IT Law · Digital Law Series, Part 3 | Part 1: Product Liability for Software | Part 2: Cyber Resilience Act · As of: October 2026
A ransomware attack takes your SaaS platform down for half a day, and 400 customers cannot access their data. Under the Cyber Resilience Act, you may not even have to report this, because your hosted backend is not a product. Under NIS2, however, you very likely do: the German BSI Act expects an initial notification within 24 hours. It will also later ask whether your management approved and supervised the security measures.
In the second part of our series, we showed that pure SaaS often falls outside the CRA. This article therefore closes the gap. You will learn when your software company falls under NIS2, which obligations have applied since December 2025, how reporting to the BSI works and why NIS2 affects you even if you are not covered yourself.
In short: NIS2 has applied in Germany since 6 December 2025 through the revised BSI Act (BSIG). It covers companies with 50 or more employees or more than EUR 10 million in turnover and balance sheet total in certain sectors. For software companies, the key sector is information technology, including cloud computing services, data centres and managed service providers. Affected companies must also register with the BSI, implement risk management and report significant incidents within 24 hours.
Key points at a glance
- NIS2 regulates the company, not the product. It is about the security of your operations and services.
- SaaS is cloud computing. Many SaaS providers therefore fall under NIS2, even if the CRA does not cover them.
- Size matters: As a rule, you are covered from medium-sized company level upwards.
- Three reporting stages: 24 hours, 72 hours, one month. Reports go to the BSI.
- Management is liable for implementation and must undergo regular training.
What is NIS2?
The NIS2 Directive (EU) 2022/2555, NIS2 for short, is the second generation of European cybersecurity law for companies. Unlike the Cyber Resilience Act, however, it is a directive and therefore had to be transposed into national law. Germany did this with the NIS2 Implementation and Cybersecurity Strengthening Act (NIS2UmsuCG), which completely revises the BSI Act (BSIG). It entered into force on 6 December 2025, without a transitional period for the substantive obligations.
As a result, the group of affected companies has grown considerably. In the past, the BSI Act essentially applied to operators of critical infrastructure. According to federal government estimates, around 29,500 companies are now covered, many of them for the first time.
How NIS2, the CRA and product liability interact
| Legal framework | Protects | Typical obligation for software companies |
|---|---|---|
| NIS2 / BSI Act | the operations of your company and your services | Risk management, reporting significant incidents to the BSI |
| Cyber Resilience Act | the products you ship | Security by design, updates, reporting actively exploited vulnerabilities via the ENISA platform |
| Product Liability Act (new) | injured parties | strict (no-fault) liability for damage caused by defective software |
A SaaS provider with a desktop client may therefore be subject to reporting obligations for the client under the Cyber Resilience Act and for the platform under NIS2. This consequently means two reporting channels, two recipients and different triggers.
Does your software company fall under NIS2?
You can check whether you are affected in two steps: Do you belong to a covered sector, and do you reach the size threshold? The law looks at the activity, not at the industry you consider yourself to be in.
Step 1: The relevant activities
For software companies, these types of entities are particularly important:
- Cloud computing service providers: According to the directive, this expressly includes SaaS, PaaS and IaaS offerings.
- Managed service providers (MSP): IT service providers that support or manage their customers’ networks, infrastructure, applications or other IT systems, for example via remote maintenance.
- Managed security service providers (MSSP): Providers that take over security management for customers, for example SOC services.
- Data centre services and content delivery networks
- Digital services: online marketplaces, online search engines and social networking platforms
- Manufacturers of computers and electronic products in the manufacturing sector
Pure software development on behalf of clients, on the other hand, is not a covered activity in itself. This changes as soon as you subsequently operate or maintain the software for the client. You can then quickly become a managed service provider.
Step 2: The size thresholds
| Category | Threshold (general rule) | Maximum fines |
|---|---|---|
| Particularly important entity | 250 or more employees or more than EUR 50 million in turnover and more than EUR 43 million balance sheet total | up to EUR 10 million or 2% of annual turnover |
| Important entity | 50 or more employees or more than EUR 10 million in turnover and balance sheet total | up to EUR 7 million or 1.4% of annual turnover |
| Not covered | Micro and small enterprises below these thresholds | – |
Some providers are covered regardless of their size (Section 28 BSIG), such as qualified trust service providers, DNS service providers and top-level domain name registries. You should also check group attribution: for affiliated companies, employees and turnover may be added together.
Practical example: An HR software provider with 80 employees operates its platform for 1,200 customers in a public cloud. It therefore provides a cloud computing service and exceeds the threshold for medium-sized companies. This makes it an important entity, even though it would never describe itself as operating in the IT sector.
Special rules for digital providers
A special rule applies to cloud providers, data centres, MSPs, MSSPs and digital services: the competent Member State is the one where you have your main establishment in the EU. You are therefore subject to only one national supervisory authority, in Germany the BSI. The specific security measures these providers must implement are described in great detail in Commission Implementing Regulation (EU) 2024/2690 . It is also directly binding for this group.
What obligations do affected companies have?
Registration with the BSI
Affected entities must register with the BSI within three months (Section 33 BSIG). For companies that were covered from the date of entry into force, this deadline therefore expired at the beginning of March 2026. Anyone who has missed registration should complete it without delay. The registration obligation also does not depend on whether the BSI contacts you: you must assess yourself whether you are affected.
