NIS2 doesn't apply to UK law, but if you sell into the EU, your customers' NIS2 obligations become your problem in 2026 — this guide covers exactly what to fix first.
Why NIS2 matters if you sell into the EU
NIS2 is Directive (EU) 2022/2555. It replaced the original NIS Directive from 2016 and EU member states had to transpose it into national law by 17 October 2024.
UK companies aren't directly regulated by it — Brexit means the UK sits outside the Directive's jurisdiction. But NIS2 has an Article 21 requirement: in-scope EU organisations must manage cybersecurity risk across their entire supply chain, including suppliers based outside the EU.
That's the part that pulls UK businesses in. If you supply software, IT services, logistics, or any component to an EU energy company, hospital, bank, or digital infrastructure provider, expect a security questionnaire, a contract clause, or an audit request landing on your desk sometime in 2026.
Going through the ISO 27001 gap analysis process before certification is usually the fastest way to find out where you're exposed before a customer finds out for you.
How to prepare for NIS2 directive compliance as a UK supplier
Work through these steps in order — skipping the mapping stage is the most common reason UK suppliers get blindsided by a mid-contract audit request.
- Map which customers are in scope. Identify any EU customer operating in one of the 18 NIS2 sectors — energy, transport, banking, health, digital infrastructure, and others.
- Assess your own supply chain exposure. Use a documented vendor risk management process to see which of your own suppliers would fail an EU customer's due diligence check.
- Get certified against a recognised framework. ISO 27001 or Cyber Essentials gives you a documented control set you can point to instead of rebuilding evidence from scratch every time a questionnaire arrives.
- Update your contracts. Add security clauses and breach notification terms that mirror what your EU customers are now required to demand from their own suppliers.
- Build a fast questionnaire response process. NIS2-driven due diligence requests repeat the same 40-60 questions across customers — answer them once, reuse the evidence.
- Track UK domestic reform. The UK government has proposed a Cyber Security and Resilience Bill to update the existing NIS Regulations 2018 — when it passes, similar supply-chain obligations apply at home, not just for EU trade.
Verdict: if you sell into an EU-regulated sector, treat NIS2 as a contractual requirement now — waiting for a UK law that mirrors it is not a compliance strategy for 2026.
Essential entities vs important entities: what your EU customers face
NIS2 splits in-scope organisations into two tiers. The tier your customer sits in determines how hard they'll push compliance requirements down to you.
| Entity type | Example sectors | Max fine | What it means for you | |---|---|---| | Essential entities | Energy, transport, banking, health, water, digital infrastructure, public administration, space | \u20ac10 million or 2% of global turnover (whichever is higher) | Expect formal audits, contractual security clauses, and proactive supplier vetting | | Important entities | Postal/courier, waste management, chemicals, food, manufacturing, digital providers, research | \u20ac7 million or 1.4% of global turnover (whichever is higher) | Expect security questionnaires and periodic reviews, less proactive audit activity |
A UK supplier selling to an essential entity should assume a stricter, more frequent review cycle than one selling to an important entity — the fine exposure on their end drives how much scrutiny lands on yours.
Why NIS2 preparation effort varies for UK suppliers
Not every UK supplier faces the same workload. The effort scales with a handful of specific factors:
- Which sector your EU customer sits in — critical infrastructure customers (energy, transport, health) push harder terms than lower-tier sectors.
- How deep you sit in the supply chain — a direct contractor faces more scrutiny than a sub-subcontractor three tiers removed.
- Whether you already hold a recognised certification — ISO 27001 or Cyber Essentials shortens due diligence dramatically versus starting from a blank questionnaire.
- Contract renewal timing — customers with contracts up for renewal in 2026 are the ones adding NIS2-driven clauses first.
- Your existing incident reporting process — NIS2 requires fast breach notification; if you don't have a documented process, this is usually the biggest gap.
- Group structure complexity — suppliers operating across multiple entities need multi-entity compliance automation to avoid duplicating evidence collection per subsidiary.
Get audit-ready before the questionnaire arrives
Automate evidence collection for ISO 27001, Cyber Essentials, and SOC 2 in one place.
Frequently asked questions
One last thing
The UK companies getting caught out by NIS2 in 2026 aren't the ones without a security policy — they're the ones with a policy nobody can produce evidence for on demand. A questionnaire response that takes three weeks to assemble loses deals to a competitor that answers in three days.
If your evidence lives in a certification you already hold, standardise how you package it for repeated use — don't rebuild the same answer set every time a new EU customer asks. That's the difference between NIS2 compliance being a recurring cost and being a one-time setup.