NIS2 and your SMB in 2026: are you in a regulated entity's supply chain?

NIS2 is not the AI Act. But it’s landing on SMB desks through the same channel: a bigger client passing down its obligations.

Many Italian and European SMBs assume “not my problem, I’m too small”. In 2026 that’s often false, not because you’re a regulated entity, but because you’re in the supply chain of one who is.

Key takeaways:

• Most SMBs are NOT direct NIS2 entities (it takes a critical sector plus medium/large-enterprise size thresholds).
• But if you supply a regulated entity, its security requirements reach you through the contract: supplier questionnaires, clauses, requests for logs and incident response plans.
• Your risk isn’t the NIS2 fine (that hits the regulated entity), it’s losing the contract if you fail the due diligence.
• If you run AI agents on your processes, those agents access data and systems: they enter the security perimeter the client wants governed.
• The useful prep isn’t a 6-month project: it’s written policies, access control, logs, an incident plan. Documentation, not heroics.

Are you a direct NIS2 entity, or one “by reflection”?

The directive classifies essential and important entities across a list of sectors (energy, transport, banking, health, digital infrastructure, public admin, critical manufacturing, waste, food, and others), with size thresholds that typically exclude micro and small firms.

Operational translation: if you’re a 10-200 person SMB outside those sectors, you’re almost certainly not a direct entity.

The point is the second channel. NIS2 requires regulated entities to manage supply-chain security. So your regulated client must ensure its suppliers (you) have an adequate security level too. And it does so the easiest way for itself: it writes it into the contract.

What a regulated client will actually ask for

You won’t get a letter from the State. You’ll get a supplier security questionnaire, or a contract annex, with requests like:

• Documented security and access-management policies.
• Activity logs on the systems touching its data.
• An incident response plan with notification timelines (NIS2 imposes tight timelines on the regulated entity: if an incident starts with you, it needs to know fast).
• Clauses that extend its obligations to you.

Fail to answer and you don’t get a fine. You risk dropping off the supplier shortlist. For an SMB, that’s the real cost.

Where AI actually fits

Two concrete links, no hype.

First: your AI agents are in the perimeter. If you’ve automated ticket triage, reconciliations or screening with agents that access data and systems, those agents are part of your security surface. A careful NIS2 client will ask how you govern them. That’s why Soraia sprints include by default an immutable audit log on every agent decision, access control and human oversight on critical cases: not a flourish, exactly what you need to show in due diligence. We cover this on our Customer & Compliance Automation page.

Second: AI helps sustain the obligations, it doesn’t invent them. Automatic triage of security alerts, generated and maintained documentation, monitoring: these are repetitive tasks where an agent cuts the load. But accountability stays human. “AI that handles compliance by itself” is a shortcut that doesn’t exist.

When you do NOT need a project

Straight talk: if none of your clients is a NIS2 entity, and you don’t expect one, don’t launch a cybersecurity programme in the name of a directive that doesn’t touch you. Do the basics (backups, access, MFA, a minimal incident plan) and focus on the business.

The project makes sense when a regulated client is already sending you the questionnaire, or when you’re building AI agents on sensitive data and want the governance to survive an audit. Then it’s worth treating agent security as part of the build, not a patch afterwards. Same principle we apply to custom software development: security and logs inside the project, your code from day one.

If you’re training the team to use AI in a safe, traceable way, that’s the kind of governance we also cover in AI Adoption programmes.

Next step

You don’t need a 6-month consultancy to know where you stand. You need an honest map: are you a regulated entity, in the chain of one, or out of scope? And if you use AI agents, do they hold up to a due-diligence request?

Let’s talk for 20 minutes, or take the check-up. We’ll tell you which scenario you’re in, without selling a project you don’t need.