Supplier contracts

The KSC act has applied in its amended form since 3 April 2026 and implements NIS2, EU Directive 2022/2555 on cybersecurity. The supply chain means the ICT products, services and processes, that is the hardware, software and IT services, on which your service depends, together with their suppliers. An essential or important entity ensures the security and continuity of this chain, taking into account vulnerabilities, meaning weaknesses in security, and the overall quality of each supplier's products. A supplier outside the scope of the act has no obligations of its own under it, so it receives them written into its contract with you.

A company covered by the act from the day it came into force, 3 April 2026, has until 3 April 2027 to implement its obligations, including those relating to suppliers. This deadline determines which contracts will be renewed in time and which need an amendment.

We start with the list. We collect the contracts with cloud, software, maintenance and servicing suppliers, and with the subcontractors you know of. For each, we note the company service that would stop without it, and assess whether it can be replaced, how quickly and whether the data would come back. We also check whether the supplier is the subject of proceedings to recognise it as a high-risk supplier whose products would have to be withdrawn; so far no such list has been published and no proceedings have been opened against any supplier.

We read every contract against the obligations under the act and note where it is silent or says too little. The requirements fall into four groups. Security at the supplier: how it protects your data, who at the supplier has access to it and how it fixes weaknesses in its own software. Incident reporting: the deadline by which the supplier notifies you of an event on its side, so that your own report can be made on time. Access for verification: how you will confirm that the supplier does what it promised. Exit from the contract: in what form and how quickly you will get your data and documentation back.

For new orders we write a template of requirements for requests for proposal: the same four groups as questions for bidders and as requirements for the future contract. In the directive, security in the acquisition of a new system is a separate requirement, alongside its development and maintenance. Members of our team have legal training: we describe the requirements and check the suppliers, while the wording of contract clauses and legal opinions are prepared by a law firm.

Whether the act covers your company is established by the impact and gap analysis; the company's incident procedure and the safeguards in the system are also separate scopes.

1. We list the suppliers and contracts. We collect the contracts with their annexes and talk to the people who work with the suppliers. Result: a list of suppliers with an assessment of dependency, and a contract calendar.
2. We read the contracts against the obligations. We set each one against what the act requires you to ensure in the supply chain. Result: a review of contracts with requirements described in general terms.
3. We check the suppliers. We ask them about their safeguards, where the data is kept, who has access and how they fix weaknesses, and compare the answers with the contract. Result: an assessment of each supplier with a list of discrepancies.
4. We hand the requirements to the law firm and to you. The law firm puts them into contractual wording, and you receive the template for requests for proposal and the order of negotiations. Result: amendments and renewals ready for negotiation.