The installation sector does not fall as a whole under the NIS2 Directive. There is no "installation" sector in the annexes that the Directive uses to designate essential and important entities. Yet installation companies are asked about this increasingly often, and there is a concrete reason: many of their customers do fall under the security obligation, and that obligation requires them to look at their suppliers as well.
Whether NIS2 affects your installation company depends on three things side by side: the sector in which you operate, the size of your business, and whether through your customers you end up in the supply chain of an obligated organisation. That third route is often the most likely for installers, and therefore deserves separate attention.
Sector: does installation fall under Annex I or II?
The Directive designates sectors in two annexes: Annex I for essential sectors such as energy, drinking water, public health and digital infrastructure, and Annex II for important sectors such as certain industry and wastewater management. A general installation company that installs heating, electrical or security systems does not appear as such in those annexes. Exceptions are conceivable: an installer who is itself part of an energy network, or who manages critical infrastructure for a designated sector, may come closer to the direct scope. That is an assessment per situation, and not a general outcome for the sector.
Size: do you qualify as a small, medium-sized or large undertaking?
The Directive ties the direct obligation to size: essentially it concerns medium-sized and large undertakings within the designated sectors, with exceptions that may differ by sector. Many installation companies are small or medium-sized in terms of staff and turnover, and often fall outside the direct obligation for that reason too, even if the sector would have a connection. Size alone, however, is never the complete answer; sector and size must be considered together, and the national implementation may differ in parts from the Directive itself.
Supply chain position: access to buildings and systems at customer sites
Here lies the real point of attention for installers. An installation company that works for a hospital, an energy company, a water board or a large logistics company often enters literally: into buildings, at meter cabinets, at building management systems, sometimes with their own login to the customer's systems. For the customer who themselves fall under the security obligation, that is exactly the kind of access that Article 21 of the Directive looks at: risks that arise through suppliers and service providers are part of the security responsibility of that organisation. That is why installation companies receive questionnaires, contractual provisions or requirements about access management, even without being obligated themselves.
What does "supply chain-affected" mean concretely for you?
Supply chain-affected means that you do not yourself fall under the reporting obligation or registration obligation, but that a customer may ask you to demonstrate how you handle access, passwords, updates and incidents. This usually happens via a security questionnaire or an addition to the contract. Those who cannot produce anything in response run the risk that an assignment goes to a competitor who can answer quickly and convincingly. It is therefore not a legal obligation that directly rests on your business, but rather a commercial reality that flows from your customer's obligation. read through the explanation per situation illustrates how those two paths — directly obligated and supply chain-affected — diverge in practice.
What can you do now?
The first step is clarity about which of the three categories applies to your business: essential, important, supply chain-affected, or unaffected. That is precisely what the NIS2 check is for: a few questions about sector, size and the customers you work for, with an indication and an explanation of why. in a few questions see where your company stands requires no account and no cost. If the result is supply chain-affected, the next question is practical: which questionnaires and contract requirements can you expect, and how do you record the answers so you don't have to think them up again each time. view the frequently asked questions about the check and the file gives you a first impression of that, and read where the information on the platform comes from shows how the results are linked to the Directive and the national law.
Would you like to know now whether your installation business is heading towards essential, important, supply chain-affected or unaffected? Take the free NIS2 check, or read through the knowledge base first to work through the concepts at your own pace.