--- title: "NIS2 for Web Platforms & SaaS" description: "NIS2 compliance guide for German SaaS companies. 29,500 companies affected, BSI registration deadline passed on 6 March 2026." lastUpdated: "2026-06-23" canonical: "https://anvilstack.eu/en/compliance/nis2-web-platforms" --- > Sitemap for agents: https://anvilstack.eu/llms.txt # NIS2 for Web Platforms & SaaS The NIS2 directive is Germany's most comprehensive cybersecurity regulation, and it now affects **29,500 companies** – including every SaaS company and every web platform that provides digital infrastructure. Here is what you need to do now. > **Deadline:** **Registration with the BSI: the deadline for particularly important entities was 6 March 2026.** The NIS2 transposition took effect on 6 December 2025 – with no transition period. Fines of up to €10 million or 2% of annual revenue. ## What is NIS2? The NIS2 directive (Network and Information Security Directive 2) is the revised EU cybersecurity directive, transposed into German law by the **NIS-2-Umsetzungs- und Cybersicherheitsstärkungsgesetz** (NIS2UmsuCG). It replaces the previous NIS directive and dramatically expands the scope of who is covered. - **29,500** – companies affected in Germany (previously: 4,500) - **€10M** – maximum fine or 2% of global annual revenue - **€2.3B** – estimated annual compliance cost for the economy - **24h** – deadline for the initial report of a security incident [openkritis: NIS2 compliance cost (draft act, July 2025) – around 30,000 affected companies, EUR 2.2bn one-off, EUR 2.3bn annually](https://www.openkritis.de/it-sicherheitsgesetz/kosten-nis2-wirtschaft-bund.html) ## Does NIS2 apply to my company? NIS2 applies to you if your company: - operates **SaaS platforms** that other businesses rely on - offers **online marketplaces** or **e-commerce platforms** - provides **managed IT services** or **cloud services** - runs **digital infrastructure** that other businesses use - has more than 50 employees **or** generates more than €10M in annual revenue > **Warning:** **AI-built platforms are covered too.** If your platform, built with Lovable, v0 or Bolt, provides digital services to other businesses, you fall under NIS2. AnvilStack uses AI tools for rapid development – but with engineering review and NIS2 compliance from day one. ## The 10 mandatory measures under Article 21 NIS2 Article 21 requires at least these ten cybersecurity measures: 1. **Risk analysis and security concepts** for information systems 2. **Incident response** – handling security incidents 3. **Business continuity** – backup management and disaster recovery 4. **Supply chain security** – security across the supply chain and with suppliers, including [GDPR-compliant vendor management](https://anvilstack.eu/en/compliance/gdpr-vendor-audit.md) 5. **Security in procurement** – development and maintenance of systems 6. **Effectiveness assessment** – evaluating the cybersecurity measures 7. **Cyber hygiene and training** – fundamental practices and awareness 8. **Cryptography** – policies for encryption 9. **Personnel security and access control** – asset management 10. **Multi-factor authentication** – secure communication systems In the German transposition, these measures are codified in **Section 30 BSIG**. ([BSI: NIS-2 Risk Management Measures (Section 30 BSIG)](https://www.bsi.bund.de/DE/Themen/Regulierte-Wirtschaft/NIS-2-regulierte-Unternehmen/NIS-2-Infopakete/NIS-2-Risikomanagementmassnahmen/NIS-2-Risikomanagementmassnahmen.html)) ## Incident reporting obligations | Deadline | Obligation | | ------------ | ------------------------------------- | | **24 hours** | Early warning to the BSI | | **72 hours** | Detailed incident notification | | **1 month** | Final report with root-cause analysis | ## Personal liability of management A critical difference from previous regulations: **members of management are personally liable** for damages arising from a culpable failure to implement cybersecurity measures. This cannot be delegated to the CISO or the IT department. ## How AnvilStack helps We use AI tools to develop quickly – but every line of code is reviewed by senior engineers and made NIS2-compliant: - **Analysis:** We test your existing platform against all 10 NIS2 mandatory measures – you will find the full technical breakdown in our [NIS2 Security Checklist](https://anvilstack.eu/en/insights/nis2-security-checklist.md) - **[Security-by-architecture](https://anvilstack.eu/en/services/mvp-engineering.md):** NIS2 compliance is built into the system architecture, not bolted on afterwards - **Incident response setup:** We implement the reporting infrastructure for the 24h/72h/30d deadlines - **EU-sovereign hosting:** Hetzner, Germany – no CLOUD Act, no US jurisdiction - **Documentation:** Auditable evidence for the BSI, not just technical measures In a free initial consultation, we assess your platform for NIS2 relevance and show you concretely where action is needed – from the assessment through to a hardened, EU-sovereign production platform. [Book a no-obligation initial consultation](https://anvilstack.eu/en/contact) ## Frequently asked questions ### Does NIS2 apply to my SaaS company? If your company has more than 50 employees or generates more than €10M in annual revenue and provides digital services to other businesses, then yes. SaaS platforms, online marketplaces, managed IT services and cloud services all fall under NIS2. ### What penalties apply for NIS2 violations? Fines of up to €10 million or 2% of global annual revenue for essential entities, and €7 million or 1.4% for important entities. Managing Directors are personally liable for damages caused by a culpable failure to implement cybersecurity measures. ### Do I have to register with the BSI? Yes. The NIS2 transposition requires registration with the BSI. The deadline passed on 6 March 2026 (three months after the law took effect on 6 December 2025). Failure to register exposes you to additional sanctions; a late registration is still possible and advisable. ### What are the 10 mandatory measures under NIS2? Article 21 requires: risk analysis, incident response, business continuity, supply chain security, security in procurement, effectiveness assessment, cyber hygiene and training, cryptography policies, access control and multi-factor authentication. ### How quickly must I report a security incident? Within 24 hours you must send an early warning to the BSI. Within 72 hours a detailed incident notification follows. After one month, a final report with a root-cause analysis is due. ### Does NIS2 also apply to AI-built platforms? Yes. If your platform, built with Lovable, v0 or Bolt, provides digital services to other businesses, you fall under NIS2 – regardless of how the platform was developed. ## Sources - [Germany Transposes NIS 2 Directive (2026)](https://www.globalpolicywatch.com/2026/01/germany-transposes-nis-2-directive-increased-cybersecurity-requirements-for-businesses/) - [Morrison Foerster: NIS2 in Germany (2026)](https://www.mofo.com/resources/insights/251208-flipping-the-nis2-switch-what-germanys-implementation) - [Reed Smith: Germany Implements NIS2](https://www.reedsmith.com/articles/germany-implements-nis2-immediate-effect-broad-scope-near-term-registration/)