EU Compliance for SaaS & Tech Compan...

The European Union is the world's most regulated digital market — and the most lucrative. With over 450 million consumers, a GDP of EUR 16.6 trillion, and enterprise buyers who increasingly demand regulatory compliance as a procurement prerequisite, the EU represents enormous opportunity for SaaS and tech companies. But that opportunity comes with a regulatory stack that can overwhelm even experienced compliance teams.

GDPR, NIS2, DORA, the AI Act, and the European Accessibility Act — five major regulations, each with its own scope, timeline, and penalty structure. This playbook cuts through the complexity with a practical, step-by-step approach designed for non-EU tech companies entering the European market and EU-based companies scaling their compliance programmes.

Quick Reference	Details
Regulations covered	GDPR, NIS2, DORA, AI Act, European Accessibility Act
Primary audience	SaaS companies, tech companies, non-EU companies serving EU customers
Compliance timeline	90-day foundational plan (see roadmap below)
Maximum penalty exposure	Up to EUR 35 million or 7% of global turnover (AI Act)
Key principle	Compliance = competitive advantage, not just risk mitigation
EU Representative required	Yes, if processing EU personal data without EU establishment
Certifications that accelerate deals	ISO 27001, SOC 2 Type II, ISO 42001

Key Takeaways

Five EU regulations form the core compliance stack for tech companies: GDPR, NIS2, DORA, AI Act, and the European Accessibility Act

GDPR applies to any company processing EU residents' personal data — regardless of where the company is headquartered

Non-EU SaaS companies must appoint an EU Representative under GDPR Article 27 if they have no EU establishment

NIS2 expanded cybersecurity obligations to cover cloud providers, SaaS platforms, and managed service providers since October 2024

The AI Act is now fully in force for high-risk systems — companies deploying AI in the EU must classify and manage AI risk

Demonstrable compliance accelerates enterprise sales cycles by 40–60% and is increasingly a procurement prerequisite

A structured 90-day roadmap can bring a tech company from zero to foundational compliance across all applicable regulations

Regulation	Full Name	In Force Since	Scope	Max Penalty
GDPR	General Data Protection Regulation	May 2018	Personal data protection	EUR 20M or 4% of global turnover
NIS2	Network and Information Security Directive	Oct 2024	Cybersecurity for essential/important entities	EUR 10M or 2% of global turnover
DORA	Digital Operational Resilience Act	Jan 2025	ICT risk in financial services	1% of average daily global turnover
AI Act	Artificial Intelligence Act	Phased 2025–2027	AI systems on EU market	EUR 35M or 7% of global turnover
EAA	European Accessibility Act	Jun 2025	Digital accessibility for B2C products/services	National penalties (vary by member state)

Company Type	Applicable Regulations	Priority Order
B2B SaaS (general)	GDPR, NIS2	GDPR → NIS2
B2B SaaS (financial clients)	GDPR, NIS2, DORA	GDPR → DORA → NIS2
B2C SaaS / app	GDPR, NIS2, EAA	GDPR → EAA → NIS2
AI-powered SaaS	GDPR, NIS2, AI Act	GDPR → AI Act → NIS2
Fintech	GDPR, NIS2, DORA, possibly AI Act	GDPR → DORA → AI Act → NIS2
Infrastructure / cloud provider	GDPR, NIS2, possibly DORA	GDPR → NIS2 → DORA

Obligation	Requirement	Deadline/SLA
Lawful basis	Document a legal basis for every processing activity	Before processing begins
Transparency	Clear, accessible privacy notice in plain language	Published and easily accessible
Data subject rights	Access, rectification, erasure, portability, restriction, objection	30 days to respond
Records of Processing	Maintain Article 30 records of all processing activities	Continuously updated
Security measures	Appropriate technical and organisational controls	Ongoing
Breach notification	Notify supervisory authority of personal data breaches	72 hours from awareness
Data Protection Impact Assessment	Conduct DPIA for high-risk processing	Before processing begins
EU Representative	Appoint representative if no EU establishment (Article 27)	Before offering services to EU
Data Protection Officer	Appoint DPO if required (public body, large-scale monitoring, special category data)	Before processing begins

Basis	When It Applies	Common SaaS Use Case
Consent	Individual freely gives informed, specific agreement	Marketing emails, analytics cookies
Contract	Processing necessary to perform a contract	Account creation, service delivery
Legal obligation	Required by EU or member state law	Tax records, employment law
Vital interests	Protect someone's life	Emergency health situations
Public task	Exercise official authority	Government services
Legitimate interest	Balancing test: business need vs. individual rights	Fraud prevention, security, direct marketing to existing customers

