IT or compliance asked you the question: can you demonstrate which suppliers meet the NIS2 requirements? And then you realised the answer was scattered across fifty separate folders, a shared drive and a few Excel tabs. For NIS2 healthcare supplier contracts, that is exactly the problem. The Cybersecurity Act (Cbw), the Dutch implementation of NIS2, came into force on 15 August 2026. Healthcare organisations must demonstrably control cyber risks from their supply chain. Not only in new contracts, but also in the contracts that have been in place for years.
This piece builds on our earlier article about NIS2 and contract management and takes a closer look at what the law means in concrete terms for healthcare.
What changed for healthcare on 15 August 2026
The Cbw came into force on 15 August 2026, published in Staatsblad 2026, 189. There is no general transition period. Anyone who falls under the law must comply from that date. The only exception is higher education, which is given three years. In the Netherlands, the law directly affects roughly 8,000 to 10,000 organisations. Registration in the entity register via the NCSC is mandatory from 15 August 2026.
For healthcare, the IGJ is the sectoral supervisory authority. This means the IGJ can ask you to demonstrate that you control cyber risks from the chain. Not with a well-written statement of intent, but with evidence per supplier. And that is where it hurts for most healthcare organisations: the chain is large and the overview is missing.
The duty of care does not stop at your own walls
NIS2 requires organisations to demonstrably control cyber risks from the supply chain. That means: knowing which suppliers exist, which security and continuity requirements are in the outsourced contracts, and which arrangements are still open. For NIS2 healthcare supplier contracts, this is not about one party, but about the entire chain of outsourced services.
A hospital with 200 supplier contracts quickly has dozens of parties with digital access to critical systems. The EHR supplier is obvious. The party behind the building management system, the access control and the climate installation much less so, even though they often have remote access to systems that directly affect care continuity. These FM suppliers are listed in the procurement records as facility management and are therefore rarely viewed as a cyber risk.
Not every supplier is equal: risk-based segmentation
You are not going to approach every contract in the same way. Start by segmenting on risk. For healthcare, that looks like this in concrete terms:
- High risk: EHR, hosting, medical technology, medication systems, building management system (BMS). A failure or incident directly affects care.
- Medium risk: suppliers with access to personal data or your network, without being able to bring care to a standstill directly.
- Low risk: parties without digital access to systems or data.
The lesson here: segment on digital access and continuity impact, not on procurement category. An access control party with remote access belongs in the highest category, even if it is booked as facility management. Start with your high-risk suppliers and work back from there. Tackling everything at once does not work.
Which requirements must be demonstrably in your contracts
NEVI advises reviewing existing and new contracts and supplementing them with provisions on information security, incident reporting and supervision. For high-risk suppliers in healthcare, these are the arrangements that must be demonstrably recorded:
- Incident reporting obligation with concrete reporting deadlines
- Patch policy and logging
- Back-up and recovery arrangements
- Audit rights: are you allowed to check whether the supplier does what was agreed?
- Subcontracting: do you know who your supplier in turn engages?
- Exit and data portability: do you get your data back on termination?
- Continuity arrangements in case of failure of critical systems
This list is not a legal template but an assessment framework. The point is not to write every clause yourself, but to know per supplier which of these arrangements are in place and which are missing.
Why a questionnaire or certificate is not evidence
A completed security questionnaire or an ISO certificate from your supplier feels like a tick-box moment. It is not. Trustbound and ABN AMRO rightly point out that a certificate does not replace your own risk analysis. The IGJ does not want to see that you once sent out a questionnaire. The supervisory authority wants to see which arrangements are contractually recorded, which deviations you have consciously accepted and how you follow up on open points.
That shifts the question from “did we ask?” to “is it recorded, and where?”. And that is exactly where most healthcare organisations get stuck, because the answers sit in addenda, mailboxes and people’s heads.
In healthcare, continuity matters just as much as security
In healthcare, the availability of care is at least as important as preventing a data breach. An EHR that fails, a medication system that is unavailable, a BMS that no longer regulates the climate in an operating theatre complex: these are direct risks to patients. That is why, alongside security, a second axis belongs in your contracts: continuity. Think of escrow arrangements, a workable exit scenario and arrangements for disaster recovery of critical systems. These arrangements are often forgotten because they do not fall under the security label, but they are just as necessary.
Your supplier register as proof
The bridge between all these requirements and demonstrability is a supplier register: recording per supplier which requirements are in the contract, which risk category applies and which arrangements are open. Not in a loose Excel file that nobody maintains, but in a place where the overview stays current and where, when the IGJ asks, you can immediately show how the chain stands.
An honest boundary belongs here. GRIP is contract management software for supplier contracts of Dutch organisations in healthcare, education and the public sector. GRIP is not a cybersecurity tool and does not make you NIS2-compliant. What GRIP does do: give grip on the contract side of the duty of care. In the Contract Dashboard, you record per supplier which requirements are in place and which arrangements are open, so you can make the chain demonstrable. KAIA reads in your contracts and recognises the relevant clauses, so you do not have to manually work through 200 contracts. GRIP operates under ISO 27001 and processes contract data exclusively within Europe.
Frequently asked questions
When did the Cybersecurity Act come into force for healthcare?
The Cbw came into force on 15 August 2026, published in Staatsblad 2026, 189. There is no general transition period. Only higher education is given three years. For healthcare, the law therefore applies immediately.
Who supervises NIS2 in healthcare?
The IGJ is the sectoral supervisory authority for healthcare. The IGJ can ask you to demonstrate that you control cyber risks from the supplier chain, with evidence per supplier.
Do facility suppliers also fall under the duty of care?
Yes, if they have digital access to critical systems. A building management system, access control or climate installation with remote access affects care continuity and therefore belongs in your risk inventory, even if the supplier is booked as facility management.
Which requirements must be in my supplier contracts?
For high-risk suppliers at minimum: incident reporting obligation with reporting deadlines, patch policy, logging, back-ups, audit rights, arrangements on subcontracting, exit and data portability, and continuity in case of failure of critical systems.
Is a certificate from my supplier sufficient evidence?
No. A certificate does not replace your own risk analysis. The supervisory authority wants to see which arrangements are contractually recorded, which deviations you have accepted and how you follow up on open points.
Does GRIP make my organisation NIS2-compliant?
No. GRIP is not a cybersecurity tool. GRIP gives grip on the contract side of the duty of care: recording per supplier which requirements are in the contract and which arrangements are open, so you can make the chain demonstrable.
See how you record requirements and open arrangements per supplier in the Contract Dashboard and book a demo.