NIS 2 and the EU AI Act for purchasing teams
- Both regulations reach a purchasing team through the same two places: the supplier record and the contract.
- NIS 2 makes supply-chain security a sourcing criterion, something you assess before you sign and keep watching after.
- Most purchasing AI is not high-risk under the AI Act, so the real job is vendor due diligence and staff literacy, not a compliance project.
Compliance rarely arrives as a directive you read cover to cover. It arrives as a clause in a renewal, a questionnaire with forty rows, a line in a tender that was not there last year. For most companies, NIS 2 and the EU AI Act both land in the same practical place: the supplier record and the contract, which is where a purchasing team actually works.
NIS 2: supply-chain security becomes a sourcing decision
NIS 2 asks in-scope companies to manage the security of their supply chain. In plain terms, a supplier's security stops being only their business. You assess it before you sign, you write an incident-notification window and an evidence right into the contract, and you keep watching the suppliers that matter. And because in-scope customers pass these requirements down, you will be asked the same questions by your own buyers, so a purchasing team ends up running the obligation in both directions.
This is supplier management with a security column added. Handled as part of the supplier record, it is routine. Handled as a separate binder re-sent once a year, it is always a scramble.
The AI Act: the deadline moved, the duties did not vanish
In 2026 the EU deferred the high-risk obligations of the AI Act, but it removed none of them, and the lighter duties already apply. The reassuring part for a purchasing team is that the AI that helps you buy, scoring suppliers, comparing offers, checking documents, is generally not on the high-risk list, which covers areas like recruitment and consumer credit. What does apply is lighter: be transparent about where AI is used, make sure the people using it understand it, and when you buy AI-enabled software, ask the vendor where it sits under the Act and write the answer into the contract.
One place to manage both
Step back and the two regimes stop looking like two projects. NIS 2 adds a security posture and an evidence trail to each supplier. The AI Act adds a due-diligence status to each vendor that sells you software. Both are attributes of a supplier you already manage. Keep them there, next to price and delivery, and compliance becomes part of the sourcing decision rather than a parallel chore. None of this is legal advice, so confirm your own in-scope status with counsel.