Risk management measures
The core of NIS2 consists of appropriate, proportionate and effective state-of-the-art measures (Section 30 BSIG). The law lists ten areas as a minimum standard:
- Risk analysis and security concepts for your information systems
- Handling of security incidents with clear processes
- Business continuity: backups, recovery, crisis management
- Supply chain security, including your service providers and software suppliers
- Security in development, procurement and maintenance, including vulnerability management
- Assessing the effectiveness of the measures taken
- Cyber hygiene and training for all employees
- Cryptography and encryption
- Human resources security, access control and asset management
- Multi-factor authentication and secured communication, including for emergencies
For software companies, the item development is particularly relevant. A secure development process, documented code reviews and vulnerability management meet CRA requirements at the same time. If you set up both together, you avoid duplicate work.
Reporting obligations to the BSI
Significant security incidents must be reported to the BSI (Section 32 BSIG). An incident is significant if it can cause severe operational disruption or financial loss or causes considerable damage to other persons. For cloud providers and MSPs, Implementing Regulation (EU) 2024/2690 also specifies the thresholds, for example based on duration and the number of affected users.
| Deadline | Report |
|---|---|
| 24 hours after becoming aware | Early warning, stating whether an unlawful attack is suspected |
| 72 hours after becoming aware | Incident notification with an initial assessment, severity and indicators of compromise |
| at the request of the BSI | Intermediate report on the current status |
| 1 month after the notification | Final report with root cause and remedial measures |
In addition, you may also have to inform your customersif the incident may affect their services. At the same time, the GDPR notification within 72 hours (Art. 33 GDPR) and, for products already shipped, the CRA notification may become due.
Practical tip
Build a joint response plan for all three reporting channels. One person decides within the first few hours which report is triggered, and templates for the BSI, the ENISA platform and the data protection authority are ready to use.
Obligations of management
NIS2 expressly makes cybersecurity a matter for top management (Section 38 BSIG). Managing directors must therefore approve the risk management measures and supervise their implementation. If they breach this duty, they are liable to the company for the resulting damage. They must also regularly attend trainingso that they can identify risks and assess measures. Implementation can be delegated, but responsibility cannot.
Not directly affected? NIS2 reaches you through your customers
Even if your company stays below the thresholds, you will still feel the effects of NIS2. Your customers must ensure the security of their supply chain . They therefore pass these requirements on contractually to their software and IT suppliers. Expect:
- Security questionnaires and audits during sales and contract renewals
- Contract clauses on reporting obligations, often with deadlines of less than 24 hours
- Certifications such as ISO 27001, BSI C5 for cloud services or TISAX in the automotive industry
- Requirements for subcontractors, access rights and remote maintenance access
Those who can provide this evidence quickly have a competitive edge with customers who are themselves subject to NIS2. Those who cannot will lose tenders.
Recommendations: 7 steps to NIS2 compliance
- Check whether you are affected: Assign each business activity to a type of entity and check the size thresholds, including at group level. Document the result, even if it is negative.
- Catch up on registration: If the deadline has passed, register with the BSI immediately.
- Involve management: Have the measures formally approved, define reporting lines and schedule management training.
- Carry out a gap analysis: Compare your existing measures with the ten minimum areas and, for digital providers, with Implementing Regulation (EU) 2024/2690.
- Set up a reporting process: Define when an incident is significant, who decides and who reports. Then practise the process in a tabletop exercise.
- Manage your supply chain: Identify your critical service providers and adapt the contracts to reporting and evidence obligations.
- Align with the CRA and product liability: Use a joint requirements register for operations and products. The same documentation will then help with supervision, conformity assessment and liability proceedings.
Conclusion: NIS2 closes the CRA’s SaaS gap
With NIS2, there is hardly any unregulated space left for software companies. Here are three key takeaways:
- SaaS is not a loophole. What the CRA excludes as a service, NIS2 often covers as a cloud computing service.
- The obligations already apply. Registration, risk management and reporting obligations have been in force since December 2025.
- Responsibility lies at the top. Management must approve, supervise and undergo training.
This series gives you an overview of all three building blocks: Product liability governs who pays. The CRA governs how secure your product must be. NIS2 governs how secure your operations must be. Planning all three together makes you more efficient and better defended in an emergency.
Would you like to know whether your company falls under NIS2? Arrange a no-obligation initial consultation – we will review whether you are affected, your reporting processes and your supply contracts.
Request an initial consultationFAQ: Frequently asked questions about NIS2 for software companies
The NIS2 Implementation Act entered into force on 6 December 2025, revising the BSI Act. The obligations have applied since then without a transitional period; only registration with the BSI was given a three-month window.
Often, yes. SaaS is one of the cloud computing services covered in the information technology and telecommunications sector. Providers of medium size and above are affected, i.e. those with 50 or more employees or more than EUR 10 million in annual turnover and balance sheet total.
NIS2 regulates the security of the company and its operations. The Cyber Resilience Act regulates the security of products placed on the market. A software company can be subject to both frameworks at the same time.
Significant security incidents must be reported to the BSI in three stages: an early warning within 24 hours, an incident notification within 72 hours and a final report no later than one month after the notification.
Yes. Managing directors must approve the risk management measures and supervise their implementation. If they breach this duty, they are liable to the company for the damage. They must also regularly attend training.
Particularly important entities face fines of up to EUR 10 million or 2% of worldwide annual turnover, important entities up to EUR 7 million or 1.4%. The BSI can also issue orders and demand evidence.
This article is for general information purposes only and does not replace legal advice in individual cases. As of: October 2026. Section references refer to the BSI Act as amended by the NIS2UmsuCG.
