Software Lantern

For system integrators

As an integrator, you can sit on both sides of these rules: like a machine builder, your own remote-access practices may be assessed by in-scope customers under NIS2's supply-chain rules, and depending on exactly what you supply, you may also face product- level obligations directly.

● in force · ○ upcoming · checked against the sources above on 19 October 2026.

Where you sit

If you install or service connected equipment at a customer's site, your remote- access practices are exactly what an in-scope customer is expected to assess about you under NIS2 Article 21(2)(d), whether or not your own company is itself in NIS2's scope. Your own organizational NIS2 status depends on your company's size and sector, same general thresholds as everyone else.

If you modify, rebrand, or substantially integrate equipment such that you're effectively placing a new product on the market, the Cyber Resilience Act's and Machinery Regulation's manufacturer obligations can apply to you directly, not just to the original builder. Confirm your specific situation with a qualified advisor.

Check your situation →