Home / Qualification
Qualification
Direct or contractual exposure
Being a supplier to a European client does not automatically mean being directly subject to every European text.
Exposure profile
What the context changes in this analysis.
Data transferTo be qualified according to actual flows
Bilateral relationshipNo automatic effect on audit
Country sourcesTo be verified depending on the country
Country file
Country benchmarks
Sources reviewed on —
01
Economy and sectors
What this data indicates
02
Incidents, fraud and impersonation
Risks observed
03
Points to check within your organisation
What your client may ask you to demonstrate
Developments to be aware of
The topics that may change your answers
What this means for your situationUnderstand the country's effects on your European relationship →
How to read this data. Statistics describe populations, reports or incidents using different methodologies. They provide context; they measure neither your organisation's compliance nor its likelihood of suffering an attack.
Assumptions, limitations and sources of this reading
Reading point
Qualify before claiming
A useful conclusion separates a possible direct obligation, a contractual requirement, a data transfer and a voluntary expectation.
- Identify the contracting entity and the service concerned
- Separate direct obligation from passed-through requirement
- Qualify data, systems and product
- Reserve formal legal interpretation
Decision map
Distinguish what directly affects the business from what the client passes on contractually.
Entity and activity
A European rule may apply directly to the company, its product or its establishment.
Client relationship
A requirement can be imposed by contract without making the supplier directly regulated.
Data and access
International flows create their own roles, safeguards and access conditions.
Conclusion
Each effect retains its source, its status and any validation required.
Decision path
Before concluding on the organisation's exposure
Four qualifications prevent a client request from being wrongly presented as a general regulatory obligation.
01Relationship reviewed
Name the contracting entity, the recipient of the rule, the goods or service provided and the relevant places of performance.
02Origin of the requirement
Establish whether the requirement stems from applicable legislation, the contract, a procurement policy, or a voluntary reference choice.
03Expected accountability
Determine who must decide, who implements the capability and who can validate the legal interpretation when it remains open.
04Qualified conclusion
State separately the possible direct effect, the contractual commitment, the voluntary reference and the point subject to legal validation.
Points to be reviewed
The facts that make it possible to separate direct exposure from contractual commitment.
Questions to address
- "Are you subject to NIS2 / DORA?" — often asked as such, without distinguishing between channels
- The list of your entities and their contractual role
- Your obligations passed down by other clients
- What you would refuse to sign and why
Elements that support the response
- Mapping of entities and contracts
- Register of engagements by client
- Written positions on standard clauses
- Legal qualifications already obtained
Confusions to avoid
- Answer "yes" to applicability out of commercial caution
- Confusing the client's obligation with one's own
- Paying for full compliance where a contractual response would have sufficed
- Ignoring the contractual channel because "the law doesn't apply"
Assurance file, EX-021Demonstration example
Initial belief“NIS2 applies directly to us”Finding
QualificationNon-EU provider, outside listed sectorsFinding
Actual channelRequirements arrive through the client's contractFinding
Divergence observedBudget directed towards compliance that was not requestedGap
ImpactMonths invested alongside the client's real expectationGap
ActionRespond to the actual clauses, trace applicabilityDecision
Reading the coloursFactual observationGap or riskDecision or action
Demonstration
Separate the exposure pathways before drawing a conclusion.
The case shows how the same request can fall under the applicable text, the contract, a data flow or a voluntary reference, without conflating their effects.
Understanding how evidence is qualified →Apply this reading
Describe the relationships that need to be distinguished.
The entities concerned, the contracts, the products or services and the main data flows are enough to separate the initial exposure hypotheses.