The question doesn’t come from regulators.
It comes from your customer.

What matters

When are you likely to appear in your customer’s supply chain risk assessment?

Not every supplier to an in-scope organisation is affected. The law itself sets out no exhaustive list of criteria – in practice this will typically apply when at least one of the following is true for you:

• You supply products or services related to your customer’s network and information systems.
• You provide software, hardware or IT services that become part of those systems.
• You have access to your customer’s network and information systems yourself.

The more access your organisation has to systems, data or critical business processes, the more likely it is that a customer will consider you relevant to its supply-chain risk assessment. Organisations such as IT service providers, software developers, SaaS providers and managed service providers will often fall into that category. If you supply several in-scope organisations at once, expect different questionnaires from different customers – each organisation will interpret “appropriate measures” in its own way.

Consider a cloud or managed service provider, such as a hosting provider, Azure partner or managed IT provider. When such a party has access to an in-scope organisation’s systems or data, it’s not unusual for additional questions to come up during a contract renewal about security measures, incident handling and supplier risk management. It matters little whether the supplier itself falls within the Cyberbeveiligingswet’s scope; what matters is the risk that supplier poses to the customer’s service delivery.

In practice

What can your customer contractually require of you?

Standard SLAs and licence agreements are usually written for availability and performance, not cyber resilience. In-scope organisations are therefore supplementing those contracts with provisions tailored specifically to the Article 21 duty of care. Topics that come up regularly include:

• Concrete security requirements – often set out in a separate security schedule, referencing a certification (ISO 27001, SOC 2 Type II) or specific technical measures.
• Audit rights – access to certifications and audit reports, sometimes supplemented with penetration test results or a a shared audit involving multiple customers.
• A faster reporting deadline than you’re used to – in-scope organisations are subject to strict incident notification timelines, including an initial notification within 24 hours. To meet that, they’ll want to hear from you sooner – often within a few hours, not 24.
• Obligations that flow down to your own subcontractors – similar to how a data processing agreement works under the GDPR, but broader: it’s not only about personal data, but about any systems relevant to your customer’s business continuity.
• Liability and insurance – a higher liability cap specifically for security incidents, and sometimes an attempt to include additional liability provisions for damage arising from shortcomings on the supplier’s side, potentially including costs linked to regulatory action or sanctions.

These are no longer minor negotiation points. Large, standardised vendors often leave little room to negotiate such clauses; smaller, specialised service providers usually allow more – and give you more reason to raise the conversation yourself rather than wait for it.

The real risk

What happens if you can’t comply?

To start with: the Cyberbeveiligingswet itself isn’t addressed to you. As long as you don’t fall within its scope, there’s no regulator knocking on your door, and therefore no administrative fine either – the penalties in the law – up to €10 million or 2% of worldwide turnover for essential entities, up to €7 million or 1.4% for important entities – are aimed at the in-scope organisation, not at the parties it works with (unless you happen to be in scope yourself). That’s precisely why the risk is often underestimated: no warning letter from a supervisory authority ever lands on your desk to force the issue.

The consequence shifts instead from the regulator to the negotiating table. Where demonstrable compliance is missing, a customer may choose to follow an escalation process. Depending on the contractual arrangements, this can lead to a deadline to put things right, the right to suspend the engagement, and ultimately termination of the contract. For a new tender, that escalation is often skipped altogether – you simply don’t make it through pre-qualification, before the conversation about substance even starts.

Long before it gets that far, the damage is often already done. Customers usually raise compliance questions during an ongoing relationship or a contract renewal – the moment you want to show you’re a reliable partner, not the moment you’re looking at your own security for the first time. A hesitant or uncertain answer costs you something hard to rebuild: the trust you’ve built up, sometimes over years. The time and effort invested in that customer relationship is then at stake as well – well before any contractual consequence follows.

Common assumption

“We have a certificate, so that conversation is closed”

A certificate such as ISO 27001 opens the conversation with a customer, but it doesn’t close it: it’s a photograph, not a film. An auditor assesses a defined scope at a fixed point in time, and between one audit and the next, something is constantly shifting under the bonnet – a new system, a different supplier, a freshly discovered vulnerability.

In-scope organisations must themselves test continuously whether their measures still hold up, and that obligation echoes through to what they expect from their suppliers. So expect “do you have a certificate” to be followed quickly by a second question: how do you maintain visibility between audits, and how fast do you close out a finding once one turns up?

Concrete

What you can do this week

Don’t wait for a customer to ask. Map out which of your customers are likely to include you in their supply chain risk assessment – use the three points above. Then start the conversation yourself about which measures are appropriate for that relationship, rather than waiting for a questionnaire to land.

Also document how you demonstrate, between audits, that a measure is still working – a fixed review date, a short internal check, or a log of what’s changed since the last review. That’s exactly the evidence your customer will ask for once the conversation moves beyond the certificate itself.

Conclusion

Not sure whether this could affect your organisation?