the BSIG obliges your regulated customers (per the BSI, 20,141 registered entities at the end of September 2026), and only your contractual commitments bind you. The NIS2Compass templates show how supplier questionnaires can be structured.

Are You Directly Affected by NIS2 as a Supplier, or Only Indirectly?

First check whether you are affected yourself: what counts is your activity under Annexes 1 and 2 BSIG and your size, not your customer's sector. Only if § 28 BSIG does not apply does NIS2 reach you indirectly, by contract. The NIS2 Affectedness Check from NIS2Compass helps you classify your situation.

Your customer's questionnaire proves nothing. It says neither that you are affected nor that you are not. It only shows that the customer is working on its own obligation.

By 30 September 2026, 20,141 entities had registered with the BSI. The BSI gives no figure for suppliers. Its info package on the supply chain notes that a large number of companies are indirectly affected as suppliers or service providers.

• Directly affected: Your own activity is listed in Annex 1 or 2 BSIG and your company reaches the threshold in § 28 BSIG: at least 50 employees, or annual turnover and balance sheet total each above EUR 10 million. Covered regardless of size are, for example, operators of critical facilities, DNS service providers, TLD name registries, trust service providers and telecommunications providers. The obligations in §§ 30 et seq. BSIG then apply to you.
• Indirectly affected: You do not fall under § 28 BSIG. You then have no obligations of your own under §§ 30 to 38 BSIG, but face demands from your customers. Whatever you commit to by contract still binds you.

An automotive parts manufacturer with 80 employees is an important entity (Annex 2). A plastics processor with 80 employees supplying the same automotive sector is not affected if its activity falls under NACE C22, because that division is in neither annex (thresholds and examples in the SME article). This holds provided no further activity falls under an entity type in the annexes. Negligible secondary activities can be disregarded under § 28 (3) BSIG.

Managed service providers are listed in Annex 1. IT service providers should therefore check especially carefully whether they are covered.

What Happens If You Classify Yourself Incorrectly?

If you hastily classify yourself as "just a supplier" although you fall under § 28 BSIG, you overlook your own obligations: registration, reporting channels and risk management. Fines under § 65 BSIG are then possible. If you were covered when the law took effect on 6 December 2025, you had to register by 6 March 2026. If you grow into scope later, you have three months (§ 33 (1) BSIG).

For an overview, see NIS2 in the Supply Chain: What Suppliers Need to Know.

What Can Your Customer Require of You Because of NIS2, and on What Basis?

Unless you fall under § 28 BSIG yourself, the BSIG obliges your customer, not you: § 30 (2) no. 4 BSIG requires supply chain security with regard to direct suppliers. The law does not prescribe a questionnaire, evidence or a clause. What you owe only arises from the contract you sign.

According to Bitkom (1,002 companies with 10 or more employees, 7 November 2025), 9% know of attacks on their suppliers in the past twelve months and 19% suspect them. Of both groups, 41% felt effects in their own business.

These demands rest on five levels of differing binding force:

• Law (binds the customer): For the supply chain, § 30 (2) no. 4 BSIG requires "supply chain security, including security-related aspects of the relationships with direct suppliers or service providers" (translated). Since 6 December 2025 (NIS2UmsuCG), regulated customers have been legally bound by this.
• Directive and explanatory memorandum (explain the depth): Art. 21 (2) (d) of the NIS2 Directive is the European basis. The explanatory memorandum (BT-Drs. 21/1501, on § 30 (2)) gives as examples "contractual agreements with suppliers and service providers" (translated) on risk management, incident handling and patch management, as well as security by design. These are optional examples, not a mandatory catalogue.
• BSI (authority's interpretation, not statutory text): According to the BSI, the BSIG does not indirectly oblige all suppliers or service providers; rather, entities may no longer be able to work with every company without risking breaches of duty (BSI info package). The BSI also says entities must oblige their suppliers to comply with corresponding security requirements. That goes beyond the statutory wording and explains why customers insist on clauses. Here too, the obligation falls on the customer, not you.
• Implementing regulation (for some customers): Implementing Regulation (EU) 2024/2690 sets out supply chain requirements for certain digital services such as cloud, data centres, MSPs and MSSPs, according to the BSI only for a selected part of entities. These customers can pass the content on by contract.
• Contract (binds you): Only here does your obligation arise. The customer may ask and set conditions; you may negotiate or decline. For the BSI, whether a supplier continues to supply such entities is also an economic decision.

