A supplier you can assess under Indian and EU rules

NIS2, Directive (EU) 2022/2555, reaches essential and important entities in the EU through national laws. Article 21(2) lists supply-chain security among the minimum measures, and under Article 21(3) entities must consider the security practices of each direct supplier. An Indian software or managed service provider therefore meets NIS2 mostly through its EU customers’ contracts and evidence requests. Certain digital providers without an EU establishment, such as cloud, data centre and managed security service providers offering services in the Union, must also designate a representative in a Member State (Article 26).

When we are the supplier, we make that evidence easy to give. Security clauses, incident contacts and vulnerability handling are agreed in each contract, and the controls for your engagement are documented for your supplier risk review. At home, CERT-In’s Directions of 28 April 2022 already require listed incidents to be reported within six hours, so an incident process built for India works to a tighter clock than the NIS2 early warning. Whether and how NIS2 reaches your organisation remains your own assessment.

Regulation (EU) 2022/2554, the Digital Operational Resilience Act, applies from 17 January 2025. EU banks, insurers, payment institutions, investment firms and other financial entities must manage ICT third-party risk, keep a register of information on every ICT services contract (Article 28) and include set contractual provisions (Article 30), wherever the provider is based. A provider outside the EU that is designated critical must set up an EU subsidiary within 12 months of the designation (Article 31(12)).

As an ICT provider we sign up to the Article 30 provisions: a full description of the services, where they are provided and where data is processed, help when an ICT incident occurs, access for and cooperation with your supervisors, and your rights to terminate. Where a service supports a critical or important function, exit strategies and our participation in your resilience tests are added to the agreement.

Indian regulated entities face a parallel regime at home: RBI’s directions on managing risks in outsourcing, including IT services, and SEBI’s Cybersecurity and Cyber Resilience Framework (CSCRF) for its regulated entities. We supply the data your register needs and write exit plans from the start, so that changing provider stays a real option.

The EU AI Act, Regulation (EU) 2024/1689, reaches beyond the Union: it covers providers placing AI systems on the EU market wherever they are established (Article 2(1)(a)), and providers and deployers in third countries whose AI output is used in the Union (Article 2(1)(c)). Its obligations arrive in steps. Bans on prohibited practices and the AI literacy duty have applied since February 2025, transparency duties under Article 50 since August 2026, and the high-risk rules for Annex III systems from 2 December 2027, following the 2026 amendment by Regulation (EU) 2026/1744.

A provider of a high-risk system established outside the EU must appoint an authorised representative in the Union before the system is made available there (Article 22(1)). The system itself needs technical documentation (Article 11), automatic event logs (Article 12) and a design that people can oversee effectively (Article 14), and deployers must give oversight to staff who are competent and empowered to intervene (Article 26). In India, the India AI Governance Guidelines released by MeitY in November 2025 set out principles without creating a statute; where your output reaches the Union, we build to the EU requirements.

Your role, provider or deployer, depends on how the system is placed on the market or put into service. Deciding it is a legal question for your advisers; we provide the technical facts they need.

Vendor risk, information security and legal teams want proof before signing. You can ask us for the ISO/IEC 27001 certificate and its scope, for answers to your vendor security questionnaire and for the data processing terms proposed for your engagement.

Use the contact page and name the framework your vendor assessment follows, for example RBI’s outsourcing directions, SEBI’s CSCRF, the DPDP Rules, NIS2 or DORA. The right specialist will reply.