NIS2 in a sales conversation: what the law asks of suppliers, and what it doesn't

NIS2 is the most quoted law in European security sales and one of the least read. The articles themselves are short. Reading them takes an afternoon and removes most of the folklore that ends up in vendor decks, including some that can come back to you as a liability.

The dates in this guide are as of October 2026. National rules keep moving, so check the official sources before you quote them to a customer. This is a guide for sales and marketing, not legal advice.

what NIS2 asks of the customer

NIS2, Directive (EU) 2022/2555, applies to essential and important entities in 18 sectors, through each country’s national law. Article 21 requires member states to make them take risk-management measures, and one of those measures is about you.

• Article 21(2)(d) names “supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers”.
• Article 21(3) tells them to take into account the vulnerabilities specific to each direct supplier, the overall quality of suppliers’ products and cybersecurity practices, including secure development, and the results of coordinated EU supply chain risk assessments.
• Article 23(4) sets incident reporting: an early warning within 24 hours, a notification within 72 hours, and a final report within one month.
• Article 34 requires member states to set maximum fines of at least EUR 10 million or 2% of worldwide turnover for essential entities, and at least EUR 7 million or 1.4% for important entities, whichever is higher. NIS2 also makes management accountable.

what it does not do

This is the half that gets left out.

• It prescribes no assessment method and no contract clauses for suppliers. Each customer decides how to assess you. That is why you get a different questionnaire from every one of them.
• It does not require any product category. No article says “buy PAM” or “buy EDR”. It lists measures, such as access control, incident handling and cryptography, and the organisation chooses how to implement them.
• It does not apply to products. Obligations apply to organisations. A product can support specific measures. It cannot make a company compliant, and “NIS2 compliant” on a datasheet is a claim no article supports.
• It does not fix what suppliers must tell customers about incidents. The 24 and 72 hour clocks bind the entity. What you owe your customer is set by your contract, which is why those clauses are arriving now.

the Polish dates, as of October 2026

Poland transposed NIS2 by amending its National Cybersecurity System Act (KSC). The Ministry of Digital Affairs published the key dates on 10 April 2026:

KSC in Poland: the dates that matter in a sales conversation

3 April 2026Amended KSC in force (Dz.U. 2026 poz. 252)

13 April 2026Register of entities opened

7 May to 3 October 2026Self-registration for entities not entered by the ministry

as of October 2026

3 April 2027End of the adaptation period

3 April 2028First audits due; fines possible, after a warning

Two practical consequences. The first registration window has closed, so a customer that has not registered is late, and the first conversation is about their status, not your product. And whether a given customer is a key or important entity is a legal question for them and their counsel. Do not answer it in a quote.

Other countries moved at different speeds. As of July 2026 the European Commission had referred four member states to the Court of Justice for failing to notify transposition. If you sell across Europe, keep a country table and date every line in it.

how NIS2 shows up in your deals

For a vendor, NIS2 arrives in three forms.

1. As a reason to buy. ENISA’s NIS Investments 2025 report, based on 1,080 organisations in high-criticality sectors, found that 70% name regulatory compliance as the main driver of their security investment. The sample is mostly large companies, but the direction matches what most sellers see: a deadline turns an old problem into this year’s budget line.
2. As a review of you. Article 21 makes your customer assess you as a supplier. Expect questionnaires mapped to Article 21, questions about your secure development practices, and contract schedules with security and incident notification duties. The guide on running the security review in parallel with the POC covers how to handle it.
3. As a contract change. In financial services, DORA goes further. Article 30 lists what contracts with ICT providers must contain, from data locations to audit rights and exit plans, and has applied since 17 January 2025. If you sell software with digital elements, the Cyber Resilience Act adds its own dates: reporting obligations from 11 September 2026, main obligations from 11 December 2027.

what to say instead

The strongest accurate statement is short: NIS2 makes supplier security your customer’s duty, so they will assess you, and here is how your product supports specific measures they must take. Then name the measures and show the evidence.

A useful sales asset is a one-page map: each Article 21 measure in one column, what your product does for it in the next, and what the customer still has to do themselves in the third. Have an engineer review it. The third column is the one that earns trust, because nobody else’s deck has it.

the next NIS2 conversation

When a customer opens with “we need to be NIS2 compliant”, ask: “Which of the Article 21 measures is the gap your auditor or board is worried about?” The answer turns a regulation into a project you can scope.