Compliance knows where it stands
Every supplier requirement has a Control, an owner and evidence – not a spreadsheet updated before the audit.
Solutions · Supplier contracts under NIS2 and DORA
Are your supplier contracts ready for NIS2 and DORA?
Both regulations make your suppliers your responsibility – and the contract is where that responsibility is written down. See which agreements lack the required terms, who owns each gap and what proves it is closed.
LegalProcurementCompliance
Supplier contracts · NIS2 art. 21.2 d
- In scope14 contracts
- Security terms missing3 contracts
- OwnerLegal · due 30 Nov
Sound familiar?
Sound familiar?
“We know NIS2 covers our suppliers. We don't know which contracts fall short.”
“Compliance owns the requirement. Legal owns the contract. Nobody owns the gap.”
“When the supervisor asks, we would rebuild the answer from email.”
Why now
The requirement sits in the regulation. The proof sits in the contract.
NIS2 article 21 asks for supply chain security, including your direct suppliers. DORA articles 28 and 30 require a register of ICT providers and set out what their contracts must contain. Meeting either means connecting the rule to the clause – and keeping it connected.
How it runs in Paragraf
From the regulation to the clause to the proof.
Step 1 of 5
Start from the requirement.
NIS2 and DORA come ready as frameworks. Each supplier requirement becomes a Control with an owner.
Control · Supply chain security
- SourceNIS2 art. 21.2 d
- Applies toCritical suppliers
- OwnerCISO
Step 2 of 5
Find the contracts in scope.
Your supplier agreements are read and linked to the Counterparties and services they cover.
Repository · Supplier agreements
- Agreements read48
- Critical suppliers14
- ICT providers (DORA)9
Step 3 of 5
See exactly what is missing.
Each contract is checked against the required terms. Luis points to the clause – or to its absence – and shows the source.
Gaps · 3 of 14 contracts
- Nordlog ABNo incident notice term
- CloudOpsNo audit right
- FieldservNo exit plan
Step 4 of 5
Every gap gets an owner.
Legal gets the approved clause to propose. Procurement gets the supplier review. Both are dated and tracked.
Workflow · Close the gap
- AmendmentLegal · due 30 Nov
- Supplier reviewProcurement · step 3 of 5
- Approved clause§ 14.2 Incident notice
Step 5 of 5
Show the thread when asked.
Requirement, clause, owner and signed amendment sit in one record. When the supervisor or the board asks, you open it.
Chain of proof · Nordlog AB
- RequirementNIS2 art. 21.2 d
- Clause§ 14.2, signed with BankID
- StatusChain unbroken
What you get
Three teams, one thread.
Legal fixes it once
Approved clauses for incident notice, audit rights and exit, used in every new contract and every amendment.
Procurement keeps it true
New suppliers go through the same review from day one, so the gap does not come back.
Start here
Send us 10 supplier contracts. See the gaps.
Pick ten agreements with suppliers you consider critical. We run them against NIS2 or DORA in Paragraf and walk you through the result: what is covered, what is missing and where the source is.
- Your dataProcessed under a signed DPA, in the EU, and deleted after the review unless you continue.
- Your timeOne hour to choose the contracts, one hour to go through the result.
- Your decisionYou keep the gap list either way.
Before you decide
The questions that usually hold teams back.
Does this depend on AI?
No. Requirements, clauses, owners and evidence work without Luis. Luis makes the review faster, always shows the source and never changes anything without your approval.
Who needs to be involved?
Legal and Procurement to choose the contracts, Compliance to confirm the scope. That is usually three people and two hours.
What happens to our contracts?
They follow your permissions, sensitive data is masked on the server and every change is logged. Ask us where data is stored and how export works – we answer in writing before you send anything.
What if we already have a contract system?
Start with the review. Paragraf connects to what you already have through API and MCP, and you decide what moves.
For the buying group
Everyone in the decision gets an answer.
This is what each of them can say when they bring it to the others.
- General Counsel“I know which contracts fall short, and the fix is our own approved wording.”
- Procurement“New suppliers meet the terms from the start.”
- CISO“Supply chain security is a Control with evidence, not a promise.”
- CFO“No consultant project to answer the supervisor.”
Next step
Know your gaps
before the supervisor does.
Send us ten supplier contracts, or book a walkthrough of your requirements. Either way, you see the thread from requirement to proof – with your own contracts.