Is your AI vendor a supplier under NIS2?

Why does the vendor of an AI assistant count as part of the supply chain?

NIS 2 does not name AI vendors. But Art. 21(2)(d) requires supply chain security measures, including security-related aspects of the relationships with your direct suppliers or service providers. Whoever supplies you with an AI assistant is one of them. In Germany the duty sits in § 30(2) no. 4 BSIG.

When choosing these measures, you take into account the vulnerabilities specific to each direct supplier and the overall quality of its products and cybersecurity practices, including its secure development procedures (Art. 21(3) NIS 2).

The walkthrough asks who sends you the invoice. A piece of software can have several providers, such as the maker and the reseller you buy it through. Name both in 2.2 and both go on your supplier list.

Art. 21(2)(d) and 21(3) NIS 2 · § 30(2) no. 4 BSIG

How does the AI assistant get onto your software list?

In item 2.2, “Write down what your company has”, the screen “Software everyone uses” already has an entry to tick: “AI assistants (ChatGPT, Microsoft Copilot)”. Tick it if an assistant is in use at your company.

On “Which software exactly, and from whom?” you write the product you actually use and, next to it, who provides it. If that provider is missing from your supplier list, the walkthrough adds it there. Further assistants go on “Software everyone uses” as entries of your own.

The assistant now counts as software. So it also appears in 2.3 among the software you rate, and in 11.1 among the sign-ins where you record the second factor.

What goes in the row on the supplier list?

In item 5.1, “Write down who works for you”, each row on the screen “Your suppliers” has two entries: “Supplier” and “What they do for you”. For the AI vendor, write down what your people use the assistant for and which data it sees.

If the assistant is connected to the walkthrough, that belongs in the row too. If the language model runs in its vendor's cloud, the vendor processes what the assistant reads there. On the “Suppliers” page of the app you can also record “System Access” and “Data Access”.

Companies that themselves provide certain digital services, such as cloud or data centre services, must keep such a registry under Implementing Regulation (EU) 2024/2690, with a contact point and the products and services supplied for each provider (Annex point 5.2).

What should the contract with the AI vendor settle?

Item 5.2, “Record what you have agreed with your suppliers”, asks two things: whether security requirements are settled, for example on access and updates, and whether the supplier has to report security incidents to you. Large AI vendors rarely negotiate. Then their standard terms are what counts.

If the vendor processes personal data on your behalf, it has to take the measures under Art. 32 GDPR and notify you of personal data breaches without undue delay (Art. 28(3)(c), Art. 33(2) GDPR). A security incident without personal data is not covered. Anthropic, for example, states that it acts as a processor for its commercial products (as of October 2026).

How much needs to be settled depends on the risk. NIS 2 requires appropriate and proportionate measures (Art. 21(1)), and § 30(1) BSIG names, among other things, the size of your company, the cost of implementation and how likely and severe incidents are. For providers of certain digital services the Implementing Regulation adds rules on subcontractors and on retrieving and disposing of information when the contract ends (Annex point 5.1.4).

If nothing is settled, choose “None of this is agreed”. Besides the contract, you can limit what the assistant sees, for example by leaving the records switch off, or by having it connected by a person who may not export and is assigned only the fitting areas.

Art. 21(1) NIS 2 · § 30(1) BSIG · Annex point 5.1.4 Implementing Regulation (EU) 2024/2690

How do you rate the risk the AI vendor brings?

In item 2.3, “Rate your risks”, you rate the assistant and its vendor once each. For the software, think of its worst realistic case: it goes down, it is attacked or data is lost. For the supplier, the worst case is that it fails or has a security incident of its own.

The level then also shows on the supplier list. If a supplier is rated high or very high and its contract settles neither security nor incidents, the walkthrough shows it as an open point before the sign-off in 7.3. The same goes for a sign-in to the assistant for which you record no second factor in 11.1.