NIS2 compliance: EU Suppliers must address these risks

The NIS2 Directive was introduced to strengthen cybersecurity across the EU, particularly in critical sectors like energy, transport, healthcare, and digital infrastructure. Now, one year after its official adoption, the expectation was that suppliers operating within or selling to the EU would be fully aligned with its principles.  

In reality, many are still scrambling to plug critical gaps, especially in supply chain governance, incident reporting, and internal accountability. For client services teams, this is not a back-office issue: these gaps risk disrupting contracts, eroding trust, and even triggering legal liabilities. 

This article will help you identify the most common blind spots, understand their practical implications, and take proactive steps to meet client and regulatory expectations. 

Where we stand today

As of mid-2025, most EU member states have begun enforcement and expect covered entities—including key suppliers—to demonstrate compliance. This includes having: 

• Comprehensive risk management processes 
• Reliable incident response procedures 
• Clear governance and accountability frameworks 

However, several industry assessments suggest that over 40% of suppliers still lack a formal compliance roadmap. In regulated industries like finance or utilities, this non-compliance isn't just risky, it can be a deal-breaker. 

Common gaps suppliers are still overlooking

1. Third-party risk assessments are incomplete

Many suppliers still lack comprehensive third-party risk assessment frameworks for evaluating their own vendors and subcontractors. This oversight creates a critical blind spot, not only in terms of cybersecurity exposure, but also in regulatory compliance under NIS2. 

From a client’s perspective, this is a significant concern as NIS2 places a strong emphasis on the security and resilience of the entire supply chain, not just the primary service provider. As a result, clients are increasingly scrutinising whether their suppliers have implemented robust processes to assess, monitor, and manage risks originating from their own third-party relationships. Failure to demonstrate effective third-party oversight can lead to contractual friction, loss of client confidence, or even disqualification from regulated procurement opportunities. 

Example: A telecoms provider discovered that its software supplier outsourced key code components to a subcontractor outside the EU—one that had no data security controls in place. This created exposure not just for the supplier but for every downstream client. 

Practical Tip: Start with a tiered risk assessment model, focusing first on critical suppliers. Use standardized Due Diligence Questionnaires (DDQs) that ask specific questions about NIS2-aligned policies, certifications, and breach history. 

2. Incident reporting protocols still unclear

Under NIS2, significant incidents must be reported to national authorities within 24 hours. But many suppliers have yet to formalise these protocols, or fail to notify clients when such events occur. Clients expect to be informed promptly and transparently about incidents that may impact their data, operations, or service continuity. Delayed or incomplete disclosure can lead to reputational damage, legal exposure, and strained commercial relationships. 

Example: A SaaS provider experienced a ransomware attack but only disclosed the issue to clients after three days, well past the regulatory window and without sufficient detail. 

Practical Tip: Client contracts should include clauses outlining mandatory notification timelines and the escalation matrix. Simulate incident scenarios internally to ensure readiness. Define incident severity levels clearly in your internal playbooks (e.g., critical, major, minor) so teams know when NIS2’s 24-hour notification rule applies. 

3. Lack of board-level engagement

Cybersecurity is no longer just an IT issue. NIS2 places clear responsibilities on leadership, including potential personal liability for executives in some cases. 

NIS2 mandates that leadership must not only be aware of their organisation’s cyber risk posture but also demonstrate active engagement in its management. This includes overseeing the implementation of risk management measures, reviewing incident response capabilities, and ensuring that appropriate resources and governance structures are in place. Regulators and clients alike are looking for evidence that cybersecurity is embedded into strategic decision-making—not treated as a purely operational issue. A lack of board-level visibility or involvement is increasingly viewed as a red flag during audits, due diligence, and procurement assessments. 

Example: A logistics firm was found to have never briefed its board on cyber risk. During an audit by a major retail client, this omission flagged serious governance concerns. 

Practical Tip: Train senior leadership on NIS2 obligations. Appoint a board-level cybersecurity sponsor and require periodic reviews of cyber posture. Conduct a NIS2 executive briefing session at least twice a year, tailored to non-technical stakeholders—highlighting legal liabilities, reputational risk, and business continuity implications. 

