NIS21 min read191 words
NIS2 at a tech company: do the obligations apply to you too?
The NIS2 directive significantly widens the circle of entities subject to cybersecurity obligations. The question is no longer "is anyone subject" but "are we subject" — and many SaaS companies answer it wrong.
The NIS2 directive significantly widens the circle of entities subject to cybersecurity obligations. The question is no longer "is anyone subject" but "are we subject" — and many SaaS companies answer it wrong.
NIS2 replaced the original NIS directive and broadened the range of entities and sectors. In practice this means obligations that previously applied mainly to large critical-infrastructure operators can now cover a mid-sized technology company providing digital services.
Are you subject at all?
That’s the first and most important question. The scope depends on the sector you operate in and the size of the company. Some entities are covered as "essential", some as "important" — with different levels of obligations and oversight.
What to do if you are subject
- Map whether and in which category the company is covered by the directive
- Implement adequate cybersecurity risk-management measures
- Establish an incident-reporting process within the required deadlines
- Ensure accountability at board level
- Train the team and document compliance
The key word is "adequate". NIS2 doesn’t require a mid-sized company to build a bank’s apparatus. It requires measures proportionate to the risk — and that proportionality is exactly where it’s easiest to overshoot in either direction.
Latest articles
AI Act
The AI Act — the first deadlines already apply.
The AI Act comes in stages, and some of its provisions already apply. If you build or use AI systems, it’s worth checking which risk category your product falls into.
Pay transparency
The pay-transparency directive — what to do before 2027.
New disclosure and reporting obligations will affect technology companies too. The sooner you tidy up your pay policy, the less painful the adjustment will be.
Due diligence
The term sheet in plain terms: five clauses that decide control.
A term sheet looks innocent — a few pages, lots of abbreviations. But it’s where most of the decisions about who really controls the company after the round are made.
ESOP
ESOP in a Polish limited company: options, warrants or shares?
Incentive plans in a Polish limited company (sp. z o.o.) can be done several ways. Each has different tax consequences and a different impact on the ownership structure.
IP / AI
Who owns the rights to code written by AI?
Generative tools entered engineering teams faster than the law managed to describe it. The question of rights to AI-generated code and content is becoming part of due diligence.
FDI
Foreign-investment screening and a round with a non-EU fund.
When a non-EU investor joins the round, foreign direct investment (FDI) screening may come into play. Spotted in time, it won’t stop the round. Missed — it can.