Your customer sent a NIS2 supplier security questionnaire: an answer sheet (Article 21(2)(d), Implementing Regulation 2024/2690) for small suppliers, their AI tools and their accountants
What you get: a finished NIS2 supplier questionnaire answer sheet in four tabs: a scope check that tells you whether the client is itself likely inside NIS2 or is being asked as a supplier; a question log with one row per customer question, mapped to the ten minimum measures in Article 21(2), with a formula that marks each answer READY, ADD EVIDENCE, REFRESH EVIDENCE, ANSWER HONESTLY WITH A DATE or DO NOT CLAIM; a contract clause check for the eight supplier clauses listed in Implementing Regulation (EU) 2024/2690; and the client's own supplier list (including AI tools) in the form that regulation describes. A short cover reply template and four made-up rows show how it fills in.
Short answer: NIS2 (Directive (EU) 2022/2555) applies from 18 October 2024 (Article 41(1)) mainly to medium-sized and larger entities in the sectors of its Annexes I and II (Article 2(1)). Most small clients are not covered themselves, but their covered customers must manage "supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers" (Article 21(2)(d)), taking into account "the overall quality of products and cybersecurity practices of their suppliers and service providers, including their secure development procedures" (Article 21(3)). That is why the questionnaire arrives. Answer it truthfully, with evidence, and never tick a box the client cannot back up.
Why accountants and bookkeepers should look at this now
- The questionnaire lands on small firms. Recital 85 says covered entities "should in particular be encouraged to incorporate cybersecurity risk-management measures into contractual arrangements with their direct suppliers and service providers". A web agency, IT support firm, software maker, payroll bureau or cleaning company with system access can all receive one.
- Some customers have a binding list. For cloud, data centre, managed service and managed security providers, online marketplaces, search engines, social networks, DNS, TLD and trust service providers, Implementing Regulation (EU) 2024/2690 sets out what the supply chain policy and contracts must contain (Annex, point 5). Other covered entities often reuse that list, so it is the best guide to what you will be asked.
- AI tools count as suppliers. A chatbot, meeting note-taker or AI writing tool that touches customer systems or data is an ICT service from a "direct supplier or service provider". Customers increasingly ask which AI tools see their data. Your client should know the answer before the questionnaire arrives.
- A wrong "yes" is worse than an honest "not yet". Contract answers can become warranties. The sheet's result column will not produce READY unless there is an evidence document dated within the last year.
Step 1: tab 1, scope check (is the client covered, or only a supplier?)
| Cell | What to write or the formula | Source |
|---|---|---|
| B1 staff headcount (annual work units) | Number, including linked and partner enterprises where the Recommendation requires it | Recommendation 2003/361/EC, Annex Arts 2, 3, 6 |
| B2 annual turnover (EUR), B3 balance sheet total (EUR) | Last approved accounts | Annex Art. 2 |
| B4 sector in NIS2 Annex I or II | Yes or No (for example energy, transport, health, digital infrastructure, ICT service management B2B, postal, waste, manufacturing of certain products, digital providers) | NIS2 Annexes I and II |
| B5 size result | =IF(OR(B1>=50,AND(B2>10000000,B3>10000000)),"MEDIUM OR LARGER","SMALL OR MICRO") | Annex Art. 2(2): small is fewer than 50 persons and turnover "and/or" balance sheet not over EUR 10 million |
| B6 result | =IF(AND(B5="MEDIUM OR LARGER",B4="Yes"),"LIKELY COVERED: check national NIS2 law and registration","SUPPLIER ONLY (unless Art. 2(2) to (4) applies): answer customer questionnaires with this sheet") | NIS2 Art. 2(1), 2(2); formula is our working rule |
Article 2(2) brings in some entities "regardless of their size", such as providers of public electronic communications networks or services, trust service providers, top-level domain name registries and DNS service providers, the sole provider in a Member State of an essential service, and certain public administration entities. NIS2 also says Article 3(4) of the Recommendation's Annex "shall not apply" (Article 2(1)). Each Member State transposed NIS2 into its own law, so check the client's national act and registration rules before relying on B6.