4. Inadequate supply chain mapping

Knowing who your suppliers are, and who their suppliers are, is fundamental to understanding risk. Supply chain visibility and mapping should therefore be treated as a strategic compliance function, supported by structured inventories, contract clauses requiring disclosure of subcontractors, and periodic reassessments of risk. Clients and regulators alike increasingly expect documented evidence that organisations are not only aware of their extended supplier network, but also actively managing and mitigating associated risks. 

Example: An automotive company learned only after a parts shortage that its supplier relied on a non-compliant data processor in a third country, violating cross-border data flow requirements. 

Practical Tip: Use supply chain mapping tools or manual inventories to identify key suppliers and data flows. Classify each based on criticality and regulatory exposure. Review contracts to understand shared liability: Ensure you know where your obligations end and where your suppliers’ begin—particularly for incident reporting and regulatory disclosures. 

5. Documentation and audit trails still missing

Many suppliers are making meaningful investments in cybersecurity and compliance, but fall short when it comes to demonstrating that compliance in a structured, auditable way. As a result, they risk failing client due diligence checks, regulatory audits, or losing out on competitive contract opportunities. 

Under NIS2, it is sufficient to implement best practices; organisations must be able to evidence them clearly. This includes maintaining up-to-date documentation, policies, incident logs, risk assessments, and proof of staff training. The inability to present this material when requested creates a perception of non-compliance, regardless of the underlying effort. Audit readiness should be treated as an operational priority, with compliance artefacts aligned to client expectations, contractual obligations, and regulatory frameworks. 

Example: An IT provider had completed cybersecurity training for all staff but had no records or signoffs to prove participation during a client audit. 

Practical Tip: Maintain a compliance register that tracks key activities: risk assessments, incident simulations, staff training, and third-party evaluations. 

6. Why client services teams should care

Client-facing teams are often the first line of defence when it comes to understanding and responding to client concerns around compliance. They're also the ones answering Request for Proposals and managing Service Level Agreement (SLA) negotiations—where NIS2 is increasingly referenced. 

You might be asked: 

• “Are your suppliers NIS2-compliant?” 
• “Can you show your incident response history?” 
• “What’s your chain-of-custody for data handling?” 

Practical Advice: Equip client service managers with a “compliance playbook” that outlines standard answers, key documentation to share, and red flags to escalate internally. 

What suppliers must do 

In addition to the practical tips advised above, here’s an arranged action plan for catching up: 

• Run a compliance gap assessment: Use external frameworks (e.g., ENISA’s NIS2 campaign) to benchmark your maturity. 
• Update contracts and SLAs: Include clauses on incident response, breach notification, and subcontractor controls. 
• Create a cross-functional taskforce: Involve Legal, IT, Procurement, and Client Services to ensure end-to-end compliance. 
• Educate client-facing teams: Provide frontline teams with briefings and FAQs so they can confidently address client concerns. (e.g. ENISA Team Awareness Slides) 
• Establish continuous monitoring: Cyber risk is dynamic. Implement tools and policies for regular reassessments.  

Looking Ahead: Preparing for Enforcement & Audits 

As member states ramp up enforcement and more clients add NIS2 clauses into procurement, the bar is only going to rise. Suppliers can expect: 

• More frequent and detailed audits 
• Increased penalties for non-compliance 
• Loss of contracts if they cannot demonstrate control 

Pro Tip: Don’t wait for a regulator or client to point out gaps—build self-audit cycles into your Q3 compliance plans now. 

NIS2 compliance isn’t just about ticking boxes. It is about building trust across the value chain. For suppliers, the hidden gaps aren’t just technical oversights, but business risks waiting to surface. Client service leaders have a critical role to play in closing these gaps—by asking the right questions, sharing the right documentation, and being a bridge between client expectations and operational reality. For additional insight into organisational readiness and implementation planning, Trilateral Research offers a detailed overview of NIS2 obligations and strategies for compliance. 

Trilateral’s Data Protection and Cyber Risk Team have extensive experience supporting organisations to comply with their NIS2 obligations, and assess any risk relating to these. We can assist you to get ready to develop and deploy compliant NIS2 solutions. Please feel free to contact our advisors, who would be more than happy to help.