NIS2 abroad: is the law the same in every EU country?
No, not entirely. NIS2 is a European directive, and a directive works differently from a regulation. A regulation such as the GDPR applies directly and verbatim in all Member States. A directive such as NIS2 sets out an objective and a framework, but each country must transpose it into its own national legislation. As a result, the precise rules, the terms used and the method of supervision can differ from country to country, even though the starting point is the same everywhere.
For a business that supplies customers in multiple countries, or that has its own establishments abroad, this means that a questionnaire from Germany may use different wording than a questionnaire from France or Belgium, even though both are based on the same European directive. What is called a mandatory measure in one country may fall under a slightly different heading in another country. This is neither a mistake by your customer nor a mistake by you: it is a consequence of how a directive works legally.
What stays the same, what differs
The core of NIS2 is established at European level: which sectors may fall under the directive, what kind of cybersecurity measures are expected, and that a form of supervision will be introduced. This basis is the same starting point in all Member States.
What differs is mainly in the implementation. Each country appoints its own supervisory authority, with its own name and its own working methods. The way in which a business must report, the precise wording of obligations, and national penalty schemes can also vary from country to country. Some countries have also chosen to transpose the directive more broadly or slightly more strictly than the European minimum, within the scope that the directive allows for this.
In practice, this means that a Dutch supplier delivering to a German or Spanish customer may receive a questionnaire that is structured slightly differently from a comparable Dutch list. The underlying question — can you demonstrate that you are doing something about cybersecurity — is usually comparable. The form in which that question is asked is not always the same.
What this means for your own supply chain file
For the business that answers the same type of questions dozens of times a year, the distinction between the European core and the national implementation is mainly relevant from a practical perspective. The evidence you provide — a policy, an overview of measures, a statement on access control — can essentially remain the same, even if the questioning varies from country to country. It is the translation into the customer's format that can change from country to country, not necessarily the content of what you have already documented.
This is also where a central supply chain file shows its value: document the underlying information once, and use it again for each questionnaire, regardless of which country the customer is in or what specific national law is behind the question. the knowledge base with explanations by subject indicates per theme which information is usually requested, so that you do not have to find out again for each country what is different.
Whether NIS2 in the national form of a particular country specifically applies to your business, and what precise obligations follow from it, is set out in that country's own legislation and with the supervisory authority designated there. For the Dutch situation, you can check this with the competent supervisory authority or a lawyer familiar with cross-border NIS2 matters; we do not assess that situation and do not provide an opinion on it.
First see where you stand roughly
If you are not sure whether the questions you receive about cybersecurity are related to NIS2, or simply stem from your own customer's policy, it helps to first have a brief overview of what is usually asked and why. get a first indication in a few questions shows which topics may be relevant to your situation, without this being a judgment on your compliance.
For anyone who wants to know exactly where the information on supplia.eu comes from and how it is maintained, that is explained on the page on how the information is created. If you still have doubts after reading about a specific term or situation, you will find additional explanations in the frequently asked questions about questionnaires and supervision.
If you want to know how this kind of country differences play out in practice with your own customers, do the free quick-scan or browse through the knowledge base. This way you quickly see which topics apply to your company, without having to research all national regulations yourself first.