NIS2 supply chain and remote access, explained

Last updated: October 19, 2026

NIS2 Article 21(2)(d) requires an in-scope entity to assess the cybersecurity of its suppliers, including a machine builder or integrator with remote access into its systems. It does not name or require any specific product, technology, or vendor for that access.

What NIS2 requires (Article 21(2))

Directive (EU) 2022/2555 (“NIS2”), Article 21(2), requires in-scope entities to take minimum cybersecurity risk-management measures. Verbatim:

“The measures referred to in paragraph 1 shall be based on an all-hazards approach that aims to protect network and information systems and the physical environment of those systems from incidents, and shall include at least the following: (a) policies on risk analysis and information system security; (b) incident handling; (c) business continuity, such as backup management and disaster recovery, and crisis management; (d) supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers.”

Point (d), supply chain security, covers a machine builder or integrator with remote access into its customer's systems. Source: Directive (EU) 2022/2555, Art. 21(2)(d), checked 19 October 2026

What NIS2 does not require

NIS2 does not specify any particular technology. It does not name a required product, architecture, or vendor, for remote access or anything else. It requires “appropriate and proportionate” measures and leaves the specific implementation to the entity, based on its own risk assessment.

Who this actually reaches

• If a machine builder or manufacturer is itself in scope (generally: medium or large, in machinery and equipment manufacturing, which NIS2's Annex II, point 5(d) names directly), it generally has “important entity” status (Directive (EU) 2022/2555, Art. 3(2)) and has its own direct obligations under Article 21(2), including assessing its own suppliers.
• Separately, if a machine builder's customer is in scope, that customer has its own obligation to assess the machine builder's security practices as a supplier with system access. This can create commercial pressure on the machine builder, even when it is generally outside NIS2's direct scope on size. That pressure is contractual and commercial, not a separate legal requirement under NIS2 itself.

Source: Directive (EU) 2022/2555, Annex II, point 5(d). Wording cross-checked against published copies, 19 October 2026. · Source: Directive (EU) 2022/2555, Art. 3(2), checked 19 October 2026

NIS2 across the Netherlands, Belgium, and Luxembourg

NIS2 is a Directive: each country transposes it into its own national law, on its own date.

Netherlands – Cyberbeveiligingswet, Staatsblad 2026, 187 and 189 (Art. 35):

“De Cyberbeveiligingswet en dit besluit treden in werking met ingang van 15 augustus 2026.”

Our translation: “The Cyberbeveiligingswet and this decree enter into force as of 15 August 2026.”

Source: Staatsblad 2026, 187 and 189 (Art. 35), checked 19 October 2026

Belgium – Law of 26 April 2024 (Moniteur belge), Art. 98:

“La présente loi entre en vigueur le 18 octobre 2024.”

Our translation: “This law enters into force on 18 October 2024.”

Source: Law of 26 April 2024 (Moniteur belge), Art. 98, checked 19 October 2026

Luxembourg – Legilux gazette record, Loi du 5 mai 2026 (Mémorial A225):

• Signature: 5 May 2026
• Publication: 6 May 2026
• Entry into force: 10 May 2026
• Parliamentary document: No 8364

Source: Legilux gazette record, Loi du 5 mai 2026 (Mémorial A225), checked 19 October 2026 · Chamber of Deputies summary of bill No 8364 (transposition of Directive (EU) 2022/2555)

Check your own situation

Use the checker, or go directly to your country's own official tool, which covers every sector (this guide and the checker only cover machine builders, operators, and integrators):

• NIS2 Zelfevaluatie (Rijksoverheid / RDI) (Netherlands)
• NIS2 scope test (Centre for Cybersecurity Belgium) (Belgium)

Related guides

What “proportionate” means under NIS2 and Preparing to answer a customer's security questionnaire.

This is a general guide based on published sources, not legal advice. Confirm your specific obligations with a qualified advisor.