Does NIS2 Apply to Your US Company If an EU Customer Puts It in Your Contract?

NIS2 does not regulate a US-based company directly. It regulates EU "essential" and "important" entities — medium and large organizations across energy, transport, healthcare, manufacturing, and digital infrastructure — and one of the ten risk-management measures those entities must implement is supply chain security, applied to their direct suppliers and service providers. If you sell hardware, software, or managed services to an EU manufacturer, hospital system, port operator, or utility, that requirement is arriving in your next contract renewal whether or not you have a single employee in Europe.

On July 8, 2026, the European Commission referred Ireland, Spain, France, and the Netherlands to the Court of Justice of the European Union for failing to notify full transposition of the NIS2 Directive, Directive (EU) 2022/2555, into national law — nearly two years after the October 17, 2024 deadline (Hunton Andrews Kurth, European Commission Refers Four Member States to CJEU Over NIS2 Transposition Delays). The Commission is asking the Court for both a lump-sum penalty and a daily fine running until each country notifies complete transposition. That should end any "NIS2 isn't really happening" argument in a US supplier's compliance function: 23 of 27 member states had fully transposed by mid-2026, and the four laggards now face court-ordered financial pressure to catch up (European Commission, NIS2 Transposition in EU Countries).

Who NIS2 actually regulates

NIS2 covers medium and large entities — broadly, 50 or more employees, or annual turnover above €10 million — in sectors listed across two annexes: energy, transport, banking, healthcare, water, digital infrastructure, and public administration make up Annex I ("essential" when large); manufacturing, digital providers, postal services, and waste management make up Annex II ("important," or "essential" only if large in an Annex I role) (National Cyber Security Centre Ireland, NIS2 FAQ; European Commission, NIS2 Directive). A handful of entity types — trust service providers, DNS providers, top-level domain registries — are in scope regardless of size.

None of that list includes "US-based MSSP" or "American manufacturing supplier." A US company has no NIS2 registration obligation and no direct relationship with a national CSIRT by default. The exception is a narrow Implementing Regulation covering "digital entities" — cloud, data centre, managed service, marketplace, and search providers — that became directly applicable law on October 17, 2024 for providers meeting size and EU-presence tests, supplemented by ENISA Technical Implementation Guidance in June 2025 (DLA Piper, NIS2 Directive Explained Part 3: Supply Chain Security). A US provider with an actual EU footprint should check that regulation directly; one selling into the EU without a footprint of its own is reached a different way — through its customer's contract.

How the obligation actually reaches a US supplier

Article 21 requires every in-scope entity to implement ten categories of cybersecurity risk-management measures, and supply chain security is one of them by name: "security-related aspects concerning the relationships between each entity and its direct suppliers or service providers," weighing each supplier's vulnerabilities and cybersecurity practices (Directive (EU) 2022/2555, Article 21; summarized in DLA Piper, NIS2 Directive Explained Part 3). The directive's recitals go further, encouraging in-scope entities to build cybersecurity requirements into contracts with direct suppliers.

In practice, an EU manufacturer, hospital network, or port authority that owes NIS2 compliance to its own regulator has every incentive to push a version of that obligation onto you contractually — security questionnaires before signature, minimum control requirements in the master agreement, audit rights, and incident-notification clauses timed to its own regulatory clock. You never register with an EU authority. You sign a contract that already assumes NIS2 exists, or you lose the bid to a competitor who will.

This is the same mechanism that makes the Digital Operational Resilience Act (DORA) reach US vendors serving EU banks and insurers without registering them directly — see our DORA compliance guide for US vendors with EU financial clients for the financial-sector version of this pattern. The difference is scope: DORA only reaches financial entities, while NIS2's sector list touches manufacturing, transport, and logistics companies that may not expect a European compliance conversation at all.

The reporting clock your EU customer will expect you to match

Article 23 sets a specific, short sequence for any NIS2-covered entity that experiences a "significant incident": an early warning within 24 hours of becoming aware, a fuller incident notification within 72 hours that includes an initial severity assessment, an intermediate report on request, and a final report no later than one month after the 72-hour notification (Directive (EU) 2022/2555, Article 23; timeline confirmed against the directive text at Springlex, NIS2 Directive Article 23). The competent authority or CSIRT is supposed to acknowledge the early warning within 24 hours as well, with initial feedback and, on request, mitigation guidance.

Your EU customer's 24-hour clock starts when they become aware — usually when you tell them, if your product or service is implicated. A vendor contract that promises notification "promptly" and nothing more forces the customer to build in slack they may not have. Reviewing that clause against a specific hour count, not a vague adverb, is the single highest-value fix in most US supplier contracts we see. We covered the equivalent problem domestically in whether a typical MSSP breach-notification clause meets DFARS, HIPAA, or FTC Safeguards Rule deadlines; the NIS2 version is tighter than any of those three US deadlines.

What actually changed in 2026

Three developments this year move NIS2 from "directive on paper" to enforcement with teeth:

• The CJEU referral (July 8, 2026). Ireland, Spain, France, and the Netherlands went from letters of formal notice (November 28, 2024) to reasoned opinions (May 7, 2025) to an active Court of Justice case in nineteen months, and the Commission is seeking recurring daily penalties on top of a lump sum (Hunton Andrews Kurth).
• Twenty-three of 27 member states fully transposed. The remaining laggards — Spain (partial), Bulgaria, Poland, and Slovenia — are the exception, not the rule (European Commission, NIS2 Transposition Tracker).
• A January 2026 amendment proposal aimed at clarity, not retreat. The Commission's broader cybersecurity package proposed targeted amendments meant to make compliance more manageable — simplification, not a scope rollback (Hunton Andrews Kurth).

