my client falls under NIS2 and I don't, what does that mean for me

You are affected through the contract, not through the law

You yourself do not fall under NIS2, but that does not mean nothing changes. Your client who does fall under the directive must themselves ensure security throughout the supply chain under Article 21(2) of Directive (EU) 2022/2555. This requires them to pass on requirements to their suppliers — including you. Not because you are an entity within the meaning of the law, but because your client must demonstrate their own responsibility, and you are part of that.

In practice, you will notice this as a questionnaire or as additional contractual terms, not as a legal obligation that directly binds you. The questions usually concern the same ten measures that your client must take themselves: risk policy, incident handling, continuity, vulnerability management, access and cryptography. You can therefore use the same substantiation you already have, even if you never had to prepare it for yourself. If you do not yet have those documents complete, it is advisable first to check whether there is a policy for risk analysis and security of information systems and whether security requirements for own suppliers it has already been documented somewhere — because these two subjects appear in virtually every supply chain questionnaire, regardless of whether you yourself are an entity.

Established in Article 21, implemented through the contract

The obligation for supply chain security is set out in Article 21(2)(d) of Directive (EU) 2022/2555: entities must take measures to ensure the security of the supply chain, including the relationship with their direct suppliers. The Dutch implementation of this will follow through the Cybersecurity Act, which enters into force on 15 August 2026. As long as you yourself do not fall within the scope of that act, the implementation towards you remains contractual: your client determines for themselves how they will request your compliance with their obligation, and this may differ per client.