Does NIS2 apply to SaaS companies? Scope explained

Does NIS2 apply to software and SaaS companies, and when?

A software or SaaS company is in NIS2 scope directly only if one of its services falls in an Annex I or Annex II category, it is at least a medium-sized enterprise (or exceeds those ceilings under Recommendation 2003/361/EC), and it provides services in the EU. If any of those conditions fails, the company is usually affected through its customers, who must manage security across their supplier relationships. Your customer questionnaire or contract clause is most likely a sign of the second case, but you should test it against the first before you accept the obligations it describes. The answer depends on three things: the service model you actually operate, the size test applied to your company, and the national transposition law of each Member State where you provide services. Cloud computing, managed services and online platforms are named categories in NIS2, but a product sold as software and hosted by the customer may fall outside them. Start by listing each product line, how it is delivered (hosted by you, managed for the customer, or installed on the customer's premises) and who operates it. Then check headcount, turnover and balance sheet totals against the size thresholds, and confirm with counsel or your national competent authority how your transposition law treats your category.

The organization makes this determination, not a vendor, consultant or auditor. A consultant can prepare the analysis and document its reasoning, and an assessor can review it, but the company's management body owns the conclusion and the Article 20 accountability that follows from it. Record the scope decision, the facts it rests on and the date it was made, and revisit it when you change service models, grow past a size threshold or when the proposed amendments to NIS2 (COM(2026) 13) move through the European Parliament and the Council. Ask each customer which NIS2 entity category they believe they belong to and which clauses they expect you to meet, because the answer determines whether you face direct supervision or contractual flow-down.

Four routes by which a software company ends up in scope

A software company rarely falls under NIS2 because it writes code. It falls under NIS2 because of the service it delivers, the size test it meets, and whether it runs or manages systems for others. The four routes below separate direct entry from indirect exposure through customers.

Cloud computing service provider

A SaaS product or hosted PaaS offering is a cloud computing service under NIS2, which lists Software as a Service and Platform as a Service among the cloud service models. Such a provider sits in Annex I only if it meets the size test for medium-sized enterprises or larger and provides services in the Union. Check the delivery model, whether customers reach the service on demand over the network, and whether your headcount and financial figures cross the Recommendation 2003/361/EC ceilings.

Managed service provider

A company that installs, manages, operates or maintains customers' ICT products, networks, infrastructure or applications falls under the managed service provider definition, whether it does this remotely or on the customer's premises. Support contracts, monitoring, patching and administration for customer tenants all count. Check whether your staff actively administer customer systems or only sell software, because active administration is what moves a vendor into this category.

Annex II digital provider

Online marketplaces, online search engines and social networking services platforms are digital providers in Annex II. A software company that operates a marketplace where third parties sell products, or a public-facing platform for social networking, falls here. This route is separate from the SaaS route, and the classification is tested against the platform's actual function rather than its technology stack. Check whether your product matches one of these three defined service types.

Affected through customers only

A software company that meets none of the three routes is outside direct scope but still feels NIS2. In-scope customers must manage security across their relationships with direct suppliers and service providers under Article 21(2)(d), so they will ask for security commitments, evidence and contract terms. Check which of your customers are essential or important entities, what they will request in questionnaires, and whether your product must support their supplier assessments.

Why the size cap decides most software companies, and what the 2026 proposal could change

Under NIS2 as adopted, size is the first test for most software companies. Article 2(1) brings in entity types listed in Annexes I and II only when they qualify as medium-sized enterprises under Article 2 of the Annex to Recommendation 2003/361/EC, or exceed those ceilings, and when they provide services or carry out activities in the Union. A small software company is therefore generally outside direct scope, whatever its product does. Two caveats matter. Member States may adopt or keep stricter rules under Article 5, so a national transposition law can extend coverage to smaller firms, and a company that is outside scope can still be pulled in by customers who must secure their supply chains under Article 21(2)(d). Confirm the national law that applies to your main establishment before concluding that you are out of scope.

