NIS 2 (Directive (EU) 2022/2555) can reach a company with no EU office: its scope covers medium-sized or larger entities in 18 sectors that provide services in the Union. Only cloud, data-centre, managed-service and other listed digital providers must also name an EU representative (Article 26(3)).
Suppliers that are not themselves in scope are not regulated by NIS 2. Its duties reach them through their EU customers' contracts. This guide is for CISOs and contract managers at Gulf digital providers and suppliers.
Which NIS 2 duties reach a company outside the EU?
Member States had to apply NIS 2 through national laws from 18 October 2024, and Article 5 lets them go further.
Size does not matter for some types: Article 2 brings in DNS providers, TLD registries and domain registration services of any size.
| Situation | Does NIS 2 apply directly? | EU representative? | Whose rules? | What to have ready |
|---|---|---|---|---|
| Cloud, data-centre, CDN, managed or managed security service provider (medium-sized or larger) or DNS provider (any size), serving the EU with no EU office | Yes | Yes, Article 26(3) | Your representative's Member State, plus Implementing Regulation (EU) 2024/2690 | Written mandate, registration, Annex measures, 24-hour, 72-hour and one-month reporting |
| The same provider with an EU establishment | Yes | No | Member State of main establishment (Article 26(2)) | As above |
| Online marketplace, search engine or social network serving the EU, no EU office | Yes | Yes, Article 26(3) | As the first row | As the first row |
| Other Annex I or II entity, for example manufacturing or postal, serving the EU with no EU office | Depends on national law | No rule today. Proposed for all such entities | National law of each Member State concerned | A scope assessment per Member State |
| Supplier to an EU essential or important entity, not itself in scope | No | No | Your customer's contract | Questionnaire answers and incident, audit, vulnerability and subcontractor clauses |
For the listed digital providers, whether you offer services in the EU is a test of intent. Recital 116 says a website reachable from Europe, an email address or content in your home language is not enough. A Member State's language or currency with the option to order, or mention of EU customers, can be.
The fourth row is the grey area. Article 26 has a representative rule only for the listed digital types, so for other non-EU entities the answer depends on each Member State's national law.
Check the definitions before choosing the last row. Article 6 defines a managed service provider as anyone installing, managing, operating or maintaining a customer's ICT products, networks, infrastructure or applications, on site or remotely. A Gulf IT outsourcer doing that for EU clients may belong in the first row.
Who needs an EU representative, and what does it change?
Article 26(1)(b) lists the digital types: those in the first and third table rows, plus TLD registries and domain registration services. One of these that offers services in the EU without an establishment there must designate a representative in a Member State where it offers them (Article 26(3)).
It then falls under that state's jurisdiction. With no representative, any Member State where it provides services may take legal action against it. Recital 116 says the designation is a written mandate covering your NIS 2 duties, including incident reporting.
By 17 January 2025, these providers had to give the competent authority their details for the ENISA registry, including the representative's address and contacts (Article 27).
All of them except domain registration services are also bound directly by Implementing Regulation (EU) 2024/2690, in force since 7 November 2024. Its Annex sets the Article 21 measures in 13 sections. Where a point says "where appropriate" and you do not apply it, you must record why. Compare it with ISO/IEC 27017 cloud controls.
The Regulation also defines when an incident is significant, which starts the 24-hour clock. One trigger is an actual or potential direct financial loss above EUR 500,000 or 5% of annual turnover, whichever is lower.
What will EU customers put in your contracts?
Article 21(2)(d) makes every essential and important entity manage supply chain security, including its relationship with each direct supplier. Article 21(3) makes it weigh each supplier's specific vulnerabilities and secure development practices. Recital 85 encourages security terms in supplier contracts.
For digital-provider customers, Annex point 5.1.4 of the Regulation lists the terms their supplier contracts specify, where appropriate.
- (a) cybersecurity requirements, and (b) staff awareness, skills, training and, where appropriate, certifications
- (c) background checks on your staff
- (d) notifying the customer without undue delay of incidents that present a risk to it
- (e) a right to audit, or to receive audit reports
- (f) handling vulnerabilities, and (g) subcontracting rules that flow the requirements down
- (h) retrieval and disposal of information when the contract ends
Your customer owes an early warning within 24 hours of becoming aware of a significant incident, and a notification within 72 hours (Article 23(4)). Agree a notification time you can actually meet.