Which NIS2 Obligations Apply to You as an Indirectly Affected Supplier, and Which Do Not?

Unless you fall under § 28 BSIG yourself, you have no registration obligation, no duty to report to the BSI and, from the customer relationship, no risk of fines under § 65 BSIG. Contractual commitments still bind you. A breach has consequences towards the customer, not the BSI.

This does not apply unless you fall under § 28 BSIG yourself:

• § 33 BSIG on registration is addressed to particularly important and important entities as well as domain name registry service providers.
• § 32 BSIG on reporting does not apply to you, not even because of a contractual 24-hour deadline. You can report voluntarily under § 5 (2) BSIG.
• § 30 BSIG creates no statutory implementation obligation of your own, § 38 BSIG no management duty.
• The relevant offences in § 65 BSIG are tied to obligations of entities under § 28 BSIG. The indirect effect alone therefore triggers no fine.

This applies nonetheless: Agreed information and patch deadlines, audit rights and flow-down to subcontractors bind you, and false statements in a self-declaration can have contractual consequences. Art. 33 GDPR and, for your own products, the CRA remain unaffected.

The BSI recommends but does not require: if you can rule out being affected yourself, "it may be advisable to review internal compliance with risk management measures under § 30 (2) BSIG for any agreements with clients" (translated) (BSI FAQ).

No fine does not mean no consequences. Depending on the contract, these include exclusion from tenders, lost orders, contractual penalties, damages or termination. Your customer must report significant incidents within 24 hours at the latest and depends on your information.

21% of companies affected by data theft, industrial espionage or sabotage report effects on other companies, such as production outages at business partners or reputational damage to clients (Bitkom Wirtschaftsschutz 2026).

How Do You Answer a NIS2 Supplier Questionnaire Without Starting Over for Every Customer?

Create an answer base: a maintained overview along the ten areas of § 30 (2) BSIG with implementation status, evidence and date. Compare new questionnaires against it instead of starting over. The BSI welcomes initiatives for a uniform question catalogue, but each customer can use its own format.

Fictitious example: A plastics processor with 80 employees is not affected under § 28 BSIG. Its customer, an automotive parts manufacturer registered as an important entity, sends an Excel questionnaire citing § 30 (2) no. 4 BSIG, with two weeks to respond. A month later, a second customer sends a portal form with different questions. The IT manager has a two-person team and no compliance background.

1. Record your classification. Note your activity, size and the result under § 28 BSIG in a dated memo. This answers the common opening question "Are you yourself subject to NIS2?".
2. Create the answer base. Structure it by the ten areas of § 30 (2) BSIG, each with implementation status, document, owner and review date. If you are only indirectly affected, this is voluntary guidance, not a statutory obligation.
3. Compare instead of rewriting. Map each customer question to an entry. Clarify only the deviations, then add them to the base. This keeps your answers to different customers consistent.
4. Answer precisely. Write "Partially implemented, to be completed by [date]" instead of a blanket "Yes". A self-declaration can become part of the contractual basis.
5. Be selective with evidence. Share summaries rather than your internal security concept, and clarify confidentiality in advance.
6. Approve and maintain. Get management approval. Review the base at least after changes and before every new response.

For guidance, the BSI FAQ points to the UP-KRITIS recommendations on requirements for suppliers (version 4.0, 7 November 2023). It is aimed at operators of critical infrastructure and is a recommendation, not a universal standard.

Chapter 6 of the NIS2 templates from NIS2Compass includes, among others, the Supplier Security Questionnaire and the Supplier Inventory. Both are built for the buyer's side; there is no ready-made answer template. As a supplier, use the questionnaire to change perspective and test yourself, and the inventory for your own subcontractors. No customer has to ask exactly these questions.

With the NIS2 supplier proof, Pro users can share the progress they have documented in NIS2Compass via a verification code. It is a self-declaration: NIS2Compass does not check the information, the proof is neither a certificate nor a statement of conformity, and your customer decides whether that is enough.

Which NIS2 Contract Clauses Should You Review Before Signing?

Before signing, review above all reporting and patch deadlines, audit and evidence rights, flow-down to subcontractors and blanket references to the BSIG. What matters is whether your operations can actually keep each commitment. Have liability and contractual penalties legally reviewed in advance.

Models for such clauses appear in the BSI's checklist "Sichere Lieferkette" (secure supply chain) (as of 1 October 2025) and in Annex point 5.1.4 of Implementing Regulation (EU) 2024/2690, which only applies to certain digital services.

