Across the markets we work in, NIS2 has moved from a future concern to a present one. It's a single EU directive, but it only takes effect once each country has written it into national law, and member states have moved at very different speeds. In two of them, it is already in force: Germany, since 6th December 2025, and Greece, since November 2024.

Close behind is France, where NIS2 has been folded into a broader resilience law. Ireland has not passed its law yet, but its National Cyber Security Centre is already acting as the regulator.

While these laws take effect on different dates — some already passed, some still to come — the destination is the same: every one of these markets is heading to full NIS2 enforcement.

The channel has spent the past year preparing for this reality, but unfortunately, a lot of that effort has been misplaced. Much of the conversation I hear treats NIS2 explicitly as a sales opportunity — selling compliance, audit, and security products and services.

That instinct isn't wrong: there is a commercial opportunity here. But the full picture is that NIS2 has broader implications for the channel itself, and partners and MSPs need to understand that before they rush to sell. Because NIS2 pulls partners into their customers’ compliance posture and has them assessed as suppliers, your own security is being checked.

The obligation that arrives through procurement

Of course, none of this is new on paper. The supply-chain duty has been in NIS2 since 2022. What's changed is that as each country writes the directive into law, it has gone from text on a page to something your customers must now act on.

Article 21 requires organizations covered by the law to manage the security of their supply chain, including the security of their direct suppliers and service providers. In other words, a company is now responsible for the security of its suppliers, as well as its own. The European Commission has gone further and set out detailed rules on how this should work for digital providers, including Managed Service Providers (MSPs).

So, for the channel, the consequences directly affect you. If your customer is covered by NIS2 — a hospital, an energy company, a bank, a government body, a large manufacturer — its obligations do not end with its own systems. They extend to the suppliers it relies on. The customer now must assess and record the security of those suppliers, and a reseller with access to its systems, or an MSP managing part of its IT, is exactly the kind of supplier the law has in mind. If your customer falls under NIS2, part of that compliance burden now lands on you.

Belgium’s national cybersecurity authority has told any organization that might sit in the supply chain of a covered customer to meet a baseline security standard and has confirmed that a covered customer can require a particular standard from its suppliers through the contract. Irish guidance says the same in commercial language: suppliers of hardware, software and IT services should expect to prove they meet their customers’ NIS2 requirements.

So how might this look? For a partner, your interaction with NIS2 may be in the form of a request from a customer. To meet its own obligations, that customer has to be confident its suppliers are secure, so it starts asking you to prove it. A security clause appears in the contract. The service-level agreement gains tighter terms. You receive a supplier security questionnaire that has to be completed before the deal can close.

None of this stops at the EU's borders. The UK left the EU before NIS2 existed, so while the directive does not bind UK companies directly, the obligation travels through the supply chain regardless. A UK reseller or MSP that supports EU customers, the UK operations of an EU-covered group, or cross-border critical sectors sits in exactly the chain a covered customer must now account for.

Compliance is not just a product the channel can sell

Let’s look at what NIS2 actually asks of the organizations it covers. Most of it concerns how a company governs its own security: the decisions it makes, the processes it follows, and who is accountable for them. These duties sit mainly in two articles. Article 21 is a list of governance and process requirements: managing risk, handling incidents, checking your own suppliers, and being able to prove it. Article 20 makes a company’s senior management — its board or equivalent — responsible for approving and overseeing those measures and says they can be held liable when the company gets it wrong.

For the most critical organizations, enforcement can go as far as temporarily banning a senior manager from their job. In plain terms, the people at the top now carry the compliance risk personally. None of that is simply something a customer can buy off a product catalogue. A customer can own every security and audit product on the list and still fail an assessment, because it cannot show that anyone is accountable for how those products are used.

What the customer needs is help putting together a security setup it can defend to a regulator. They also need accountable suppliers and partners willing to work towards the security of these systems. That is old-school, relationship-building work, and exactly where a distribution partner can help. No single vendor meets NIS2 on its own. It takes a combination of products and the people who can run them – and a distributor that already works across those vendors can point a partner to the right security solutions and specialists.

The partners who sort out their own security first

The partners who do well out of NIS2 will be the ones who accept that they are now part of their customers’ compliance posture, whether they like it or not. Two things follow.

The first relates to your own security. If you are going to be assessed as a supplier, you need everything documented before customers start asking: your controls, how you handle incidents, who your own suppliers are. The partner who can answer quickly is the easy supplier to keep.

The second is about what you sell, and how you sell it. For partners, the conversation that delivers value is no longer “here is a compliance product.” It is “here is how we help you manage this, prove it, and account for the parts that run through us.” For a distributor, this is familiar ground. Our job has always been to do the assessment work, so partners do not have to do all of it themselves: to vet the products we sell our partners and take responsibility for them.

That kind of assurance — being able to vouch for the security of what you supply — is exactly what NIS2 now pushes down the chain. Each supplier must satisfy the customer above it, and it happens through contracts rather than goodwill. Your customers will start asking it of you, the same way you have always been able to ask it of us.

NIS2 was written to push cybersecurity up to the board and to make companies answerable for the security of their suppliers. Trust between a customer and its suppliers now has to be proven and recorded, whereas before it could be assumed. That is more work, and it is also where the opportunity is: the partner who can show its own security is in order and help a customer account for the parts of their systems that run through it, becomes the supplier a procurement team keeps rather than the one it is told to review.

In a market where it is easy to switch distributors or resellers, that is worth a great deal.