Article 22Union level coordinated security risk assessments of critical supply chains

Article 22 lets the NIS Cooperation Group, working with the Commission and ENISA, carry out coordinated security risk assessments of the supply chains of specific critical ICT services, systems or products. Both technical and, where relevant, non-technical risk factors may be considered. The Commission, after consulting the Cooperation Group and ENISA, identifies which services, systems or products may be assessed. The power is permissive: nothing obliges the Group to assess any particular supply chain.

The reason this matters to an entity lies in Article 21(3). Member States must ensure that entities choosing supply chain measures are required to take the results of these assessments into account, alongside the vulnerabilities and practices of each direct supplier. A published Union-level assessment is therefore an input to supplier decisions, not just background reading. The Directive does not say what an entity must conclude from one, only that it must be considered. Assessments exist only where the Group has carried one out, so the practical first step is to check what has been published.