Published on
NIS2 supply chain rules put the legal duty on your Dutch customer, not on you. Since 15 August 2026, the Cyberbeveiligingswet and its decree require essential and important entities to secure their supply chain and check their direct suppliers. What you owe them follows from your contract. As a Dutch lawyer at MAAK Advocaten in Amsterdam, I help suppliers outside the EU decide what to sign and what to negotiate.
Part of our overview of EU product law for companies selling into the Netherlands.
Why is your Dutch customer sending you NIS2 terms?
Your Dutch customer must secure its supply chain and show that it checks its direct suppliers. Questionnaires, audit clauses and security schedules are how it builds that evidence. The legal duty stays with the customer.
The Netherlands implemented Directive (EU) 2022/2555 (NIS 2 Directive) through the Cyberbeveiligingswet (Cbw). An essential or important entity takes appropriate and proportionate measures for the security of its network and information systems, including supply chain security towards its direct suppliers or service providers (Article 21(1) and (3)(d) Cbw). It weighs each direct supplier’s vulnerabilities and its suppliers’ cybersecurity practices, including their secure development procedures (Article 21(4)).
The implementing decree, the Cyberbeveiligingsbesluit (Cbb), adds that the entity has a written supply chain security policy, tests whether its direct suppliers meet its security requirements and checks this periodically (Article 10 Cbb).
The directive explains that entities “should in particular be encouraged” to put cybersecurity measures into supplier contracts (recital 85). That is encouragement, not a legal duty; the contract is simply the practical way to prove compliance.
Does the Dutch NIS2 law apply to your own company?
Usually not, if you supply products from outside the EU. The Cbw applies to entities established in the Netherlands. Non-EU providers of cloud, data centre, managed or managed security services that are themselves essential or important entities are the main exception.
The Cbw applies to essential and important entities established in the Netherlands (Article 4(1) Cbw); for cloud, data centre and managed (security) service providers, among others, the test is their main establishment or representative here (Article 4(3)). Is your company itself an essential or important entity providing such services in the Netherlands from outside the EU, without a representative in a Member State where you offer them? Then you designate a representative established in one of those Member States (Article 42(1) Cbw). Suppliers of hardware, components or software as a product have no such duty.
A medium-sized or larger manufacturer in an Annex 2 sector, such as electronic products, electrical equipment, machinery or medical devices, is an important entity unless it is essential (Article 12(1)(b) Cbw). Entity duties are covered on our page on NIS2 in the Netherlands and the Cyberbeveiligingswet.
Which NIS2 supplier requirements come from the law, and which are negotiable?
The law requires your customer to test you and check you periodically. It does not prescribe audit frequency, notification times or liability. Those are commercial terms, open to negotiation within what the customer needs as evidence.
| Your customer asks for | Legal basis on the customer’s side | Your position |
|---|---|---|
| Supply chain policy, supplier assessment, periodic checks | Art. 21(3)(d) and 21(4) Cbw; Art. 10 Cbb (digital providers: Annex, point 5.1, Implementing Regulation (EU) 2024/2690) | cooperate; form and frequency are negotiable |
| Security requirements, questionnaire, evidence of secure development | Art. 21(4)(b) Cbw | cooperate; proportionate, Art. 21(1)–(2) Cbw |
| Notification of incidents to the customer | digital providers: point 5.1.4(d) Implementing Regulation (EU) 2024/2690; other customers: contract only | negotiate the definition and timing |
| Audit right or audit reports | digital providers: point 5.1.4(e); other customers: contract only | audit report instead of on-site audit; frequency and costs |
| Same requirements for your subcontractors | digital providers: point 5.1.4(g); recital 85 | flow them down back-to-back |
| Unlimited liability, passing on the customer’s fines | none: the Cbw contains no liability rule, and fines are imposed on the entity | negotiate; not derived from the law |
Commission Implementing Regulation (EU) 2024/2690 covers digital providers such as cloud computing, data centre, managed and managed security service providers, online marketplaces and trust service providers (Article 1). Their supplier contracts specify, where appropriate, security requirements, staff training and background checks, incident notification, audit rights or audit reports, vulnerability handling, subcontracting rules and obligations at termination (Annex, point 5.1.4).
For other customers, such as manufacturers or food producers, no legal list of contract clauses exists, but the list is a useful checklist. The Cbw asks for appropriate and proportionate measures (Article 21(1)–(2)); requirements far beyond that are open for discussion.
How does NIS2 work in the Netherlands?