A US supplier cannot count on the directive stalling out. The countries furthest behind are now under court pressure to catch up, and the ones already caught up are the ones most of your EU customers answer to today.

What happens if your EU customer gets this wrong — and why that becomes your problem

Article 34 sets maximum administrative fines of at least €10,000,000 or 2% of worldwide turnover for essential entities, and at least €7,000,000 or 1.4% of turnover for important entities, whichever is higher, for Article 21 or Article 23 infringements (Directive (EU) 2022/2555, Article 34; figures confirmed at NIS2-Directive.com, Article 34 text). Those fines land on your customer, not you — but a customer facing that exposure audits its suppliers accordingly, and a supplier that cannot show its own control maturity becomes the audit finding, and eventually the vendor that gets replaced.

A practical playbook for a US supplier with EU customers

1. Inventory which contracts are actually in scope. Any agreement where the customer is an EU entity in a covered sector — not just financial services — is a candidate, regardless of your own company's size.
2. Read your contract language against a 24-hour / 72-hour clock, not an adverb. Replace "promptly" or "without undue delay" with a specific hour count your incident-response process can actually hit, tested against a tabletop exercise before you promise it in writing.
3. Document your subcontracting and sub-processor chain. If you rely on a cloud provider, an offshore analyst team, or a downstream MSSP, your customer's Article 21 supply chain review needs that chain disclosed accurately, not discovered later.
4. Map your controls to a framework your customer's auditor already recognizes. A current SOC 2 Type II report, ISO 27001 certification, or NIST Cybersecurity Framework mapping does not satisfy NIS2 alone, but it gives their compliance team a starting point instead of a blank questionnaire.
5. Confirm whether the Implementing Regulation for digital entities reaches you directly. Cloud, data center, managed service, marketplace, or search infrastructure with an actual EU presence should be checked against that regulation before assuming the contractual path is your only exposure.
6. Track NIS2 and any sector-specific EU regime in parallel, not as overlapping requirements. A manufacturer with an EU financial-services client in a separate line of business may face both NIS2 and DORA at once, each with its own clock.

Where this connects to broader Cyberuptive coverage

NIS2 does not stand alone in the EU regulatory landscape. Financial-sector vendors are more likely to encounter DORA first — see our DORA compliance guide for US vendors with EU financial clients. Vendors with Canadian customers face a parallel flow-down pattern under PIPEDA, covered in what PIPEDA requires of a US-based MSSP serving Canadian clients. A combined NIS2 and DORA readiness program is what our NIS2 and DORA compliance service is built around. Manufacturers and shippers with EU exposure should also see our manufacturing security and shipping and logistics security coverage, and how NIS2's transport-sector reach compares to the US Coast Guard's own Cybersecurity Plan deadline for shippers and terminal operators under 33 CFR Part 101 Subpart F.

Frequently asked questions about NIS2 and US suppliers

Does NIS2 apply to my US company if we sell to a single EU manufacturer or hospital?

Not directly under NIS2's own scope, which covers EU essential and important entities, not their suppliers. But your contract with that EU customer is the mechanism the directive expects to carry supply chain security requirements down to you, and your customer's own regulator can examine how that contract performs in practice.

What exactly changed with the July 2026 Court of Justice referral?

The European Commission referred Ireland, Spain, France, and the Netherlands to the Court of Justice on July 8, 2026 for failing to notify full NIS2 transposition, nearly two years after the October 17, 2024 deadline. The Commission is seeking a lump-sum penalty plus a daily fine running until each country completes transposition.

Which countries have fully transposed NIS2 as of 2026?

Twenty-three of 27 EU member states had fully transposed NIS2 by mid-2026, according to the European Commission's transposition tracker. Spain has partially transposed, and Bulgaria, Poland, and Slovenia had not yet fully transposed as of that tracking period.

What incident reporting timeline should I build into my contract?

Match NIS2 Article 23: an early warning within 24 hours of becoming aware of a significant incident, a fuller notification with an initial severity assessment within 72 hours, and a final report no later than one month after that 72-hour notification. Building your own SLA around vague language like "promptly" leaves your EU customer unable to meet its own regulatory clock.

Is a SOC 2 report enough to satisfy an EU customer's NIS2-driven questionnaire?

No single existing certification fully satisfies NIS2's contractual and risk-management expectations on its own, but a current SOC 2 Type II report, ISO 27001 certification, or documented NIST Cybersecurity Framework mapping gives your customer's compliance team a recognized starting point that speeds up their own due diligence.

How is NIS2 different from DORA for a vendor serving both financial and non-financial EU clients?

DORA is sector-specific to EU financial entities and their ICT providers. NIS2 is broader, reaching essential and important entities across energy, transport, healthcare, manufacturing, and digital infrastructure, with a separate incident-reporting timeline. A vendor with clients in both categories needs to track both frameworks independently rather than assuming one substitutes for the other.

Could my company become directly regulated under NIS2 instead of just contractually affected?

Yes, in one case. The NIS2 Implementing Regulation for "digital entities" — cloud, data centre, managed service, marketplace, and search providers — applies directly to providers meeting size and EU-presence tests, independent of any customer contract. A US provider with EU infrastructure or an EU-established subsidiary in one of those categories should check that regulation directly.

References

• Directive (EU) 2022/2555 (NIS2), EUR-Lex
• European Commission — NIS2 Transposition in EU Countries
• European Commission — NIS2 Directive
• Hunton Andrews Kurth — European Commission Refers Four Member States to CJEU Over NIS2 Transposition Delays
• National Cyber Security Centre Ireland — NIS2 FAQ
• DLA Piper — NIS2 Directive Explained Part 3: Supply Chain Security
• Springlex — NIS2 Directive Article 23 (incident reporting)
• NIS2-Directive.com — Article 34 (administrative fines)