NIS2 national profiles: vendor contract clauses your client must verify by jurisdiction

What is being compared

The NIS2 Directive covers 27 member states [src:regime/nis2], but it is a minimum-harmonisation instrument. Each state transposes it into national law, and those national laws vary in ways that directly affect the vendor and supply-chain contract clauses your client needs in place. The differences are not cosmetic. Scope thresholds, the treatment of group-company relationships, reporting windows and the regulator your client faces all shift depending on jurisdiction.

This guide covers seven jurisdictions most commonly raised in client engagements: Germany, the Netherlands, Belgium, Denmark, Sweden, Austria and Ireland. It maps where the national laws diverge and which contractual points those divergences create.

The NIS2 regime documentation set includes a supply chain security policy, incident reporting procedure, asset register and management accountability record, among other documents [src:regime/nis2]. Those documents are the foundation. What varies is which national law gives them their operative context, which regulator will assess them, and whether specific vendor clauses need to reflect local statutory language.

---

Where they differ

Germany

Germany transposed NIS2 as NIS2UmsuCG / BSIG 2025, in force from 6 December 2025, supervised by the Federal Office for Information Security (BSI) [src:nis2_profile/DE].

Entities must register within three months of first qualifying; changes must be notified within two weeks (§33 BSIG) [src:nis2_profile/DE]. Germany creates three entity classes — besonders wichtige Einrichtungen (essential), wichtige Einrichtungen (important), and operators of critical facilities — and §28(3) BSIG permits negligible business activities to be disregarded when classifying [src:nis2_profile/DE]. Vendor contracts should identify which class the client falls into, because the audit and monitoring rights you negotiate need to match that classification.

Incident reporting follows the standard NIS2 cascade: early warning within 24 hours, full notification within 72 hours, final report within one month of the incident notification (§32 BSIG) [src:nis2_profile/DE]. Vendor agreements should contain a corresponding notification obligation that gives your client enough lead time to meet the 24-hour early warning window.

For further background on the registration and reporting clocks specific to Germany, see The German NIS2 clocks a consultant has to track.

Netherlands

The Netherlands transposed NIS2 as the Cyberbeveiligingswet (Cbw), in force from 15 August 2026, supervised by the National Cyber Security Centre (NCSC) via MijnNCSC [src:nis2_profile/NL].

The law designates ministries, provinces, municipalities, water boards and critical entities as essential by law (art. 8) [src:nis2_profile/NL]. Partner and linked enterprises count toward size thresholds [src:nis2_profile/NL]. If a vendor operates shared infrastructure across group entities, that may affect whether a client crosses a size threshold, so confirm the group structure before finalising the scope recital in any vendor agreement.

The law sets no fixed registration date, but changes must be notified within two weeks [src:nis2_profile/NL]. Reports go through MijnNCSC to the sector CSIRT and the relevant supervisor. The final report is due one month after the incident notification [src:nis2_profile/NL]. Vendor contracts should mirror that timeline.

See also The Dutch Cyberbeveiligingswet is in force: what to check now and the broader NIS2: national transposition differences that matter.

Belgium

Belgium transposed NIS2 as the Law of 26 April 2024 (and Royal Decree of 9 June 2024), in force from 18 October 2024, supervised by the Centre for Cybersecurity Belgium (CCB) [src:nis2_profile/BE].

Registration deadlines were early and strict: digital infrastructure and digital providers were required to register by 18 December 2024; all others by 18 March 2025 or within five months of identification (arts. 13–14) [src:nis2_profile/BE]. If your client has not yet registered, that is already past deadline — address it as a gap, not a forward action.

Belgium has a sector-specific rule that vendor contracts must account for: trust service providers are required to notify within 24 hours rather than the standard 72 (art. 35 §2) [src:nis2_profile/BE]. If your client is a trust service provider or relies on one as a vendor, the contract notification chain needs to reflect the tighter window.

When assessing group company size, the CCB considers how independent the entity's network and information systems are (art. 3 §2) [src:nis2_profile/BE].

The final report is due 30 days after the early warning [src:nis2_profile/BE].

Denmark

Denmark transposed NIS2 as NIS 2-loven (Act no. 434 of 6 May 2025), in force from 1 July 2025, coordinated by the Danish Agency for Societal Security [src:nis2_profile/DK].

Denmark's Act is distinctive in stating its own size thresholds directly (§§4–5), rather than cross-referencing the EU Recommendation on SME definitions. Medium entities: 50 or more employees and €10 million in both turnover and balance sheet. Large entities: 250 or more employees, €50 million turnover, €43 million balance sheet [src:nis2_profile/DK]. Because the Act defines thresholds independently, verify those numbers against the Act text rather than assuming equivalence with EU standard definitions.

The Act explicitly carves out entities already covered by the energy preparedness law, the telecom security law or the financial sector rules (FIL §333) — it does not apply where those regimes already govern (§1(2)) [src:nis2_profile/DK]. For a client in one of those sectors, check the sector-specific law before building an NIS2 vendor clause set.

Registration timelines split by entity type: most entities must register within two weeks of coming into scope (§10); digital providers have three months (§9) [src:nis2_profile/DK]. Vendor agreements should be consistent with whichever deadline applies. Early warning, full notification and final report deadlines follow the standard NIS2 cascade [src:nis2_profile/DK].

Sweden

Sweden transposed NIS2 as Cybersäkerhetslag (SFS 2025:1506), in force from 15 January 2026 [src:nis2_profile/SE]. The NCSC at FRA (the Swedish signals intelligence authority) receives registrations and incident reports; that function transferred from the Swedish Civil Contingencies Agency on 1 July 2026 [src:nis2_profile/SE].