Measure size with the Recommendation's staff headcount and the annual turnover or balance sheet total, using the reference period it defines. Count headcount and financial figures for partner enterprises and linked enterprises as well as your own legal entity, because group structures, minority holdings and joint ventures can move a company above the medium-sized ceilings even when the standalone entity looks small. Ask your finance and legal teams to document the calculation, the group chart and the reference year. Revisit it whenever you raise funding, make an acquisition or open a subsidiary, since each can change the result. Note that a company that is in scope for one service may still need to check how each entity type in its portfolio is treated.

On 20 January 2026 the Commission proposed targeted amendments to NIS2 (COM(2026) 13), which include a new small mid-cap category. The proposal would add an intermediate tier for companies that are larger than small enterprises but below the usual medium-sized ceilings, with a lighter regime than full NIS2 coverage. It is a proposal only. It still needs approval by the European Parliament and the Council, and it does not change any obligation today. Plan on the current size cap, track the legislative progress through the Commission's NIS2 Directive page, and ask counsel how any final text would map onto your headcount and turnover once the wording is fixed.

Which software services are likely to trigger direct scope

This table compares common software and SaaS delivery models against the NIS2 category they may fall under. Read each row as a starting question, not a verdict: the outcome depends on the entity's sector annex, size, and what the service actually does for customers. Confirm the classification for your own entity before relying on it.

Service model	Likely NIS2 category	What decides the outcome	What to confirm
SaaS delivered to customers over the internet	May fall under cloud computing (Annex I) if the service is a cloud computing service	Whether the service meets the cloud computing definition: on-demand, broad remote access to scalable, shareable resources	Whether the entity is medium-sized or larger, and whether the service meets the definition in Article 6
Hosted PaaS or IaaS	May fall under cloud computing (Annex I), with EU-level requirements under Implementing Regulation 2024/2690	Whether the entity provides the infrastructure or platform to customers as a service, and where resources are distributed	Whether the entity is in scope by size and establishment, and which technical requirements apply
Managed operation of customers' systems or security monitoring	May fall under managed service provider or managed security service provider (Annex I)	Whether the entity installs, manages, operates or maintains customers' ICT systems, on premises or remotely	Whether the service is provided to customers as a business activity, and the size of the entity
On-premise licensed software with no operation by the vendor	Does not automatically fall under NIS2 as a service provider	Whether the vendor runs, administers or maintains any service on customers' systems	Whether any support or maintenance activity could meet the managed service definition
A product sold as software that is later installed by the customer	Does not automatically fall under NIS2; product security is addressed separately	Whether the vendor provides an ongoing service or only a product, and whether the product is covered by other EU rules	Relevance of the EU Cyber Resilience Act and customer security requirements passed down by contract
An online marketplace or app store	May fall under online marketplaces (Annex II, digital providers)	Whether the platform meets the Annex II definition of an online marketplace	Whether the entity is medium-sized or larger, and its main establishment in the EU
A social network or search service	May fall under online search engines or social networking services platforms (Annex II, digital providers)	Whether the service meets the Annex II definitions for search engines or social networking platforms	Whether the entity is medium-sized or larger, and its main establishment in the EU

What changes for you by situation

If your company is a medium-sized enterprise or larger and provides SaaS in the Union, NIS2 likely reaches you directly. SaaS is one of the cloud computing service models listed in Recital 33, and cloud computing providers appear in Annex I. Whether you are classed as essential or important depends on Article 3 and your national transposition law, so confirm that classification with your national competent authority or counsel.