• Incident information: What triggers the deadline, a suspicion or only confirmation? How long is it, who receives it, and who reports at night and at weekends? For a 24-hour clause, see the article on the reporting process for service providers.
• Vulnerabilities and patches: Are the deadlines operationally achievable, and when does the clock start? The UP-KRITIS recommendation, Table 2 gives as an example 3 hours to neutralisation (a workaround suffices) for CVSS 9.0 to 10.0 and 3 days for 7.0 to 8.9. These are examples from a recommendation for critical infrastructure, not statutory deadlines. If you sign this, you need on-call cover outside office hours.
• Audit and evidence rights: Does this mean on-site audits or reports? How are scope, notice, costs and confidentiality governed?
• Subcontractors: Can you actually pass requirements on to your cloud provider? The UP-KRITIS recommendation calls for flow-down in writing and monitoring by the contractor. In the editors' view, large providers in particular often do not change their standard terms.
• Blanket references to standards: Does it say "The supplier meets all requirements of the BSIG"? In the editors' view, this sentence turns an indirect effect into a comprehensive contractual obligation. Specifically named measures are better.
• Legal consequences: Are contractual penalties, liability and termination rights proportionate to the order?

Assign each commitment to an internal owner. Whatever nobody can take responsibility for, negotiate before signing. This article is not legal advice.

Is an ISO 27001 Certificate Worth It If Customers Only Ask for NIS2 Evidence?

That depends on the customer's actual requirement, not the size of the quote. According to the BSI, there is no general certificate proving the NIS2 requirements, and each entity assesses ISO 27001 for itself. The certificate pays off when customers explicitly require it or reject a self-declaration.

Check your classification first. With 50 employees and an activity matching an entity type in Annex 1 or 2, you are affected yourself. In that case ISO 27001 alone is not enough, because § 32, § 33 and § 38 BSIG still apply.

Then read the requirement's exact wording. Is a certificate in the contract or a tender condition, or is a statement sufficient? According to the BSI FAQ, each entity assesses ISO 27001 individually in its risk management. If a customer asks for a "NIS2 certificate", see the article on certification, audits and evidence, which also covers costs.

According to ENISA Good Practices for Supply Chain Cybersecurity (June 2023, 2022 study of 1,081 operators of essential services and digital service providers in the EU), 61% of respondents require security certifications from suppliers, 43% use security rating services and 37% due diligence or risk assessments.

• In favour: Several customers explicitly require the certificate, tenders presuppose it, the scope covers your service and the annual maintenance is manageable.
• Against, or for waiting: Customers accept a structured self-declaration, a single questionnaire is the only trigger, or the scope on offer does not match your service.

Even with a certificate, individual questions can remain open. The NIS2 supplier proof from NIS2Compass does not replace a certificate. Only the customer decides whether a self-declaration or proof is sufficient.

Before your next quote discussion, clarify three things with your customer in writing: which evidence it accepts, for what scope and by when. You can then measure any certification offer against actual need.

Frequently Asked Questions

Do I have to register with the BSI as a supplier?

Only if your company itself falls under § 28 BSIG. The registration obligation under § 33 BSIG applies to particularly important and important entities, not to suppliers as such. A customer request or clause creates no registration obligation. So check your own activity and size first: manufacturers and IT service providers can also be covered.

Do I have to answer my customer's NIS2 questionnaire?

Not under the BSIG, unless you are covered yourself. An obligation can, however, arise from your contract. If you do not answer, the customer may reconsider working with you, because it must ensure the security of its supply chain under § 30 (2) no. 4 BSIG. If you respond, state your actual status accurately.

Is there a NIS2 certificate for suppliers?

No. The BSI's FAQ states: "There is no general certificate proving the requirements." (translated) Customers can take certificates such as ISO 27001 into account, but must assess them in their own risk management. If a customer asks for a "NIS2 certificate", ask which evidence it actually means.

Does NIS2 also apply to a supplier's subcontractors?

Not automatically by law: § 30 (2) no. 4 BSIG refers to your customer's direct suppliers and service providers. Requirements reach subcontractors only if passed on by contract. In its info package, the BSI recommends that regulated entities also understand their sub-suppliers. So check what you can pass on yourself.

Will the NIS2 supplier proof from NIS2Compass be enough for my customer?

Your customer decides. The proof shows the progress you documented yourself in NIS2Compass, shared via a verification code. It is a self-declaration, not a review by NIS2Compass, not a certificate and not a statement of conformity. Clarify in advance whether your customer accepts a self-declaration or expects an independent review.