Does NIS2 Apply to Non-EU Companies? (UK, US, GCC, Pakistan Vendors)

Regional Notes (editorial)

• UK — post-Brexit UK regime is separate; UK firms still meet NIS2 via EU ops and customer contracts.
• US — SaaS and MSSP exporters supporting EU critical sectors should expect questionnaires and incident-notice clauses.
• GCC / Pakistan — vendors serving EU energy, health, finance, or digital infrastructure customers inherit flow-down security and reporting expectations.

What Non-EU Vendors Should Do

1. Inventory EU legal entities and customer sectors
2. Map services to Annex I/II themes
3. Stand up Article 21-aligned controls and 24/72/one-month incident playbooks for EU impact
4. Confirm national law wherever you have establishment or designation risk

How CyberSilo Helps

• Article 21 evidence map and gap tracking in CSA for NIS2
• Article 23 reporting clocks with ThreatHawk SIEM detection workflows
• Advisory scoping — contact CyberSilo

Frequently Asked Questions

If we only sell into the EU with no office, are we safe?

Not necessarily — digital/ICT service themes and customer flow-down can still create obligations or commercial mandates. Assess facts and confirm national law.

Does GDPR Article 3 logic apply one-for-one?

No. NIS2 uses sector/entity classification and national transposition, not GDPR’s Article 3 territorial test.

What do procurement teams usually ask?

Article 21 control summaries, MFA/crypto posture, supplier risk process, and incident notification SLAs.

Related NIS2 Resources

NIS2 hub · Supply chain · CSA