Transfer Mechanism	Description	Best For
Adequacy decision	EU Commission has determined the country provides adequate protection	US (via EU-US Data Privacy Framework), UK, Japan, South Korea, Canada, and others
Standard Contractual Clauses (SCCs)	Pre-approved contractual terms between data exporter and importer	Most common mechanism; works for any country
Binding Corporate Rules (BCRs)	Internal policies approved by supervisory authority	Large multinational groups
Transfer Impact Assessment (TIA)	Supplementary assessment when destination country laws may undermine SCCs	Required alongside SCCs where adequacy is uncertain

Your Activity	GDPR	NIS2	DORA	AI Act	EAA
Process personal data of EU residents	Yes	—	—	—	—
Provide cloud/SaaS/managed IT services	Likely	Yes (if >50 employees or >EUR 10M turnover)	—	—	—
Serve the financial sector (banks, insurers, investment firms)	Likely	Yes	Yes	—	—
Develop or deploy AI systems in the EU	Likely	—	—	Yes	—
Offer B2C digital products/services	Likely	—	—	—	Yes
Operate online marketplaces or search engines	Likely	Yes	—	Possibly	Yes
Provide data centre or DNS services	Likely	Yes	—	—	—

Violation	Penalty Tier	Notable Examples
Administrative/documentation failures	Up to EUR 10M or 2% of global turnover	Insufficient Article 30 records, missing DPO appointment
Rights violations, unlawful processing, transfer breaches	Up to EUR 20M or 4% of global turnover	Meta: EUR 1.2B (transfers), Amazon: EUR 746M (targeting)
Failure to cooperate with supervisory authority	Discretionary	Can trigger investigations and escalated penalties

Aspect	Details
Who	A natural person or legal entity established in the EU
Where	Must be in a member state where data subjects are located
Role	Point of contact for supervisory authorities and data subjects
Liability	The representative can be subject to enforcement alongside the company
Cost	EUR 3,000–15,000/year depending on provider and complexity
Exceptions	Public authorities; occasional processing not including large-scale special category data

Requirement	Details
Self-certification	Register with US Department of Commerce
Annual re-certification	Must renew annually
Privacy policy updates	Must commit to DPF principles in privacy policy
Dispute resolution	Must provide accessible, independent recourse mechanism
FTC/DOT enforcement	Subject to enforcement by US authorities
Human rights redress	EU individuals can seek redress through Data Protection Review Court

Essential Entities (stricter obligations)	Important Entities
Energy (electricity, gas, oil, hydrogen, heating)	Postal and courier services
Transport (air, rail, water, road)	Waste management
Banking and financial market infrastructure	Chemical manufacturing
Healthcare	Food production and distribution
Drinking water and wastewater	Manufacturing (medical devices, electronics, machinery, vehicles)
Digital infrastructure (IXPs, DNS, TLD registries, cloud, data centres, CDNs)	Digital providers (online marketplaces, search engines, social networks)
ICT service management (B2B managed services, managed security)	Research organisations
Public administration
Space

Obligation	Details	Timeline
Risk management	Implement cybersecurity policies, risk analysis, and security measures	Ongoing
Incident reporting	Early warning within 24 hours, detailed report within 72 hours, final report within 1 month	Per incident
Supply chain security	Assess and manage risks from third-party suppliers and service providers	Ongoing
Business continuity	Backup management, disaster recovery, crisis response procedures	Ongoing
Vulnerability handling	Disclosure and management of vulnerabilities	Ongoing
Management accountability	Senior management must approve security measures; personal liability for failures	Ongoing
Training	Cybersecurity awareness training for all staff, including management	Regular

Entity Type	Maximum Penalty
Essential entities	EUR 10 million or 2% of global annual turnover
Important entities	EUR 7 million or 1.4% of global annual turnover
Management liability	Personal liability for senior management; potential temporary bans

Financial Entities	ICT Third-Party Providers
Banks and credit institutions	Cloud service providers serving financial entities
Investment firms	Data analytics platforms for financial services
Insurance and reinsurance companies	SaaS tools used by banks, insurers, or investment firms
Payment institutions	Managed IT service providers for financial sector
Crypto-asset service providers	Outsourced ICT infrastructure providers
Central counterparties	Software providers for trading, risk, or reporting

Obligation	Requirement	Key Detail
ICT risk management	Comprehensive framework: identify, protect, detect, respond, recover	Must be approved by management body
Incident reporting	Initial notification: 4 hours; intermediate: 72 hours; final: 1 month	Faster than NIS2 for financial sector
Resilience testing	Regular testing of ICT tools and systems	TLPT every 3 years for significant entities
Third-party risk management	Due diligence, contractual requirements, concentration risk assessment	Exit strategies required for critical providers
Register of Information	Maintain detailed register of all ICT service provider arrangements	First submission: 30 April 2025
Information sharing	Participate in cyber threat intelligence sharing	Voluntary but encouraged

