However, neither article imposes anything at all directly on the supplier. Most organizations are currently trying to discharge their duty of care using a supplier questionnaire. Ultimately, a questionnaire only captures the existence of controls at a given point in time; it cannot measure security that needs to be assessed as circumstances change and evolve, nor can it guarantee the full scope or efficacy of those controls.
Recent real-world cases across Germany, France, and Italy highlight the severe operational gaps created by these regulatory and supply chain dynamics.
On 14 April 2026, unimed, a medical billing service provider for the German healthcare sector that has been invoicing for German hospitals since 1984, identified a ransomware attack. While the attackers failed to encrypt the provider’s systems, they exfiltrated data before being shut out.
The fallout spread rapidly across downstream healthcare providers:
Not a single hospital network was touched directly. A clinic in Karlsruhe noted that its own network was prepared to stop lateral movement, but the hospitals' own networks were never the perimeter.
France's national transposition of NIS2 has faced delays, with the Senate passing a transposition bill on 12 March 2025 and the country being referred to the European Court of Justice alongside Ireland, Spain, and the Netherlands. Despite the legal delays, attacks continue.
In February 2025, Paris fintech Harvest SA discovered a ransomware attack that crippled its wealth-management software, used by more than 4,600 clients, taking services offline for about four weeks. The root cause was a virtual machine hosted at one of Harvest SA's own service providers. A banking supervisor later confirmed to Parliament that the banks' software supplier was compromised through the software supplier's supplier. Downstream impacts included MAIF notifying 55,000 clients and prospects, BPCE notifying customers across subsidiaries, and AXA France notifying twenty clients.
Harvest SA possessed mature security controls, including multi-factor authentication (MFA) for at least some accounts, EDR, XDR, SIEM, and patch management. Yet, a standard vendor questionnaire only verifies that controls exist, not their full scope or efficacy.
Italy has passed its local implementation of NIS2 under D.Lgs. 138/2024. The first cohort of NIS entities received notifications of inclusion on 12 and 13 April 2025 and must have basic security measures in place 18 months later, putting their deadline at the end of October 2026 with no extension.
Supply chain incidents in the region illustrate the pressing scope of the issue:
Small suppliers are not directly obliged by NIS2 or national implementing laws to comply. As the German BSI notes, firms outside the law’s scope that serve in-scope entities should expect requirements to be pushed down strictly through customer contracts.
According to ENISA’s German BSI notes report (December 2025), 37% of respondents name supply chain risk management as the most difficult NIS2 requirement. ENISA’s May 2026 survey further shows that SMEs in highly critical sectors find compliance significantly more challenging than larger organizations.
Italy stands out as an exception in how it handles this gap: under ACN’s Determinazione 127437/2026 , in-scope organizations must submit an annual list of suppliers. The ACN then determines which suppliers are essential or important under Article 3 of D.Lgs. 138/2024 based on the volume of in-scope entities they serve, allowing the supervisory authority to impose direct security requirements rather than relying purely on private contracts.
Across Europe, however, scoping remains unresolved, particularly for ICT service management, which ENISA’s NIS360 2026 report flagged as a primary risk zone where criticality has outrun maturity.
Compliance duties are already live in Germany, where roughly 17,700 entities are registered out of an estimated 29,500 in scope. In Italy, boards face the end-of-October deadline. In France, the absence of finalized national law offers no practical reprieve from active threats.
Cyber incidents consistently exploit supply chain vulnerabilities. Contractual agreements and vendor questionnaires are no longer sufficient on their own to address risks that span multi-tiered supplier networks.
Establishing contractual controls and issuing vendor questionnaires may help meet baseline administrative duties under NIS2, but it does not prevent exfiltrated vendor data from being weaponized against your organisation. In part two of this NIS2 series, we examine how cybercriminals turn stolen supplier databases into hyper-personalized phishing infrastructure, how national laws trimmed employee training mandates, and how to defend the human perimeter.