Generally not—but there are exceptions. Companies , that provide critical services (e.g., in healthcare or digital infrastructure) may also be affected below the thresholds. In addition, large companies subject to NIS2 are increasingly requiring compliance evidence from their suppliers.