Aspect	DORA	NIS2
Nature	Regulation (directly applicable)	Directive (transposed into national law)
Scope	Financial sector + their ICT providers	Cross-sector (essential + important entities)
Incident reporting	4 hours initial	24 hours early warning
Testing	TLPT required for significant entities	Risk-based testing
Relationship	Lex specialis — DORA takes precedence	Applies where DORA does not

Risk Level	Examples	Key Obligations	Effective Date
Prohibited	Social scoring, exploitative AI, real-time biometric ID in public spaces (with exceptions), emotion recognition at work/school	Must not deploy	2 Feb 2025 ✅
High risk	AI in recruitment, credit scoring, critical infrastructure, education, law enforcement, migration	Conformity assessment, risk management, human oversight, technical documentation, CE marking	2 Aug 2026 ✅
Limited risk	Chatbots, deepfakes, emotion recognition (where permitted), AI-generated content	Transparency — users must know they interact with AI	2 Aug 2025 ✅
Minimal risk	Spam filters, recommendation engines, most business software	No specific requirements; voluntary codes of conduct	N/A

Products	Services
Computers and operating systems	E-commerce websites and mobile apps
Smartphones, tablets	Banking services (ATMs, online banking)
TV equipment with interactive computing	Telephony and messaging services
E-book readers	Transport services (ticketing, real-time info)
Self-service terminals (ATMs, kiosks, check-in)	E-books and dedicated software

Requirement	Standard	Details
Web accessibility	WCAG 2.2 Level AA	Perceivable, operable, understandable, robust
Mobile accessibility	WCAG 2.2 Level AA + platform guidelines	Native app accessibility features
Accessibility statement	Published and machine-readable	Conformance status, known issues, contact info
Feedback mechanism	Users can report accessibility barriers	Accessible contact method for issues
Documentation	Accessible product documentation	User guides, help content in accessible formats

Step	Activities	Deliverables
Assemble the team	Appoint project lead; form cross-functional squad (product, legal, security, engineering); establish communication channels	Team charter, RACI matrix
Data inventory	Map all personal data: what you collect, where it's stored, how it flows, who processes it, lawful basis	Data flow map, processing inventory
AI inventory	Catalogue all AI/ML systems: purpose, data inputs, outputs, affected persons, provider	AI system register
Vendor inventory	List all vendors processing personal data or providing ICT services	Vendor register with risk tiers
Regulatory mapping	Determine which regulations apply based on inventories	Regulatory applicability matrix
Gap analysis	Compare current state against requirements for each applicable regulation	Gap assessment report with priority ranking
Claims audit	Review marketing, contracts, product copy for compliance claims that need substantiation	Audit findings and remediation list

Violation	Maximum Penalty
Deploying prohibited AI	EUR 35 million or 7% of global annual turnover
Non-compliance with high-risk requirements	EUR 15 million or 3% of global annual turnover
Providing incorrect information	EUR 7.5 million or 1.5% of global annual turnover

Aspect	GDPR	NIS2	DORA	AI Act	EAA
Type	Regulation	Directive	Regulation	Regulation	Directive
In force	May 2018	Oct 2024	Jan 2025	Phased 2025–27	Jun 2025
Scope	Personal data	Cybersecurity	Financial ICT resilience	AI systems	Digital accessibility
Applies to non-EU	Yes (extraterritorial)	Limited	Limited	Yes (extraterritorial)	Yes (if selling to EU consumers)
EU Representative	Required (Art. 27)	Not explicitly required	N/A	Required for non-EU providers	N/A
DPO / officer	DPO (if applicable)	CISO / responsible officer	ICT risk management function	AI compliance officer (recommended)	Accessibility officer (recommended)
Incident reporting	72 hours	24h / 72h / 1 month	4h / 72h / 1 month	Serious incident reporting (GPAI systemic risk)	N/A
Documentation	Records of processing, DPIA	Security policies, risk assessments	ICT risk framework, register of information	Technical documentation, conformity assessment	Accessibility statement
Certification	Not required (but helpful)	National schemes possible	N/A	CE marking (high-risk)	Self-declaration or testing
Max penalty	EUR 20M / 4%	EUR 10M / 2%	1% daily global turnover	EUR 35M / 7%	National (varies)

Overlap Area	Regulations Involved	How to Handle
Security measures	GDPR + NIS2 + DORA	Implement once, document for each framework
Incident reporting	GDPR + NIS2 + DORA	Single incident process with regulation-specific notification paths
Risk assessment	All five	Unified risk methodology with regulation-specific modules
Vendor management	GDPR + NIS2 + DORA	Combined vendor assessment questionnaire
Documentation	All five	Central compliance documentation repository
Training	GDPR + NIS2 + DORA + AI Act	Integrated compliance training programme

