DORA and NIS2 Flow-Down Pulls Non-EU Vendors Into Scope
Image
Germany – October 28, 2026 -- Vendors selling to EU banks, hospitals or energy providers are being pulled into DORA and NIS2 obligations through contractual flow-down, regardless of where they are headquartered, according to Sergiy Lapin, CEO of Passeca Germany.
Customer contracts, not legal text, now define regulatory scope
Lapin says supplier contracts now carry DORA and NIS2 clauses even in countries where regulatory transposition is not finalized. His summary of the shift: "'We are not in scope' was the 2024 answer." By 2026, he argues, vendors must say their customers are in scope and prepare accordingly.
Passeca, a Hyperproof MSSP partner, offers incident response, security awareness, vCISO services and compliance support.