Step 2: tab 2, question log (one row per customer question)
| Column | What to write | Source |
|---|---|---|
| A. Customer | Who sent the questionnaire | |
| B. Question | Copy the wording exactly | |
| C. Topic | One letter (a) to (j) from the table below | Art. 21(2) |
| D. What we do today | Yes, Partly or No | |
| E. Evidence | Name of the document, screenshot or log (policy, backup report, MFA setting, training list) | |
| F. Evidence date | Date the evidence was last produced or reviewed | |
| G. AI tool involved | Name of any AI tool that touches the customer's data or systems, or blank | Art. 21(2)(d); IR Annex 5.2 |
| H. Planned date | If Partly or No: date the gap will be closed | Art. 21(4) (corrective measures, for covered entities) |
| I. Result | =IF(D2="Yes",IF(E2="","ADD EVIDENCE",IF(TODAY()-F2>365,"REFRESH EVIDENCE","READY")),IF(D2="Partly",IF(H2="","ANSWER HONESTLY WITH A DATE: add H","ANSWER HONESTLY WITH A DATE"),"DO NOT CLAIM: answer No"&IF(H2="",""," and give the plan date"))) | Formula and the one-year evidence rule are our working rule |
Use these ten topics for column C. They are the minimum measures NIS2 requires of covered entities, so customer questionnaires are usually built around them:
| Topic | Article 21(2) wording | Evidence a small supplier can usually show |
|---|---|---|
| (a) | "policies on risk analysis and information system security" | A one-page information security policy, dated and approved by the owner |
| (b) | "incident handling" | Who to call, how fast you tell customers, an incident log (even if empty) |
| (c) | "business continuity, such as backup management and disaster recovery, and crisis management" | Backup schedule plus the date of the last test restore |
| (d) | "supply chain security" | Tab 4 of this sheet: your own supplier and AI tool list |
| (e) | "security in network and information systems acquisition, development and maintenance, including vulnerability handling and disclosure" | Patch routine, update dates, a contact address for reporting vulnerabilities |
| (f) | "policies and procedures to assess the effectiveness of cybersecurity risk-management measures" | Date of the last yearly review of this sheet |
| (g) | "basic cyber hygiene practices and cybersecurity training" | Training list with names and dates |
| (h) | "policies and procedures regarding the use of cryptography and, where appropriate, encryption" | Disk encryption on laptops, TLS on websites and email |
| (i) | "human resources security, access control policies and asset management" | Device list, joiner/leaver checklist, who has admin rights |
| (j) | "the use of multi-factor authentication or continuous authentication solutions, secured voice, video and text communications and secured emergency communication systems within the entity, where appropriate" | Screenshot showing MFA enforced on email, accounting and AI tool accounts |
For MFA, the Implementing Regulation asks the entities it covers to authenticate users "by multiple authentication factors or continuous authentication mechanisms … where appropriate, in accordance with the classification of the asset to be accessed" (Annex 11.7.1), and to use "strong identification, authentication such as multi-factor authentication" for privileged and system administration accounts (Annex 11.3.2(a)). Expect customers to ask about admin accounts first.
Step 3: tab 3, contract clause check (the eight supplier clauses)
Implementing Regulation 2024/2690 says the entities it covers must make sure their supplier contracts specify, "where appropriate through service level agreements" and "where appropriate", the following (Annex 5.1.4). Put one row per clause in the customer's draft contract: B in the contract (Yes/No), C can we meet it today (Yes/Partly/No), D note.
| Row | Clause (Annex 5.1.4) | What to check before signing |
|---|---|---|
| 1 | (a) cybersecurity requirements for the supplier | Are they listed, or only "industry standard"? Ask for the list |
| 2 | (b) awareness, skills, training and, where appropriate, certifications of staff | Does it demand a certification the client does not hold? |
| 3 | (c) verification of the background of staff | Is this lawful and proportionate under the client's national law? |
| 4 | (d) notify, without undue delay, incidents that present a risk to the customer's systems | Who notifies, by which channel, within what internal target |
| 5 | (e) right to audit or right to receive audit reports | Notice period, cost, how often |
| 6 | (f) handle vulnerabilities that present a risk to the customer | Patch times the client can actually meet |
| 7 | (g) subcontracting and security requirements for subcontractors | Does this include the client's AI tools and cloud providers? List them from tab 4 |
| 8 | (h) obligations at termination, such as retrieval and disposal of information | How data is returned and deleted, and proof of deletion |
Result for each row: =IF(B2="No","NOT ASKED",IF(C2="Yes","OK TO SIGN",IF(C2="Partly","NEGOTIATE OR ADD PLAN DATE","DO NOT SIGN AS WRITTEN"))) (our working rule). For clause (d), the customer itself reports significant incidents with an early warning "within 24 hours" and a notification "within 72 hours" of becoming aware (NIS2 Article 23(4)(a) and (b)), so it will want to hear from the supplier fast. Agreeing an internal target that the client can meet is our working rule, not a legal deadline for the supplier.