The Netherlands implemented the NIS 2 Directive through the Cyberbeveiligingswet and the Cyberbeveiligingsbesluit, both in force since 15 August 2026. The supplier rules sit in Article 21 Cbw and Article 10 Cbb, and for digital providers in Implementing Regulation (EU) 2024/2690.
| Event | Date | Source |
|---|---|---|
| NIS 2 Directive adopted | 14 December 2022 | title |
| Member States adopt rules / apply them | by 17 October 2024 / from 18 October 2024 | Art. 41(1) directive |
| Implementing Regulation 2024/2690 adopted | 17 October 2024 | title, Art. 16 |
| Cbw and Cbb in force in the Netherlands | 15 August 2026 | Art. 35 Cbb |
| Commission review of the directive | by 17 October 2027 | Art. 40 directive |
Your customer takes this seriously for a reason: for a breach of Article 21, an essential entity faces a fine of up to €10,000,000 or 2% of the worldwide annual turnover in the preceding financial year of the undertaking to which it belongs, if higher, and an important entity up to €7,000,000 or 1.4% (Articles 80(3)(a) and 87(3)(a) Cbw). Those fines apply to the entity, not to you.
NIS2 regulates organisations. Requirements for products with digital elements come from the Cyber Resilience Act.
Has a Dutch customer sent you a NIS2 security schedule? I can mark which terms rest on the law: contact me as your product law partner in the Netherlands.
What do you do when a Dutch customer sends a NIS2 security schedule?
Read the schedule against your customer’s legal duty first. Testing and periodically checking direct suppliers is required by law. Anything beyond that is negotiable.
As a Dutch lawyer at MAAK Advocaten, I do not advise signing because you have to, nor blocking the schedule. I first put it next to three questions:
- which requirements must your customer itself be able to demonstrate;
- what is it asking on top of that;
- what does it cost you to comply?
Your customer must test its direct suppliers and check them periodically; cooperating with that is simply good customer management. Requirements that go further, such as unlimited liability or an audit at any time without cost compensation, do not come from the law. You discuss those, with a concrete counterproposal. That way you keep the customer and keep your risk under control.
Answering the questionnaire and collecting existing audit reports and certificates you can do in-house.
Should you accept an audit right or offer an audit report?
Offer an audit report first. The law requires your customer to check you periodically, not to inspect your premises. Even the EU list for digital providers names the right to audit and the right to receive audit reports as alternatives (point 5.1.4(e)).
I offer the report first. A recent certification or an independent audit report gives your customer what it needs to demonstrate its checks, without a team walking through your factory or systems. I accept an audit by the customer itself as a safety net: after an incident or if the report shows a clear gap, with a notice period, confidentiality and an agreement on costs.
What should you agree on incident notification?
Agree what you notify, to whom, through which channel and when. A notification duty is reasonable, but tie it to incidents that can affect your customer’s systems or service rather than to every security event.
For digital providers, the contract covers incidents “that present a risk to the security of the network and information systems” of the entity, notified without undue delay (point 5.1.4(d)). Reporting to the Dutch authorities is the entity’s own duty.
A notification duty is reasonable: your customer has short statutory notification deadlines itself and depends on what you tell it. But agree what you notify. I link the duty to incidents that can affect the customer’s systems or service, not to every suspicious email. Record to whom you notify, through which channel, and which information you give in the first notice and which later. Then your team knows what to do when things go wrong, and you avoid arguments afterwards.
Can your customer pass its NIS2 fines and losses on to you?
Not by law. The Cbw places the duties and the fines on the entity and contains no rule on liability between customer and supplier. How much of that risk you carry is decided in the contract.
A clause that moves the customer’s fines under Articles 80 and 87 Cbw to you is a contract term, not a legal consequence. Treat it like any liability clause in supply agreements under Dutch law.
I make the distinction clear. The Cyberbeveiligingswet places the obligations and the fines on your customer, not on you, and it does not govern liability between you. How much risk you carry is therefore a matter of negotiation. My proposal is usually: liability for your own failure to perform (tekortkoming), with a cap that fits the value of the contract, and no passing on of fines the customer incurs through its own negligence. Do offer something in return: demonstrable measures and quick cooperation in an incident.
Do you have to pass NIS2 requirements on to your own suppliers?
Your customer’s legal duties focus on its direct suppliers (Article 21(3)(d) Cbw, Article 10(2) Cbb); the law says nothing about the level below. You can only keep your promises if your own suppliers keep theirs.
The directive notes that entities “could consider risks stemming from other levels of suppliers” (recital 85). For digital providers, the contract also covers subcontracting (point 5.1.4(g)).