Questionnaires will arrive too. The Commission says Article 21(2)(d) has led entities to send suppliers varied questionnaires, a significant burden. Much of the evidence can come from an information security management system, as our guide to ISO/IEC 27001:2022 explains.
How does this compare with Saudi NCA ECC-2:2024?
The National Cybersecurity Authority's ECC-2:2024 controls apply to Saudi government bodies, their affiliated companies inside and outside the Kingdom, and private owners, operators or hosts of critical national infrastructure.
Control 4-1-2 asks third-party contracts to include, at least, non-disclosure, secure data removal at the end of service, incident communication procedures and a duty to apply the entity's cybersecurity requirements. That overlaps with points (a), (d) and (h) of the EU list.
Control 4.1.3.2 requires managed security operations centres that use remote access to be fully located in the Kingdom. A Gulf MSSP with Saudi government or critical-infrastructure clients and EU NIS 2 clients will face both sets of terms, and the in-Kingdom rule may shape how it serves EU clients.
Treat this as a parallel, not equivalence. We found no arrangement under which meeting either regime counts towards the other.
How are NIS 2 fines set, and who is enforcing so far?
Many pages say NIS 2 fines go "up to EUR 10 million or 2%". That misreads Article 34. For essential entities, each Member State's maximum fine must be at least EUR 10 million or 2% of worldwide annual turnover, whichever is higher. For important entities the floor is EUR 7 million or 1.4%.
National law can set higher maximums. Management bodies must approve and oversee the Article 21 measures and can be held liable (Article 20(1)). Where earlier measures fail at an essential entity, authorities can ask a court to bar a chief executive or legal representative temporarily from managerial functions (Article 32(5)).
The Commission's published enforcement so far targets Member States. After letters of formal notice in November 2024 and reasoned opinions in May 2025, it referred Ireland, Spain, France and the Netherlands to the Court of Justice on 8 July 2026. It asked for a lump sum and daily penalties, and said most Member States had complied. If your representative or customers sit in one of those four, check national law there.
What could change under the pending NIS 2 proposals?
EUR-Lex lists no amending act in force for NIS 2. Two amendments are proposed, not law.
COM(2026) 13, proposed on 20 January 2026, would replace Article 26(3). Every non-EU essential or important entity offering services in the Union would need a representative, not only digital providers. A Gulf logistics, postal or manufacturing business with EU customers should track it.
It would also have the Commission issue guidelines to prevent entities passing undue obligations on to suppliers that are not in scope. Member States would have 12 months to transpose it. On 4 October 2026 it was awaiting a committee decision in Parliament, with a draft report dated 24 September 2026.
COM(2025) 837, the Digital Omnibus of 19 November 2025, would add Article 23a: a single ENISA entry point for incident reporting. The Commission says the reporting duties themselves would not change. We found no expected adoption date for either.
How AGS can help
Two kits cover NIS 2 in editable Microsoft Word and Excel files, with PowerPoint in the training package. Neither acts as an EU representative.
- NIS 2 Directive Cybersecurity Management System: 305 documents, with a clause-by-clause compliance matrix, a Main Establishment Determination Form that records a representative designation, a Supplier and Indirect Exposure Assessment and Supplier Contract Security Clauses.
- NIS 2 Management Body & Cybersecurity Awareness Training Package: 360 documents for Article 20 board training and staff awareness.
Frequently asked questions
Does appointing an EU representative protect our company from enforcement?
No. Article 26(4) says designating a representative is without prejudice to legal action against the entity itself.
Is a small Gulf DNS or domain registration provider outside NIS 2?
Not on size alone. COM(2026) 13 proposes removing micro and small DNS providers, but that is not law.
How often must board members be trained under NIS 2?
The Directive requires members of management bodies to follow training (Article 20(2)) but sets no frequency or duration. Any annual rule comes from national law, so check the Member State that supervises you.
AGS provides independent documentation toolkits. This guide and the referenced kits are not affiliated with, endorsed by or approved by the European Commission, ENISA, the National Cybersecurity Authority or any national authority. It is general information, not legal advice.
Reviewed October 2026. Facts checked against the sources current at publication.
