NIS2 does not end at registration: cybersecurity belongs in supplier contracts

Registration with the National Security Authority is only the beginning for an essential service operator. Within twelve months, it must adopt security measures extending well beyond its own infrastructure. Cybersecurity Act No. 69/2018 Z. z. expressly requires security to reach supplier contracts. Operators registered under the rules in force before 2025 may, until 31 December 2026, comply with the measures under the previous regulations as well, as permitted by § 34b(5) of the Act. Does NIS2 apply to us? addresses scope; this article covers what follows registration.

A supplier agreement is mandatory

The operator must conclude a specific agreement with anyone carrying out, for it, activities directly related to the security of its networks and information systems.

Unofficial English translation:

Where an essential service operator carries out through a third party an activity directly related to the availability, confidentiality and integrity of its networks and information systems, it must conclude an agreement ensuring compliance with security measures and notification obligations under this Act throughout that activity; a risk analysis is performed when concluding the agreement.

— § 19(2) of Act No. 69/2018 Z. z.

The exception applies only if the supplier is itself an essential service operator or the activity’s risk is low (§ 19(3)); low risk should be supported by risk analysis rather than intuition. Supply chain security is also a mandatory measure under § 20(2). Decree No. 227/2025 Z. z., § 7(2), lists what the agreement contains in particular: a commitment to comply with and expressly accept the operator’s security policies, the scope and method of controls and audits, and the duty to inform about incidents and cooperate in resolving them. The National Security Authority publishes a model agreement. Older agreements concluded by the end of August 2025 remain in force at most for the term originally agreed, but if they do not comply with these requirements, they cannot be extended after 31 August 2025 (§ 8 of the Decree).

Flowing obligations down to subcontractors

The contractual chain does not stop at the first supplier. If subcontractors access your systems or data, we recommend flowing the obligations down to them contractually too. Supplier contracts should therefore cover:

• Incident reporting: recipient, channel and deadline. Under § 24(3), the operator reports a serious cybersecurity incident without undue delay: an early warning within 24 hours at the latest and a notification within 72 hours at the latest of becoming aware of it (a trust service provider also submits the notification within 24 hours). Supplier deadlines should therefore be shorter, with “awareness” clearly defined.
• Controls and audits: the operator’s right to verify supplier compliance, including scope, method and cost allocation.
• Remediation SLAs: response times for vulnerabilities and incidents, round-the-clock escalation contacts and recovery assistance.
• Termination and continuity: exit plans, data and configuration handover, and continuation of licences needed after termination. The Act also expressly states that concluding such an agreement must not hinder competition (§ 19(2)).

The supplier’s perspective

If you provide IT services to an essential service operator, such an agreement will eventually arrive, drafted from the customer’s perspective. Watch four areas. First, incident reporting deadlines materially stricter than statutory periods without defining when an incident is discovered. Second, result-based liability potentially excluding relief under § 374 of the Commercial Code. Third, uncapped contractual penalties: courts may reduce them under § 301, but relying on that is no strategy; put a cap in the contract. Finally, unilaterally changeable security policies: if the customer can tighten them at any time, the supplier needs a corresponding right to adjust pricing or refuse changes materially increasing costs.

Putting the arrangements in place

Our NIS2 and cybersecurity service covers obligations and supplier agreements. We incorporate requirements into service agreements with SLAs and implementation agreements. For multiple suppliers, contract oversight keeps the chain aligned. Review supplier contracts before the first incident.