Yes, to the extent you need them to keep your own promises. If you promise your customer that you notify incidents and develop your software securely, your software supplier or hosting provider must do the same. So I use the same core points in the contracts with your own suppliers: security requirements, notification, cooperation with checks and rules on subcontracting. That way you are not caught between a strict customer and a supplier who does not have to do anything.
Example: a US sensor maker and a Dutch food producer
A supplier that is not an entity itself can accept the checks its customer needs and negotiate the rest. This hypothetical NIS2 supplier contract review shows how.
Suppose a US maker of sensors with embedded software supplies a Dutch food processor that is an important entity. A new framework agreement “because of the Cyberbeveiligingswet” asks for a questionnaire, on-site audits at any time at the supplier’s cost, notice of every security event and liability for any fine.
The supplier answers the questionnaire, because the customer must test its direct suppliers (Article 10(2) Cbb). It offers an independent audit report, with on-site audits only after an incident or a clear gap. Notification covers incidents that can affect the customer’s systems. It proposes capped liability with no passing on of fines, and puts the same terms into the contract with its own cloud host.
Hypothetical example, not a case from our practice.
When do you need a Dutch lawyer for NIS2 supply chain terms?
When a Dutch customer presses you to sign a new framework agreement or security schedule, when it is a large share of your revenue, or when you are unsure whether you are an entity.
As soon as there is a new framework agreement or security schedule your customer is in a hurry with, or when a large customer accounts for a substantial share of your revenue. That is the moment to make good arrangements in one go, before there is an incident. I then look at three things: what your customer really needs, where your risk lies and which counterproposal keeps the relationship healthy. If you doubt whether you fall under the Cyberbeveiligingswet yourself, we sort that out first; it determines which requirements you must already be able to meet yourself.
How does MAAK Advocaten work on NIS2 supplier contracts?
MAAK Advocaten N.V., a law firm in Amsterdam, acts for suppliers that receive NIS2 terms from Dutch customers: contract review, negotiation and, if a dispute follows, proceedings at first instance and on appeal.
In the first days we read the schedule and framework agreement, establish whether you or your Dutch subsidiary is an entity, and label each requirement as legal basis or commercial request. We then draft your counterproposal for the NIS2 security schedule negotiation. For software and services, see also IT contracts under Dutch law.
Frequently asked questions about NIS2 and suppliers
Does the Dutch NIS2 law apply to a supplier outside the EU?
Generally only through the contract. The Cyberbeveiligingswet applies to entities established in the Netherlands (Article 4(1) Cbw). A non-EU provider of cloud, data centre or managed (security) services that is itself an essential or important entity, offers those services in the Netherlands and has no representative in a Member State where it offers them, must designate one (Article 42(1) Cbw).
Is my Dutch customer legally required to put NIS2 clauses in my contract?
Not as a general rule. Your customer must have a supply chain security policy and must test and periodically check its direct suppliers (Article 10 Cbb). For certain digital providers, such as cloud and managed service providers, Implementing Regulation (EU) 2024/2690 applies instead, and it lists what their supplier contracts must specify where appropriate.
Since when do the NIS2 rules apply in the Netherlands?
The Cyberbeveiligingswet and the Cyberbeveiligingsbesluit have applied in the Netherlands since 15 August 2026 (Article 35 Cbb). They implement Directive (EU) 2022/2555, which Member States had to apply from 18 October 2024.
When should a non-EU supplier call a Dutch lawyer about NIS2?
A non-EU supplier should call a Dutch lawyer when a Dutch customer presents a new framework agreement or security schedule, when that customer accounts for a large share of its revenue, or when it is unclear whether the supplier or its Dutch subsidiary is an entity itself.
Primary sources
- Cyberbeveiligingswet, Stb. 2026, 187, in force 15 August 2026 (Articles 4, 12, 21, 42, 80, 87 and Annex 2)
- Cyberbeveiligingsbesluit, Stb. 2026, 189, in force 15 August 2026 (Articles 4, 10 and 35)
- Directive (EU) 2022/2555 of 14 December 2022 (NIS 2 Directive), OJ L 333, 27.12.2022 (recital 85, Articles 21, 40 and 41)
- Commission Implementing Regulation (EU) 2024/2690 of 17 October 2024, OJ L, 2024/2690, 18.10.2024 (Article 1, Annex points 5.1–5.2)
Last checked on 1 November 2026 · next relevant date: 17 October 2027 (Commission review of the NIS 2 Directive, Article 40)
Has a Dutch customer asked you to sign NIS2 supply chain terms? Put your situation to me through my page as product law partner in the Netherlands. — Martin Krüger
