NIS2 and Moroccan subcontractors: what changes with your European clients

The short answer: in most cases, the European NIS2 directive does not apply directly to a Moroccan company. What changes is your contract. Your in-scope European clients have a duty to secure their supply chain, and they do so by passing their requirements on to you: questionnaires, incident clauses, evidence to supply, sometimes audits. For a subcontractor, the issue is very practical: being able to respond without stalling the contract. One case needs separate examination, that of the IT, cloud or security provider of medium size or above that itself offers services in the Union.

This article is for executives and IT managers of call centres, software firms, professional practices, manufacturers and service providers that work for Europe. It relies on the text of Directive (EU) 2022/2555 and on European Commission publications. It does not replace a lawyer’s advice on your contract, especially since each Member State applies the directive through its own law.

NIS2 in brief: who is covered

NIS2 strengthens the cybersecurity of organisations considered important to the European economy and society. It applies (Article 2) to entities of a type listed in its Annexes I and II that are at least medium-sized and provide services in the Union. Some entities are covered regardless of size, such as providers of public electronic communications networks or services and DNS service providers.

Medium size refers to European Recommendation 2003/361/EC: a company is at least medium-sized if it does not fall into the “small” category, meaning from 50 staff, or above 10 million euros in both turnover and balance sheet total. Linked and partner enterprises count in the calculation.

The directive then distinguishes essential and important entities (Article 3). For breaches of Articles 21 and 23, Member States must set a maximum fine of at least 10 million euros or 2% of worldwide turnover for the former, and at least 7 million euros or 1.4% for the latter, whichever is higher (Article 34). Management bodies must approve the measures, oversee their implementation and can be held liable (Article 20). That explains why some contracting companies have recently become much firmer.

Are you directly concerned? The common cases

Your situation	Directly subject?	What you need to do
Moroccan SMB with no establishment in the Union, working for a European client (call centre, development, accounting, production)	Generally not	Meet the client’s contractual requirements
Managed service, managed security, cloud or data centre provider not established in the Union, of medium size or above, offering services in the Union	Possibly, to be examined	Have the case reviewed, and designate a representative if confirmed (Article 26(3))
Moroccan company with an establishment in a Member State	The establishment may be	Check the sector and size under that State’s law
Moroccan subsidiary of a European group	Not necessarily in its own right	Expect the group’s policy, often imposed on all subsidiaries
SMB below the threshold, with no in-scope European client	No	Apply good practice, useful in every case

IT providers deserve a closer look. The directive defines a managed service provider as one that handles the installation, management, operation or maintenance of products, networks, infrastructure or applications, on site or remotely (Article 6, point 39). A managed security service provider is one that also assists with cybersecurity risk management (point 40). If such a provider is not established in the Union but offers services there, it must designate a representative in one of the Member States where it offers them. Without a representative, any State where it provides services may take action against it.

Why your client passes its obligations on to you

Article 21 of NIS2 requires ten families of measures, including incident handling, business continuity, backup, access control, encryption and multi-factor authentication. Point (d) covers “supply chain security”, including relationships with direct suppliers and service providers.

Paragraph 3 of the article sets out what your client must look at in your company: your specific vulnerabilities and the overall quality of your products and cybersecurity practices, including your secure development procedures. It must also take into account the coordinated assessments of critical supply chains carried out at European level (Article 22).

For this client, then, you are a risk to assess, document and manage, whether you are in Casablanca or Lyon. This article makes no distinction based on the supplier’s country, and it addresses direct relationships. In practice, the client will often ask you to impose equivalent requirements on your own subcontractors.

Digital service providers (cloud, data centres, managed services, among others) fall under a more detailed text, Implementing Regulation (EU) 2024/2690. Section 5 of its annex deals with the supply chain security policy. Where appropriate, it provides in particular for contracts to cover security requirements, incident notification, subcontracting rules and what happens to information at the end of the contract. If your client is of this type, expect especially precise requests.

What you will receive: questionnaires and clauses

Client request	What it expects	How to prepare
Security questionnaire	A description of your measures, often with attachments	Keep a single up-to-date file, with true and verifiable answers
Incident clause	A commitment to alert the client within a given time	Appoint a contact, write the procedure, test that it works outside office hours
Security baseline	Compliance with a standard or a policy annexed to the contract	Compare that baseline to what you have before signing
Subcontracting transparency	A list of your significant subcontractors	Maintain the list, and tell the client of any change
Audit or evidence right	An audit on site, or a report supplied, depending on the risk	Negotiate the scope and prepare the evidence in advance
Contract exit	Return or destruction of data, and access removed	Write the end-of-assignment procedure and keep it
Termination for security reasons	A right to end the contract for a serious breach	Have the contract reviewed, understand what triggers termination

These clauses are not a single list imposed by the directive: each client drafts them according to its sector and country. For the general shape of a service commitment, see our pointers in key clauses in a managed IT contract.

