SaaS Providers and B2B Cloud: The Complete NIS2 Guide

Cloud computing services carry particular responsibility under NIS2: they are classified as Essential Entities under Annex I No. 8 of the NIS2 Directive (EU) 2022/2555, subjecting them to the strictest requirements. This guide is written for founders, managing directors, and CTOs of SaaS companies and B2B cloud services who want to understand what obligations apply to them.

Who is affected?

NIS2 Annex I No. 8 covers cloud computing services as defined in Regulation (EU) 2018/1807. Three characteristics are decisive: on-demand provision of scalable shared resources for multiple tenants over a network. In practical terms: SaaS providers that offer independently provisionable services to business customers, operate multi-tenancy, and run their own infrastructure or managed hosting.

The size threshold follows SME Recommendation 2003/361/EC Art. 2: at least 50 employees (full-time equivalents) or at least EUR 10 million in annual revenue. Both thresholds must be exceeded in two consecutive fiscal years to trigger applicability. This means: a rapidly growing SaaS company should assess applicability prospectively.

A provider that merely resells white-label software from another vendor or operates no own service stack does not fall under Annex I No. 8, but may be classified under Annex II as another digital service.

Obligations under § 30 BSIG-new

§ 30 BSIG-new requires a comprehensive risk management system with technical and organisational measures (TOMs). Particularly relevant for SaaS providers:

1. Risk analysis and management: Regular assessment of your own security architecture - cloud infrastructure, authentication systems, database access, API security.
2. Incident handling: A documented incident response plan with clear escalation levels and communication channels to the BSI and affected customers.
3. Business continuity: Backup concepts, disaster recovery plans, and recovery objectives (RTO/RPO) must be documented and tested.
4. Supply chain security: AWS, Azure, GCP, Stripe, Auth0, and other critical suppliers must be documented in the risk analysis (§ 30 Para. 2 No. 4 BSIG-new).
5. Access control and MFA: Multi-factor authentication for all privileged access to production systems is mandatory.
6. Encryption: Customer data must be encrypted both at rest and in transit.
7. Training: Technical staff must receive regular cybersecurity training.

Deadlines and reporting obligations

BSI registration under § 33 BSIG-new within three months of determining applicability. For security incidents under § 32 BSIG-new, a three-stage reporting chain applies: initial report within 24 hours, full report within 72 hours, and a final report within 30 days of the incident.

For a security incident affecting customer data, two reporting channels run in parallel: the NIS2 reporting obligation to the BSI and the GDPR reporting obligation to the data protection authority under Art. 33 GDPR (also 72 hours). Affected customers must additionally be notified under Art. 34 GDPR if there is a high risk to their rights and freedoms. An internal incident response plan must coordinate both channels and should be finalised before the first incident occurs.

Fines and personal liability

Essential entities under Annex I: up to EUR 10 million or 2 percent of global annual revenue (§ 65 BSIG-new). Personal management liability under § 38 BSIG-new applies in addition: managing directors and board members must approve, supervise, and regularly train on cybersecurity measures. Proven neglect can lead to personal liability, irrespective of the limited liability protection of a GmbH.

For SaaS providers, contractual liability to customers is a further layer: if a provider breaches its NIS2 obligations and thereby causes damage to a customer, GDPR fines and damages claims may arise simultaneously.

DORA: What applies additionally for financial customers

Regulation (EU) 2022/2554 (Digital Operational Resilience Act, DORA) has been in force since 17 January 2025 and applies to all ICT third-party providers serving financial entities such as banks, insurance companies, or investment fund managers.

As an ICT third-party provider with financial customers, you are required under Art. 28 DORA to include certain contractual elements: a documented exit strategy enabling the financial entity to transition in an orderly manner; audit rights for the financial entity and its supervisory authorities; and full disclosure of the sub-outsourcing chain, including all sub-processors performing security-relevant functions.

Critical ICT Third-Party Providers (CTPPs) are directly supervised by European supervisory authorities (ESAs). In practice this only affects hyperscalers such as AWS, Azure, or Google Cloud, not typical SaaS providers. For SaaS providers with financial customers in their portfolio, a DORA-compliant contractual addendum to the existing main agreement is generally sufficient to fulfil the Art. 28 obligations.

Common pitfalls

"We are just software, not IT operations": This misconception is widespread. NIS2 Annex I No. 8 does not depend on how the company perceives itself, but on the characteristics of the service. A provider that operates multi-tenant software on its own infrastructure and offers customers on-demand access qualifies as a cloud computing service under NIS2 - regardless of whether the company calls itself a software house or platform provider.

Sub-processor list not maintained: Both DORA Art. 28 and GDPR Art. 28 require an up-to-date list of all sub-processors. Many SaaS providers have AWS or Stripe listed in their DPA, but forget CDN providers, email delivery services, or authentication services. An incomplete sub-processor list is a compliance risk vis-a-vis customers and regulators.

Incident reporting chain defined only internally: NIS2 requires an initial report to the BSI within 24 hours for significant incidents (§ 32 BSIG-new). A provider that has only an internal escalation process but no documented path to the BSI reporting portal will be too slow in an emergency. Additionally, affected customers must be notified - a step that must be explicitly included in the incident response plan.

First steps

1. Assess NIS2 applicability using the four cloud service criteria and size thresholds.
2. Start a gap analysis of your current security architecture against the TOMs of § 30 BSIG-new.
3. Document your supply chain: all cloud providers, sub-processors, and critical third-party services.
4. Create an incident response plan with an explicit BSI reporting path and customer notification step.
5. Review all customer DPAs for GDPR compliance and update the sub-processor list.
6. If financial customers are in your portfolio: create a DORA addendum to existing contracts.
7. Plan BSI registration within three months of determining applicability.

Use the industry-specific NIS2 calculator for SaaS providers to clarify your obligations.