- It can, but not automatically. A SaaS product can fall under NIS2 through the cloud computing definition, but only if you also meet the size test and sit under a Member State's jurisdiction.
- Even if you are out of scope, your customers may not be. In-scope buyers must take account of their suppliers' secure development procedures, and they will ask you.
- Build the incident process before launch. An early warning is due within 24 hours of becoming aware of a significant incident, then a notification at 72 hours and a final report within a month.
Does NIS2 apply to SaaS companies? It can, if you are medium-sized or larger and fall under an EU Member State's jurisdiction. NIS2 sets a single legal framework for cybersecurity across 18 critical sectors, and Member States had until 17 October 2024 to transpose it. It repealed the original NIS directive from 18 October 2024. A pure SaaS vendor is not named as its own category, so the question is which definition you fall under. This article walks through that, then through what you need in place before you ship.
This is a founder's guide, not legal advice. Your national law and your exact service decide the answer, so confirm with a lawyer before you rely on it.
How a SaaS product ends up in scope
There is no box labelled "SaaS". Implementing Regulation (EU) 2024/2690 gives technical requirements, and defines significant incidents, for a closed list of entity types. That list includes cloud computing service providers, managed service providers, managed security service providers, online marketplaces, search engines and social platforms.
According to one secondary analysis, there are two entry routes for SaaS: the managed service provider definition and the cloud computing service definition. The same source says recital 33 states that the cloud definition explicitly covers Software as a Service. Read recital 33 on EUR-Lex yourself before you decide, because your scope hinges on this point.
In practice, ask three questions:
- Does your product fit the cloud computing service definition?
- Does it fit the managed service provider definition?
- Are you an online marketplace, search engine or social platform? Those are named separately.
The size test
Being in a covered category is not enough. NIS2 generally applies to entities at or above medium-sized enterprise criteria: 50 or more employees, or annual turnover or balance sheet above EUR 10 million.
A small startup under both limits is generally outside the size test. Two things are still worth knowing. Growth can push you over the threshold, so build the habits early. And being under the threshold does not remove the pressure from customers, covered below.
Which country's rules apply
For cloud computing, managed service and similar providers, jurisdiction sits with the Member State where you have your main establishment in the Union. That matters because NIS2 is a directive, and each country writes its own law.
Transposition is uneven. On 8 July 2026 the Commission referred Ireland, Spain, France and the Netherlands to the CJEU for failing to notify full transposition. A tracker dated 16 October 2026 says a national law is in force in 24 of 27 EU countries, with France, Ireland and Spain still without one. The two sources differ on the Netherlands, so check the current status for your country rather than trusting either snapshot.
What is at stake
The directive makes top management accountable for non-compliance with the cybersecurity risk-management measures. That puts the issue on the founder's desk, not only the engineer's.
On fines, Article 34 sets the following maximums:
| Category | Maximum fine (whichever is higher) |
|---|---|
| Essential entities | €10 million or 2% of global turnover |
| Important entities | €7 million or 1.4% of global turnover |
The security measures you need in place
Article 21 sets ten minimum measures. They run from risk analysis and incident handling to supply chain security, cryptography and multi-factor authentication. They also include security in system acquisition, development and maintenance, including vulnerability handling and disclosure.
For a web app, that translates into concrete engineering work:
- Risk analysis: a written threat model and a list of the systems and data you protect.
- Incident handling: a runbook, named owners and a way to detect problems quickly.
- Supply chain security: an inventory of your dependencies, hosting and third-party services.
- Secure development: a process to receive, handle and disclose vulnerabilities.
- Cryptography: encryption with sensible key management.
- Access control and MFA: multi-factor authentication for staff and admin access at minimum.
It is easier to design these in than to retrofit them after launch. If you are planning a build, see our software development service.
The 24-hour incident reporting clock
Reporting runs in three stages. An early warning is due within 24 hours of becoming aware of a significant incident, an incident notification within 72 hours, and a final report within one month. The one-month clock runs from submission of the 72-hour notification.
| Stage | Deadline | What it contains |
|---|---|---|
| Early warning | Within 24 hours of awareness | Whether malicious acts are suspected and whether there is cross-border impact |
| Incident notification | Within 72 hours | Initial severity and impact assessment and, where available, indicators of compromise |
| Final report | Within one month of the notification | Not covered here; check your national authority |
The content details for the first two stages come from this reporting guide. Before launch, settle three things: how you will know an incident exists, who decides it is significant, and who files the report.
What counts as "significant" for a cloud provider
For cloud providers, a service completely unavailable for more than 30 minutes, or limited for more than 5% of EU users (or 1 million users, whichever is smaller) for over an hour, qualifies. Direct financial loss above EUR 500,000 or 5% of annual turnover, whichever is lower, also qualifies.
A 30-minute full outage is a short window. Your monitoring needs to show quickly whether the service is down and what share of EU users is affected.
Why it matters even if you are below the threshold
In-scope entities must take account of each direct supplier's vulnerabilities and overall cybersecurity practices, including its secure development procedures. Customers in scope will push these questions onto you and your dev studio.
So the practical advice for a small SaaS is to behave as if you were in scope, in proportion. Keep a written incident process, an asset and dependency list, and evidence of secure development.
Pending changes: do not plan around them yet
The Digital Omnibus, introduced 19 November 2025, would add a single entry point for incident reporting. It would also extend the GDPR breach deadline to 96 hours and limit reporting to high-risk cases, according to this crosswalk. None of this has been adopted, and the NIS2 24h/72h/one-month timing stays as it is today. Build for the current rules.
A pre-launch checklist
- Decide whether your service fits the cloud computing, managed service or marketplace definitions, and read recital 33.
- Count headcount, turnover and balance sheet against the medium-sized thresholds.
- Identify your main establishment in the EU and check that country's transposition status.
- Write a threat model and an asset and dependency inventory.
- Turn on MFA, encrypt data, and set up a vulnerability disclosure channel.
- Set up monitoring that shows availability and the share of EU users affected.
- Write the incident runbook with the 24h, 72h and one-month steps, and name the person who files.
- Get a lawyer to confirm your scope.
If you want to see how scope, security work and timeline fit together for a build, try our project planner or see pricing.
FAQ
Does NIS2 apply to every SaaS company?
No. It depends on whether your service falls under a covered definition, such as cloud computing or managed services, and whether you meet the medium-sized threshold of 50 or more employees or more than EUR 10 million in turnover or balance sheet. A pure SaaS vendor is not its own named category, so check the definitions and your national law.
When does the 24-hour clock start?
It starts when you become aware of a significant incident. You then owe an early warning within 24 hours and a notification within 72 hours. The final report is due within one month of submitting that notification.
We are a small startup below the size threshold. Can we ignore NIS2?
Legally you may be outside it, but customers in scope must take account of their suppliers' cybersecurity practices, including secure development procedures. Having the basics documented will help when they ask.
Is GDPR breach reporting the same thing?
No. GDPR has its own breach deadline. The proposed Digital Omnibus would extend it to 96 hours and add a single entry point for incident reporting, but none of it has been adopted.
