Does NIS2 Apply to You? If You Have EU Customers, Maybe Already.

---

Why an Australian business would ever need to care about an EU law

NIS2 significantly widened the scope of EU businesses required to manage cyber risk across their own supply chains, and it explicitly makes them responsible for the security posture of their vendors and service providers — wherever those vendors are based. An EU company that’s in scope for NIS2 doesn’t get to say “our supplier is offshore, not our problem.” Their obligation follows the data and the dependency, not the border.

The practical effect: if you sell SaaS to a company operating in the EU, and that company is directly or indirectly in NIS2’s scope (which now covers a much broader range of “important” and “essential” entities than the earlier NIS directive did), their own compliance obligations increasingly require them to push security requirements onto you. That shows up as:

• New clauses in contract renewals asking for specific security certifications
• Vendor security questionnaires that look meaningfully more detailed than they used to
• A customer suddenly asking, out of nowhere, “do you have ISO 27001?”

---

The signal to watch for

You don’t need to interpret EU law yourself to know if this applies to you. Watch for these signals in your own sales and account-management conversations:

1. A renewal or new-deal conversation suddenly asks for a security certification you’ve never been asked for before, especially ISO 27001.
2. An EU customer’s procurement or security team gets looped into a conversation that used to be commercial-only.
3. Contract redlines start including specific supply-chain security clauses — incident notification timeframes, audit rights, subcontractor disclosure.

Any one of these is a reasonable prompt to ask the customer directly: “has your own NIS2 status changed what you need from us?” Most will tell you plainly if you ask — it’s usually not a secret on their end, just something that hasn’t been explained to you yet.

---

Why ISO 27001 is the practical answer either way

You don’t need to become an expert in EU regulatory scope to respond to this. The practical fix is the same regardless of exactly which NIS2 category your customer falls into: ISO 27001 certification is the credential EU procurement and security teams recognise fastest, because it’s the closest thing to a universal answer to “how do we know your security is adequate” that doesn’t require them to interpret your specific compliance posture themselves.

If you’re already fielding more detailed security questionnaires from EU customers than you used to, that’s the signal to get ahead of it — not wait for a deal to stall on a certification you don’t have yet.