Are you entitled to know when your counterparty is hacked?

Read this article in Norwegian.

On 27 October 2026, the Norwegian National Security Authority (NSM) raised the national cyber risk level to high and made its assessment public for the first time. Over the past six months, NSM has seen a threefold increase in successful cyber operations against Norwegian businesses. It identifies the use of large language models and agentic AI systems in cyber operations as a serious risk. On 21 October 2026, Microsoft reported that, since September, a state-affiliated actor had been using the agentic AI framework ARTEX to automate attacks against hundreds of organisations in sectors including energy, manufacturing, finance, software and legal services. In several cases, attackers gained privileged access to an organisation’s cloud environment less than three hours after initial targeting. The entry point was a compromised service provider.

Against this backdrop, Schjødt is launching Cyber Readiness & Response, a legal and organisational framework that prepares businesses to respond to serious cyber incidents.

One aspect of cyber readiness is too often overlooked. Whether your counterparties must tell you when a security incident occurs.

The law contains detailed notification rules in certain areas. Under the GDPR, a controller must report a personal data breach to the Norwegian Data Protection Authority no later than 72 hours after becoming aware of it, and a processor must notify the controller without undue delay. The Norwegian Digital Security Act requires operators of essential services to notify the supervisory authority, with a copy to NSM, within 24 hours of becoming aware of an incident that has a significant impact on the delivery of the service. For the financial sector, DORA adds its own rules.

In energy, shipping and infrastructure, some of a company’s most valuable information is often held outside its own systems. Vessel designs, process and system drawings, reservoir and production data, technical specifications, pricing and contract information, source code, vulnerability reports and operational data are shared with yards, equipment suppliers, customers, advisers, classification societies and software providers. Other industries face the same issue with transaction materials, strategies, tenders and financial models. If one of these parties suffers a security breach, there is no general statutory obligation, outside specifically regulated circumstances, to ensure that you are notified.

The Norwegian Trade Secrets Act makes contractual safeguards all the more important. Protection under the Act requires the holder to have taken reasonable steps to keep the information secret. The preparatory works expressly identify contractual confidentiality obligations imposed on contractors and external partners as a relevant measure. Inadequate contractual safeguards may therefore affect not only the response to a breach, but also whether the information qualifies for legal protection as a trade secret.

Most contracts say a great deal about keeping information confidential and very little about what should happen if that confidentiality is breached. The general conditions of supply used across Nordic industry, NL 17 and Orgalim S 2022, prohibit the onward disclosure of drawings and documents but impose no express obligation to notify if they are nevertheless compromised. Most confidentiality agreements take the same approach. Where notification is addressed, it is often limited to an obligation to “notify promptly”, with no defined trigger, deadline or required content.

The largest gap often lies in a company’s own standard terms. Many companies in energy, shipping, infrastructure and manufacturing use purchasing terms, supplier terms, framework agreements and confidentiality agreements that have been carried forward and revised over many years. They may specify in detail who may receive confidential information, yet say nothing about what the supplier must do if an unauthorised party gains access to it in a security incident. An updated internal cyber policy offers little protection if the contract with the party actually holding the information has not been updated as well.

The latest standard forms have begun to address this gap. In December 2025, NF 25 and NTK 25, the Norwegian standard forms for offshore fabrication and total contracts, introduced a new Article 35 on digital security. It requires each party to notify the other party’s contact point without undue delay of security incidents liable to affect that party. The notification deadline, the information to be provided and the parties’ cooperation obligations are left to an appendix that they must complete themselves. SHIP25, the Norwegian standard shipbuilding contract issued in October 2025, goes furthest. The Builder is subject to a twelve-hour deadline for notifying the Buyer of security incidents, including those at subcontractors, and must provide an initial assessment of their severity and consequences. However, the obligation relates to the vessel and the Builder’s scope of supply, rather than the Buyer’s confidential information as such. The Builder’s liability for breach of the clause is capped at 0.25 per cent of the contract price.

For a great many contracts, the answer to the question in the headline is therefore still no.

Microsoft’s ARTEX case illustrates what this acceleration means in practice. In several attacks, less than three hours elapsed between initial targeting and privileged access. NSM’s basic principles for ICT security, which underpin the measures announced on 27 October, recommend that organisations check whether their suppliers have procedures for incident handling and security reporting. The organisation must ensure that its contracts specify whom the supplier must notify and how quickly.

Some organisations must also meet statutory notification deadlines of their own. Under the Norwegian Digital Security Act, operators of essential services must notify within 24 hours of becoming aware of an incident. NSM has stressed that this deadline is absolute, even if the incident occurs at a partner or subcontractor. Contracts, insurance terms and stock exchange rules may also require notification or other action. When an attack unfolds within hours, a contract that allows a supplier to delay notification until its own investigation is complete is not good enough.

In our view, notification of security incidents should be a routine part of the parties’ contractual arrangements, just as notification of delay and defects already is. A notification clause should be included in confidentiality agreements, standard terms and key supplier and commercial partner agreements. It should address at least six matters.

• The trigger. The obligation should cover actual or reasonably suspected unauthorised access, without requiring proof that information has been used or exfiltrated.
• The deadline. Specify a maximum notification period in hours, calibrated to the sensitivity of the information and the organisation’s own notification obligations. Market practice ranges from twelve hours under SHIP25 to 72 hours where the buyer’s own regulatory deadlines govern the approach. For particularly valuable information, the starting point should be at the lower end of that range.
• The initial notification. Require notification on the basis of the information available at the time, without waiting for the investigation to be completed.
• Containment and evidence. Require the supplier to limit the damage and preserve logs and other relevant evidence.
• The contractual chain. Require equivalent obligations to be passed down to subcontractors, advisers and providers of cloud and AI services.
• Costs. Expressly allocate responsibility for the reasonable costs of investigation, notification and mitigation.

The clause should be mutual. Most businesses are both buyers and suppliers, and the obligations they require of their suppliers are likely to be required of them by their customers. A cyber clause is only as effective as the contractual chain supporting it. A robust clause in the agreement with the main supplier offers little protection if that supplier lacks equivalent rights against the subcontractor where the incident occurs. Contractual notification obligations must also be aligned with the organisation’s own incident response arrangements. A contractual deadline is only worth something if the organisation is itself able to meet it.

The board and management should ask for answers to four questions.

• What proprietary and competitively sensitive information have we shared with suppliers, customers and partners?
• Which of these parties are contractually required to notify us of a security breach, and how quickly?
• Have our standard terms, confidentiality agreements and key supplier and commercial partner agreements been updated to address cyber incidents, and do notification obligations extend throughout the contractual chain?
• Is our own organisation able to meet the notification deadlines that customers, regulators and insurers impose on us?

Schjødt has developed a standard clause on notification of security incidents, adapted to the individual business and industry, and assists with the review of confidentiality agreements, standard terms and supply agreements. The review forms part of Schjødt Cyber Readiness & Response, under which we also establish a notification matrix, a legal response plan and a pre-agreed response team, and are available around the clock when an incident occurs. Please contact Torkel Hope, Camilla Bråfelt, Stian S. Tennfjord or your usual contact at Schjødt.

The question the board should ask today is a simple one. If a supplier, customer or adviser with access to our most valuable information is compromised tonight, will we find out in time, and do we know what to do tomorrow morning?