Sweden's most significant scoping divergence: all municipalities and regions are in scope regardless of size [src:nis2_profile/SE]. A client that is a municipality or regional body, or that supplies essential services to one, cannot rely on size threshold arguments to escape scope.

As in Belgium, trust service providers must notify within 24 hours [src:nis2_profile/SE]. The registration deadline is expressed as "as soon as possible" (2 kap. 2 §), with changes within 14 days [src:nis2_profile/SE]. Vendor contracts should contain a matching notification chain that works within the 24-hour early warning requirement for trust service scenarios.

Austria

Austria adopted NISG 2026 (BGBl. I Nr. 94/2025) but it does not enter into force until 1 October 2026; NISG 2018 applies until that date [src:nis2_profile/AT]. This matters for current contracts: vendor clauses written now for Austrian clients should reference NISG 2018 as the operative law and flag that NISG 2026 replaces it from 1 October 2026 [src:nis2_profile/AT].

Austria excludes partner and linked enterprise data from size calculations where the entity's network and information systems are independent (§25(4)) [src:nis2_profile/AT].

Registration deadline: entities in scope at entry into force must register by 1 January 2027; entities that come into scope later have three months (§29(3)) [src:nis2_profile/AT]. Incident reporting follows the standard cascade once the law is in force [src:nis2_profile/AT].

For entities with operations in both Austria and another member state, the mismatch between Austria's 1 October 2026 entry into force [src:nis2_profile/AT] and the earlier dates in other jurisdictions creates a transition gap. Vendor contracts that are signed now but intended to run across 2026–2027 should account for it.

Ireland

Ireland has not transposed NIS2. The National Cyber Security Bill has not been enacted. NIS1 continues to apply to existing operators of essential services [src:nis2_profile/IE]. The European Commission referred Ireland to the Court of Justice on 8 July 2026 for failing to transpose [src:nis2_profile/IE].

The practical consequence is that vendor contract clauses referencing NIS2 obligations cannot yet be grounded in Irish national law [src:nis2_profile/IE]. If your client has an Irish entity, NIS1 obligations are the operative contractual baseline. Do not draft NIS2 vendor clauses for an Irish-law contract as though the statute is in force — it is not.

The NCSC has stated that registration and reporting portals will open once the law is in place [src:nis2_profile/IE]. Monitor the bill's progress and build a contract amendment trigger into any multi-year vendor agreement for Irish clients.

For advice on what to tell a client with an Irish entity, see What to tell a client with an Irish entity about NIS2.

---

Which to pick when

The decision tree for vendor contract clause selection starts with jurisdiction, not with the NIS2 Directive text.

If your client's principal establishment is in Germany, use BSIG 2025 language, reference the BSI as supervisor, and build the three-tier entity classification into the audit rights clause [src:nis2_profile/DE]. The 24-hour/72-hour/30-day cascade must appear in any material vendor or subprocessor agreement.

If your client's principal establishment is in the Netherlands, confirm whether partner and linked enterprises push the client above the size threshold before finalising the scope recital [src:nis2_profile/NL]. Check whether any vendor shares infrastructure across group entities in a way that affects that calculation. Register via MijnNCSC.

If your client operates in Belgium and is a trust service provider, the vendor notification chain must support a 24-hour early warning to the client, not 72 hours [src:nis2_profile/BE]. If registration deadlines have passed, treat it as a remediation item.

If your client is in Denmark and operates in energy, telecoms or financial services, verify which sector-specific regime governs before applying NIS2 clauses [src:nis2_profile/DK]. The size thresholds in the Danish Act are stated in the Act itself — do not assume they track EU standard definitions without checking.

If your client is a Swedish municipality or regional authority, scope is automatic regardless of headcount or turnover [src:nis2_profile/SE]. Vendor clauses must reflect that, and if the client uses trust service providers, the 24-hour notification obligation applies.

If your client is in Austria and the engagement spans the October 2026 entry into force date, draft contracts that identify NISG 2018 as the current operative law, include a transition clause referencing NISG 2026, and specify the January 2027 registration deadline as a forward obligation [src:nis2_profile/AT].

If your client has only an Irish entity, do not build NIS2 statutory obligations into the vendor contract [src:nis2_profile/IE]. Use NIS1 as the baseline. Include a review trigger keyed to enactment of the National Cyber Security Bill.

For clients operating across multiple jurisdictions, the most demanding jurisdiction's notification window governs the vendor contract chain. That is currently 24 hours for trust service providers in Belgium and Sweden, against the otherwise standard 72-hour window [src:nis2_profile/BE] [src:nis2_profile/SE]. A single vendor serving clients subject to those obligations should be contractually capable of delivering early warning within 24 hours.

When reviewing vendor agreements for NIS2 purposes, check whether the vendor's supply chain documentation is accessible. IBM, for example, publishes a DPA and a trust page [src:vendor/international-business-machines-corporation-ibm] but does not publish a subprocessor list URL or confirm a data transfer mechanism in its publicly available documentation [src:vendor/international-business-machines-corporation-ibm]. That is a gap worth raising before relying on the vendor for NIS2-covered services.

For related work on scoping and national exceptions, see Who is in NIS2 scope: sectors, size and the national exceptions and NIS2 registration deadlines differ by country. The clocks do not.. For the document set your client will need to prepare, the supply chain security policy and incident reporting procedure are the starting point [src:regime/nis2].