NIS2 for a company outside the EU: what the directive asks and what clients ask
NIS2 compliance for non-EU companies comes through two doors: the directive itself, if you provide certain digital services in the EU, and your EU clients, who must manage the security of their suppliers. We work out which door is yours, prepare the measures and documents your clients or an EU authority will ask for, and keep the scope tied to what the text actually says.
NIS2 applies directly to non-EU companies in a defined set of digital services when they serve the Union: cloud and data centres, CDNs, MSPs and MSSPs, DNS, domain registration, online marketplaces, search engines and social networks. Other non-EU companies usually meet NIS2 through contracts with clients that fall under it.
The directive covers entities of the types in Annexes I and II that qualify as medium-sized enterprises or larger under Recommendation 2003/361/EC and provide services or carry out activities in the Union (Art. 2(1)). Some types are covered regardless of size, among them trust service providers, top-level domain registries and DNS service providers (Art. 2(2)).
Two doors
Direct. Article 26(1)(b) places cloud providers, data centres, CDNs, MSPs, MSSPs, DNS providers, TLD registries, domain registration services, online marketplaces, search engines and social networks under the jurisdiction of their main EU establishment. With no EU establishment and services offered in the Union, the company designates a representative (Art. 26(3)).
Through clients. An EU client under NIS2 must manage supply chain security (Art. 21(2)(d)). Its requirements reach you through the contract, the questionnaire and audit rights.
NIS2 representative in the EU: who needs one
A representative is needed by a digital provider on the Article 26(1)(b) list that has no EU establishment and offers services in the Union. It is designated in one of the Member States where the services are offered, and the company then falls under that state's jurisdiction.
Without a representative, any Member State where the company provides services may take legal action against it for infringing the directive (Art. 26(3)). For the same provider types, Commission Implementing Regulation (EU) 2024/2690 of 17 October 2024 sets the technical and methodological requirements of the Article 21(2) measures and specifies when an incident counts as significant.
Our part
We establish whether your service falls into one of the Article 26(1)(b) types and prepare the measures and documents Regulation 2024/2690 requires. You designate the representative; the contract with it and the legal assessment of your status come from a lawyer.
NIS2 supply chain requirements that EU clients pass on
An EU client under NIS2 has to take into account each direct supplier's vulnerabilities and the quality of its products and cybersecurity practices, including secure development. That is why it asks you for a description of measures, evidence and audit rights.
Article 21(3) requires an NIS2 entity to assess the specific supplier: its vulnerabilities, product quality, cybersecurity practices and secure development procedures. In practice: a questionnaire, a security annex, notification deadlines and an audit clause.
Financial clients
If your client is a bank, payment institution or e-money institution, DORA applies to it in place of NIS2: Article 4 of NIS2 gives priority to sector-specific EU acts with equivalent requirements. Article 30 of DORA then sets the contract terms.
NIS2 Article 21 measures: ten points in plain words
Article 21(2) lists ten groups of measures: risk analysis, incident handling, business continuity, supply chain security, secure development, effectiveness assessment, cyber hygiene and training, cryptography, HR security and access control, and multi-factor authentication. Management approves the measures and answers for them (Art. 20).
The measures have to be proportionate to the risks, the entity's size and the likelihood of incidents, taking into account the state of the art and European and international standards (Art. 21(1)). Members of the management body approve the measures, oversee their implementation, can be held liable for infringements and must follow training (Art. 20).
We map what you already run, such as ISO/IEC 27001 controls, against Article 21(2), close the gaps and collect evidence for each point.
NIS2 incident reporting deadlines and national laws
For a significant incident an NIS2 entity sends an early warning within 24 hours, an incident notification within 72 hours and a final report within one month of the notification. The exact procedure comes from the national law of the Member State that has jurisdiction over you.
Member States had to adopt national measures by 17 October 2024 and apply them from 18 October 2024 (Art. 41). Several were late: on 8 July 2026 the European Commission referred Ireland, Spain, France and the Netherlands to the Court of Justice for failing to notify full transposition. We therefore check requirements against the national law of the relevant country on the day work starts.
NIS2 provisions that reach companies outside the EU
Requirement
What it means
Source
Medium-sized and larger entities of Annex I and II types serving the Union (Art. 2(1))
Size and service type decide whether you are in scope directly
A written finding on whether NIS2 reaches you directly, through clients or neither, with article references
A map of your measures against Article 21(2) and, for digital providers, against Regulation 2024/2690
An evidence pack for EU clients and an incident notification procedure with deadlines
A gap plan with owners and dates
What we need from you
A description of your services, EU clients and the countries you serve them in
Questionnaires and contract requirements clients have already sent
Time from your IT owner and, where you have one, your lawyer
A signed scope letter
Boundaries
A lawyer or the competent authority gives the final word on whether the directive applies; we prepare the technical and organisational finding
You designate the EU representative; that role stays outside our work
Your company files notifications with the CSIRT or authority
The national authority of the Member State with jurisdiction checks compliance
Risks of handling NIS2 alone, with a chatbot or a freelancer
On your own
The company decides the directive is irrelevant because the office is outside the EU. Six months later a client questionnaire cites Article 21 and wants answers in two weeks.
Chatbot
It blends the directive with national laws and drafts. An applicability finding without article references is useless with a client or an authority.
Freelancer
Sells a generic NIS2 policy pack that skips Regulation 2024/2690, the part a cloud or MSP client asks about.
Frequently asked questions
It applies directly to the digital providers of Article 26(1)(b) when they serve the Union: cloud providers, data centres, CDNs, MSPs and MSSPs, DNS providers, domain registration services, online marketplaces, search engines and social networks. They need an EU representative. Other non-EU companies usually receive NIS2 requirements through contracts with clients that fall under the directive.
You do if your service is one of the Article 26(1)(b) types, you have no establishment in the EU and you offer services in the Union. The representative is designated in one of the Member States where you offer services. Without one, any of those states may take legal action against the company. We determine whether your service is covered; a lawyer handles the designation and the contract.
A description of measures along the Article 21(2) points: access and multi-factor authentication, incident handling and client notification deadlines, backups, secure development, vulnerability handling and your own suppliers, often with evidence and audit rights. We build the answer base once and reuse it for every client.
EU banks, payment institutions and e-money institutions work under DORA: Article 4 of NIS2 gives priority to sector acts with equivalent requirements on measures and notification. If you supply such an institution, the requirements come under DORA through its contract and questionnaire. With both financial and non-financial clients, you need both requirement maps.
Article 23(4) requires an early warning within 24 hours of becoming aware of a significant incident, an incident notification within 72 hours and a final report no later than one month after the notification. The recipient and the form depend on the national law of the Member State with jurisdiction. We prepare a procedure with a deadline table for each country you operate in.
The price depends on whether NIS2 reaches you directly or through clients, the number of countries and services, how many measures already run and how many questionnaires need closing. After a paid 30-minute consultation we fix the scope and the price in a scope letter. The price is fixed, and clients' follow-up questions on the answers we prepared are included.