Article 21 measures: you must run the all-hazards risk-management measures, covering areas such as access control, vulnerability handling and supply chain security, and the implementing regulation sets further technical requirements for cloud providers. See Article 21.
Article 23 reporting: a significant incident triggers the 24-hour early warning, the 72-hour notification and the one-month final report. For cloud services, an outage is significant if a service is completely unavailable for more than 30 minutes, or limited for more than 5% or 1 million EU users (whichever is smaller) for over one hour.
National supervision: the competent authority oversees compliance through inspections, security audits, scans and information requests. NIS2 issues no certificate, so you will need to produce evidence on request.
Customer questions: expect security questionnaires covering your Article 21 measures, evidence of supplier management, and commitments on how quickly you will notify customers of incidents.

First, check whether your service model and headcount place you in Annex I, and identify the authority that would supervise you.

How to confirm your NIS2 status step by step

This sequence turns a general question about NIS2 into a documented decision: which of your services fall under the Directive, whether your company is large enough to be in scope, and how confident you can be in that answer when a customer or supervisor asks.

Inventory every service you deliver
List each product, managed service, hosted platform and support offering your company provides to customers, including who operates it and where it runs. For each one, record the delivery model: software you ship for customers to install on their own systems, a SaaS application you host and operate, a managed service where you administer customer systems, or an online platform. Note whether a service is delivered from your own cloud accounts or from a third party's infrastructure. Output: a service inventory with one row per service, its delivery model, its hosting location and its named owner. The step is done when product and engineering leads have confirmed the list is complete.
Map each service to an Annex I or Annex II entity type
For each row in the inventory, test whether the service matches an entity type named in NIS2. Read the definitions of cloud computing service, managed service provider and managed security service provider in Article 6, and the Annex II digital provider categories. Pure on-premises software sold as a license is generally not a cloud computing service, while a hosted SaaS product may be, and that difference is where many decisions turn. Record the matching Annex entry or the reason none applies. Output: a mapping table with the Annex reference or an explicit no-match note, reviewed by legal or compliance counsel. The step is done when every row has a documented conclusion.
Apply the size test to the mapped entity
For each mapped entity, compare headcount, annual turnover or annual balance sheet total against the medium-sized ceilings in Article 2 of the Annex to Recommendation 2003/361/EC, and include staff and financials of linked enterprises and partner enterprises as that Recommendation requires. An entity that meets the medium-sized test or exceeds it is generally in scope under Article 2(1) if it provides services in the Union. Keep the calculation with source figures, dates and the group structure used. Confirm the figures with finance, because the test depends on how ownership links are counted. Output: a signed size calculation worksheet. The step is done when the result is recorded for each entity, including the group view if the company belongs to a larger group.
Confirm EU provision and the main establishment question
Check whether the mapped services are provided in the Union, including services sold to EU customers from outside the EU and services delivered through EU subsidiaries. Where an entity is established outside the EU but offers services in the Union, identify which Member State it is treated as established in for supervision, and whether it must appoint a representative. Record the facts that support each answer, such as customer locations, contracting entities and where decisions about security are made. Output: a jurisdiction memo listing the Member State or states of supervision and the basis for each. The step is done when counsel has reviewed the memo and it names an accountable owner.
Check the national transposition law for stricter rules
NIS2 is a directive, so the binding rules are those of each Member State that transposed it, and Article 5 allows Member States to keep or adopt higher requirements. Review the national law for each jurisdiction identified in the previous step, including its sector list, any extra entity categories, registration duties, and whether the national authority has issued guidance on digital providers or managed services. Note any sector-specific law that displaces NIS2 for particular activities. Output: a national rules register with the law name, the competent authority and any stricter provisions that affect your services. The step is done when each register entry has been checked against the current text.
Record the decision with reasons and a review date
Combine the outputs of the previous steps into one written scope memo. For each service, state whether it is in scope, the entity category that applies, the jurisdiction, the size basis and the reasons, including services judged out of scope and why. Name the decision owner and the executive who will approve it. Set a review date and list the triggers that would reopen the decision, such as a new product line, an acquisition, a change in headcount or turnover, a new EU customer market, or the outcome of the pending amendments proposed by the Commission. Output: a signed scope memo stored with the service inventory and size worksheet. The step is done when management has approved it and the memo is ready to show a customer's security team or a supervisor.

