- 2026-09-11
NIS2 can apply directly to a non-EU company that provides services within the European Union in a covered sector. More often, a non-EU company meets NIS2 indirectly: through the supply chain security obligations of an EU customer, arriving as a contract clause rather than as a regulatory notice.
When does NIS2 apply directly to a non-EU company?
Direct application follows from providing services inside the European Union in a sector NIS2 covers, not from where a company is incorporated. NIS2 also requires certain categories of entities established outside the Union to designate a representative within it. Whether a specific company falls into those categories is a legal determination, not a self-assessment.
How does the obligation travel through the contract chain?
NIS2 requires covered entities to address security in their supply chains as part of their own risk management measures. That requirement does not create a duty for the vendor under NIS2. What it creates is a commercial duty: the EU customer has to be able to evidence supply chain security, so the customer passes requirements down into vendor contracts.
The practical consequence is that a vendor can face NIS2-shaped obligations without ever being a regulated entity. The obligation reaches the vendor through procurement, not through a supervisory authority.
Where does this question usually come from?
Rarely from curiosity. We hear some version of "does this actually apply to us" early in scoping conversations with clients in the United States and Israel who are building cybersecurity teams in Europe.
The trigger is almost always downstream. A customer contract names NIS2 or DORA. A procurement questionnaire asks about incident notification timelines. A vendor-risk process requests evidence the company has never had to produce before. By the time the question reaches a scoping conversation, someone has already asked the company to prove something.
What does NIS2 scope mean when building a team in Europe?
Two things follow for team design. First, someone has to own regulatory questionnaires as a named responsibility rather than as an interruption to engineering work. Second, incident notification capability becomes a contractual asset: a vendor that can meet an EU customer's reporting timeline is easier to buy from than one that cannot.
Whether NIS2 reaches a specific company depends on the services provided, the member state involved, and the contracts in place. This text describes how the requirement travels and does not assess any reader's position. Confirm scope with qualified legal counsel before acting on it. Regulatory context in the pillar article on cybersecurity regulation across Europe.