The most sensitive point: the alert deadline

Article 23 requires the NIS2 entity to give early warning within 24 hours of becoming aware of a significant incident, a notification within 72 hours, then a final report no later than one month after that notification.

If the incident starts with you, the client can only meet these deadlines if you warn it very quickly. A poorly prepared clause therefore exposes you to a breach of contract. Three questions to ask before signing:

1. Who detects? Without logging or monitoring, an incident can stay invisible for a long time. See managed EDR and 24/7 monitoring.
2. Who decides and who calls the client? A name, a deputy and a number, including at night and at weekends. Our incident response plan sets out the steps.
3. Is the promised deadline realistic? It is written in your contract, not in the directive. Do not sign a commitment your organisation cannot keep.

Where transposition stands in Europe

NIS2 had to be transposed by 17 October 2024. Your obligations therefore also depend on the client’s country:

• Action against four States: on 8 July 2026, the European Commission announced it was referring Ireland, Spain, France and the Netherlands to the Court of Justice of the European Union for failing to notify full transposition.
• France: the so-called “Resilience” bill was adopted by the Senate on 12 March 2025. In early November 2026, it had not yet been voted by the National Assembly and no firm date was known.
• Belgium and Italy: the Commission lists them as having transposed the directive on its country pages, dated July 2025.

This delay does not shelter you. Many European groups are already preparing their suppliers, and a contract can include these requirements before a national law is even voted. Ask your client which national text it applies: the answer changes the vocabulary and deadlines of the contract.

NIS2, GDPR, Law 05-20: do not confuse them

Text	What it protects	What it changes for you
NIS2	Security of network and information systems	Requirements passed on by contract, except where it applies directly
GDPR	Personal data	Processor agreement and transfer clauses, see the GDPR for a Moroccan company
Law 09-08 and CNDP	Personal data in Morocco	Declarations and transfers, see transferring data outside Morocco
Law 05-20 and DGSSI	Cybersecurity in Morocco	Obligations depending on your status, see our guide to Law 05-20

If your client is a European bank or insurer, also check the DORA regulation, a separate text specific to the financial sector, which sets its own requirements towards IT service providers.

The preparation plan for a Moroccan SMB

1. List your European clients and their sector, then ask whether they are subject to NIS2 and under which national law.
2. Have your case reviewed if you are an IT, cloud or security provider of medium size or above.
3. Reread your contracts: alert deadlines, audits, subcontracting, exit, termination.
4. Measure your gaps with a security audit and penetration test, so that you answer on facts.
5. Fix the fundamentals first, as listed in Article 21: MFA on every account, separate admin accounts, patching, encryption, 3-2-1 backup with an immutable copy, tested restores.
6. Write the minimum: security policy, incident handling, inventory, list of subcontractors, end-of-contract procedure.
7. Build a reusable evidence file: audit reports, test results, procedures, training records.
8. Consider ISO 27001 if several clients ask for it, on a realistic scope: read ISO 27001 for an SMB in Morocco.

Mistakes to avoid

• Answering “yes” to everything on the questionnaire: your answers can become commitments, and a false statement comes back at the first incident.
• Signing an alert clause with nobody on call to apply it.
• Forgetting your own subcontractors: host, software vendor, freelancer with access.
• Leaving the subject to the IT department alone, when contracts, management and HR are also involved.
• Expecting everything from a tool: software replaces neither the procedure nor the evidence.

Sources consulted

• Directive (EU) 2022/2555 (NIS2), Articles 2, 3, 6, 20 to 23, 26, 34 and 41.
• Implementing Regulation (EU) 2024/2690, annex, section 5.
• European Commission, referral to the Court of Justice of 8 July 2026.
• European Commission, NIS2 transposition status.

How we support you

At ALLSAFE SOLUTIONS, we help Moroccan companies working for Europe meet their clients’ requirements: technical assessment, factual answers to questionnaires, rollout of MFA, backup and detection, incident procedures. Our teams monitor systems 24/7 and handle a critical incident in under 15 minutes, which helps you keep an alert commitment. For the legal reading of the contract, we work alongside your counsel.

See our cybersecurity services in Morocco and our managed IT services in Morocco, then request your free initial audit: we reply within 24 business hours with an assessment and the priorities to address before your next client questionnaire.