Common mistakes that lead to wrong scope decisions

Most scope errors for software and SaaS companies come from reading NIS2 by product rather than by activity, customer and corporate structure. The cards below cover the mistakes we see most often, each with the check that corrects it.

Treating ISO 27001 as NIS2 proof

An ISO/IEC 27001 certificate shows that an information security management system exists and is audited. It does not establish that an entity is in scope or that every Article 21 measure is met. Map the certificate's controls against Article 21(2) and the Implementing Regulation 2024/2690 requirements that apply to your service type, then record the gaps. The ENISA guidance includes examples of evidence and framework mappings you can test your own mapping against.

Assuming small size means exemption

Size is a threshold for many entity types, but it does not exempt a company whose customers are in scope. An in-scope customer must manage security across its supplier relationships under Article 21(2)(d), so contracts will push measures down to you. Ask each customer which NIS2 obligations it expects you to meet, and record the answer in the scope file even when your own entity is not covered.

Missing the managed service shift

A vendor that ships software becomes a managed service provider when it installs, manages, operates or maintains systems for customers, whether on their premises or remotely (Article 6(39)). Support contracts that include active administration, patching on the customer's behalf or monitoring can change the classification. Review each professional services and support SKU against that definition before assuming the product scope still applies.

Ignoring group-level size

Headcount and turnover are assessed for the enterprise as a whole, including linked enterprises and partner enterprises under Recommendation 2003/361/EC, not only the company that signs the contract. A small software subsidiary of a larger group can therefore fall outside the small-enterprise exemption. Confirm the group structure and the ownership and partner links, and document the calculation with the figures used.

Overlooking EU customers served from abroad

NIS2 applies to entities that provide services in the Union, and that test does not depend on where the company is incorporated or hosted. A SaaS provider based outside the EU with EU customers may still need to determine its main establishment and Member State jurisdiction. Check where your services are offered, where customers are located, and which national authority would supervise you before concluding that the directive does not reach you.

Not rerunning the scope decision

A scope decision made at product launch can become wrong after a new hosting region, an acquisition, a managed offering or a shift toward larger EU customers. Set a review trigger for each of these events and tie it to the change control process. Keep a dated record of each decision with its owner, so that a supervisor or customer can see when the assessment was last made and why it still holds.

Questions software and SaaS companies ask about NIS2 scope

Does a small SaaS company have to comply with NIS2?

Not automatically. NIS2 applies to entities of the listed Annex I and Annex II types that qualify as medium-sized enterprises or larger under the SME thresholds in Recommendation 2003/361/EC, and that provide services in the EU. A small software company is generally outside the size threshold, but some services are covered regardless of size under specific provisions, and national laws may add rules. Confirm your headcount, turnover and balance sheet against the Recommendation, and check whether your service falls under a listed type such as cloud computing or managed services. The NIS2 Article 2 text sets out the scope rule.

Is SaaS always cloud computing under NIS2?

Usually yes, but the test is the service itself, not the label. NIS2 defines cloud computing as a digital service that enables on-demand administration and broad remote access to a scalable and elastic pool of shareable computing resources. Recital 33 lists Software as a Service among the cloud service models, so a multi-tenant SaaS product that meets that definition falls within the cloud category. A desktop application that runs locally, or a product that only uses a cloud host without offering elastic shared resources to customers, may not. Map each product against the definition before deciding which obligations apply.

What is a managed service provider under NIS2?

A managed service provider is an entity that delivers services related to the installation, management, operation or maintenance of ICT products, networks, infrastructure, applications or other network and information systems, either through assistance or active administration on customers' premises or remotely. Article 6(39) defines the term. Software vendors that operate or administer systems for customers, such as running hosted environments, performing remote administration or maintaining customer applications, can fall within this definition. Pure license sales with no ongoing operational role usually do not. Managed service providers have EU-level technical requirements under Implementing Regulation 2024/2690, so the classification matters.