Step 4: tab 4, the client's own supplier list (including AI tools)
The Implementing Regulation asks the entities it covers to keep "a registry of their direct suppliers and service providers", including "contact points for each direct supplier and service provider" and "a list of ICT products, ICT services, and ICT processes provided" (Annex 5.2). The same list answers topic (d) for a small supplier. Columns: A supplier, B contact point (security or support email), C ICT product or service, D is it an AI tool (Yes/No), E customer data it sees (none, contact data, files, systems access), F MFA enforced (Yes/No), G admin accounts, H last reviewed. Flag: =IF(AND(E2<>"none",F2<>"Yes"),"FIX: turn on MFA before answering (j)",IF(TODAY()-H2>365,"REVIEW","OK")) (our working rule).
Four made-up rows (question log)
| A | B. Question | C | D | E | F | G | I. Result |
|---|---|---|---|---|---|---|---|
| Customer 1 | Do you enforce MFA for all users? | (j) | Yes | Admin console screenshot | 3 Oct 2026 | READY | |
| Customer 1 | List subprocessors that access our data, including AI services | (d) | Partly | Tab 4 (AI note-taker missing) | 15 Jan 2025 | Meeting note-taker | ANSWER HONESTLY WITH A DATE: add H |
| Customer 2 | When did you last test a restore from backup? | (c) | Yes | Restore test note | 2 Sep 2025 | REFRESH EVIDENCE | |
| Customer 2 | Do you hold an information security certificate (please name it)? | (a) | No | DO NOT CLAIM: answer No |
These rows are made up for illustration and do not describe any real business. NIS2 does not require a small supplier to hold any certification; whether the customer accepts a "No" is a commercial question.
Cover reply template
Subject: Supplier security questionnaire – [our company]
Thank you for the questionnaire dated [date]. We have answered each question against what we do today and attached the evidence named in each answer. Where we answer "Partly" or "No", we give the date by which we plan to close the gap. AI tools that may process your data are listed in the attached supplier list with their contact points. We will tell [contact] without undue delay if we have an incident that may affect your systems or data. If a question does not fit a business of our size, we have explained what we do instead.
The last sentence reflects the proportionality idea in the Implementing Regulation: where entities "cannot implement some of the technical and the methodological requirements … due to their size", they "should be able to take other compensating measures that are suitable to achieve the purpose of those requirements" (Recital 5). That recital speaks about covered entities, but it is a fair way to frame a small supplier's answers.
What to tell a client in one paragraph
"You are probably not under NIS2 yourself, but your larger customers are, and the law makes them check their suppliers. When a security questionnaire arrives, answer every question truthfully, attach evidence that is less than a year old, give dates for gaps, and never claim a certification or a control you do not have. Turn on multi-factor authentication on email, accounting and AI tool accounts first, keep a list of your own suppliers and AI tools, and read the incident-notice, audit and termination clauses before you sign." Check the client's national law and any sector rules first; refer contentious contract terms to a lawyer.
Keep the AI tool list in one place
Customers now ask which AI tools see their data. List the client's AI tools in the EURO AI Register free edition. It runs in your browser with no account and no upload, covers your first 10 AI systems and 10 evidence records, the screening questions, duties by role with dates, and a printable Article 4 AI-literacy record. Attach this sheet's question log as the evidence record for each AI tool a customer asks about.
When you need more than 10 systems, the EURO AI Register membership starts at $19 a month and adds unlimited systems, rule updates and email help. Neither tool is legal advice or proof of compliance.
Partner programme opening soon
Partner programme opening soon: join the free waitlist. Planned terms are 50% of each referred sale (75% once you have 5+ paying customers), single level, paid through Gumroad only from revenue received.
Free start: list your AI tools in the EURO AI Register free edition, then add this sheet. Related: EU AI Act customer questionnaire answer sheet · GDPR Article 32 access security sheet for AI accounts · GDPR 72-hour breach sheet · Questions to ask your AI vendor
Sources
- Directive (EU) 2022/2555 (NIS 2 Directive), Articles 2(1), 2(2), 21(1) to (4), 23(4), 41(1), Recital 85 and Annexes I and II, read on EUR-Lex on 28 October 2026: EUR-Lex
- Commission Implementing Regulation (EU) 2024/2690 of 17 October 2024, Recitals 4 and 5, Annex points 5.1.1 to 5.1.7, 5.2, 6.1.2, 11.3.2 and 11.7, read on EUR-Lex on 28 October 2026: EUR-Lex
- Commission Recommendation 2003/361/EC concerning the definition of micro, small and medium-sized enterprises, Annex Article 2, read on EUR-Lex on 28 October 2026: EUR-Lex
Unadhi Guides are free, independent explainers. We correct errors as soon as we find them: write to mininglife7@gmail.com.