You are not on the list. Your customer is.

# You are not on the list. Your customer is.

When the Norwegian digital security act came into force on 1 October 2025, most Norwegian SMBs did the same thing: read the headline, looked for their own industry in the list, did not find it, and moved on.

The conclusion was right. The action was wrong.

The act covers providers of essential services — energy, transport, health, water supply, banking, financial market infrastructure and digital infrastructure — plus certain digital services such as cloud providers, online marketplaces and search engines. If you run a twelve-person accounting firm, make specialist components, or sell IT services locally, you are not covered.

Then look at section 14.

It sets out the duty of follow-up: a covered provider must ensure that suppliers, and others doing work that can affect security, do it in a way that meets the requirements. Through agreements or other suitable measures.

That is the whole mechanism. The act places no duty on you. It places a duty on your customer to bind you.

How it reaches you

Not as a letter from a regulator. It arrives as an attachment to a contract you would rather keep.

A security questionnaire before renewal. A new clause saying you must notify within a set number of hours. A requirement to document who at your end has access to their data. A question about who your security contact is, by name.

None of it arrives labelled "this is because of section 14". It arrives because the person doing the buying now has a duty they have to answer for.

And the timescales are not generous. A covered business must notify the supervisory authority within 24 hours of becoming aware of a serious incident, update that information within 72 hours, and deliver an incident report within one month. If the cause sits with a supplier, the supplier has to have answered long before that.

Three questions you should be able to answer without calling a meeting

Who at your end can reach the customer's data, and how would we see it afterwards? Not "we have access control". Who, specifically, and what is logged.

What happens in the first 24 hours? Who notices, who tells the customer, and through which channel. If you have never rehearsed it, you do not have an answer — you have an intention.

Who is responsible, by name? Not a department. A person, who will be at work tomorrow.

If you can answer those three in writing, you will handle most of the questionnaires that come your way. If you cannot, you end up in the buyer's pile of suppliers who need extra follow-up — and that pile gets shortened at regular intervals.

What about NIS2?

This is worth being precise about, because a lot of what is written on it right now is not.

The act in force in Norway today implements NIS1. NIS2 — the expanded directive that covers far more businesses across the EU — has not yet been written into Norwegian law. The National Security Authority says it will come "in due course", together with the CER directive. As of September 2026 there is no date.

That does not mean you can wait. It means the opposite: the requirements reach you through your customers before they reach you through the law. Waiting for a date that does not exist is not a strategy.

One more thing, which surprises people: for providers of essential services there is no size threshold. A small waterworks is covered. A 200-person company in another industry is not. What decides is what the business delivers, not how big it is.

That is useful to know when you are on the other side of the table, wondering why a small customer suddenly has large demands.

The act is not yours. The requirements become yours anyway.