Can a customer require NIS2 controls in our contract?

Yes. Even when your company is outside NIS2 scope, an in-scope customer must manage security in its relationships with direct suppliers and service providers under Article 21(2)(d). That obligation is the main route by which software vendors are affected. Customers typically pass requirements down as security questionnaires, contract clauses on incident notification, security updates, access controls and audit rights. Negotiate the clauses you can meet, document what you provide, and confirm which controls are contractual commitments and which are best-effort. Legal counsel should review any indemnity or liability terms.

Must we do the NIS2 scope and control work ourselves, or can we hire a partner?

You can hire a partner, but the organization keeps ownership of its controls and decisions. An implementation partner such as DeployOpen can help plan, implement and document systems and evidence, and run security testing. Management remains responsible for approving risk-management measures and for any legal classification decision. A partner does not issue NIS2 reports or certificates. Ask any consultant to state in writing which tasks they perform, which remain with your staff, and what evidence you will own at the end of the engagement. Most engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work begins.

How long does a NIS2 scope review take for a software company?

The duration depends on scope, and no fixed duration applies to every company. A review that covers one product, a clear corporate structure and documented customer contracts will take less time than one covering several products, multiple Member States and many customer agreements. The main drivers are the number of services you provide, how well your architecture and hosting are documented, and whether legal review of sector rules is needed. Ask any provider for a written scope, the deliverables, and a timeline that tracks those drivers before work starts.

Does the January 2026 proposal change the answer for SaaS companies?

Not yet. On 20 January 2026 the Commission proposed targeted amendments to NIS2 (COM(2026) 13), including a new small mid-cap category. The proposal still needs approval by the European Parliament and the Council, and Commission pages describe it as a proposal. Until it is adopted, the current size cap and definitions apply. Track the proposal, because a new category could change which software companies are in scope, and plan your review so it can be updated quickly.

Who issues a NIS2 certificate for our company?

No NIS2 certificate exists. National competent authorities oversee compliance through inspections, security audits, security scans, information requests and administrative fines. Independent auditors and certification bodies issue reports or certificates for other standards, such as ISO/IEC 27001, which you may choose to pursue as evidence for customers. Be careful when a vendor claims NIS2 certification: ask which body issued it, under which standard, and what scope it covers. A readiness assessment or gap analysis is not a certification.

How DeployOpen helps software teams prepare for NIS2 customer requirements

DeployOpen works with software and SaaS teams on the part of NIS2 that usually reaches them: the security evidence their in-scope customers ask for. We start by agreeing in writing which services, systems and customer obligations are covered, then build or harden the self-hosted open-source platforms that produce that evidence inside your own infrastructure.

How we scope

Written scope lists the services, hosted environments and customer contracts covered by the engagement.
We confirm with your legal and compliance team whether your entity type, size and sector apply to you directly.
Scope records which customer security questionnaire and contract clauses the work must answer.

How we build

We configure self-hosted platforms in your cloud accounts or data centers to produce logs, access records and change history.
We harden identity, backup, patching and vulnerability management controls against the scope you agreed.
Security testing of applications, APIs and infrastructure checks that the controls work before customers rely on them.

How we hand over

Documentation covers each control, its owner, its configuration and the evidence it generates.
Your team receives runbooks for supplier questionnaires, incident handling and evidence collection.
Your organization keeps ownership of controls, and an independent auditor or certification body issues any report or certificate.

How we support

Ongoing support, upgrades and continuous testing are available as retainers after handover.
Retainers can keep evidence current as customers change their requirements or the implementing rules are updated.
Confirm with us the support terms, response expectations and deliverables before the written scope is signed.

Does NIS2 apply to software and SaaS companies