Step	Activities	Deliverables
Privacy documentation	Privacy policy (English + local EU languages), Article 30 records, DPA template, DPIA for high-risk processing	Documentation package
Security framework	Cybersecurity policies, risk assessment methodology, incident classification, access control policies	Security policy suite
Technical measures	Encryption (transit + rest), MFA enforcement, logging, backup strategy, vulnerability management	Technical controls matrix
Incident response	Unified procedure covering GDPR (72h), NIS2 (24h), DORA (4h) timelines	Incident response playbook
AI governance	AI risk classification per AI Act, model documentation, transparency measures	AI governance framework
Accessibility audit	WCAG 2.2 AA assessment of web and mobile interfaces	Accessibility audit report
Vendor risk programme	Vendor tiering framework, assessment questionnaire, DPA review	Vendor risk management programme

Step	Activities	Deliverables
Technical controls	Deploy consent management platform, data subject request portal, data export/deletion endpoints, MFA, security monitoring	Implemented controls
Accessibility fixes	Remediate critical and high-priority WCAG issues; implement accessibility statement	Improved accessibility score
Training	All-staff compliance basics, advanced for IT/legal, AI-specific for developers, accessibility for designers	Training records with completion tracking
Vendor compliance	Review and sign DPAs with all data processors, verify sub-processor lists, assess critical vendor security	Signed DPAs, vendor assessment records
EU Representative	Appoint and register EU Representative (for non-EU companies)	Appointment documentation
Privacy by design	Embed privacy into development workflow: preference centres, role-based access, data minimisation	Updated SDLC with privacy checkpoints

Step	Activities	Deliverables
Tabletop exercise	Simulate a data breach + AI Act inspection: test incident reporting workflows, DSR handling, security controls	Exercise report with lessons learned
Penetration test	External penetration test covering EU data residency zones and business continuity scenarios	Pentest report with remediation plan
Documentation review	Finalise all compliance documentation; ensure consistency across regulations	Final compliance documentation package
Customer-facing materials	Trust centre, security overview, compliance FAQ, sub-processor list	Published trust centre
Maintenance plan	Establish quarterly review cadence, annual procedure audit, regulatory change monitoring	Compliance operations calendar
Sign-off	Management approval of compliance programme; assignment of ongoing responsibilities	Signed compliance sign-off

Company Size	Annual Compliance Investment	What's Included
Startup (5–20 employees)	EUR 15,000–40,000	EU Representative, DPA templates, basic security controls, privacy documentation, legal review
Scale-up (20–100 employees)	EUR 40,000–120,000	DPO (outsourced), security programme, vendor management, AI governance basics, accessibility audit
Mid-market (100–500 employees)	EUR 120,000–350,000	Full-time DPO, ISO 27001 certification, SOC 2, comprehensive training, automated compliance tooling
Enterprise (500+ employees)	EUR 350,000–1,000,000+	Dedicated compliance team, multi-regulation programme, continuous monitoring, third-party audits

Component	Typical Range	Notes
Legal counsel (EU law)	EUR 10,000–50,000/year	Higher for initial setup, lower for maintenance
EU Representative	EUR 3,000–15,000/year	Required for non-EU companies
DPO (outsourced)	EUR 12,000–36,000/year	Depends on processing complexity
ISO 27001 certification	EUR 20,000–80,000 (initial)	Ongoing surveillance audits: EUR 10,000–25,000/year
SOC 2 Type II	EUR 30,000–100,000 (initial)	Annual audit: EUR 20,000–50,000
Penetration testing	EUR 5,000–25,000/test	Annual or semi-annual
Accessibility audit (WCAG)	EUR 5,000–20,000	Depends on application complexity
Compliance software (GRC)	EUR 5,000–50,000/year	Scales with features and users
Training	EUR 2,000–15,000/year	Per-employee cost decreases with scale

#	Mistake	Consequence	Solution
1	"We'll retrofit compliance later"	20–30% higher cost; delayed deals; architectural debt	Embed compliance into product development from day one
2	Copy-pasting legal documents	Inconsistencies and gaps; regulators spot generic templates	Have EU counsel co-author documents referencing your specific processing and systems
3	Technology-only approach	Gaps in processes and people	Balance technical, organisational, and training measures — compliance is people + process + technology
4	One-time project mindset	Outdated documentation within months	Quarterly reviews, annual procedure audits, continuous monitoring
5	Ignoring vendor risk	Liability for vendor failures and breaches	Vendor due diligence, signed DPAs, regular reassessment, sub-processor change notifications
6	Silence during incidents	Escalated fines under NIS2 (24h) and DORA (4h) when notification is late	Pre-draft notification templates; align legal, security, and communications teams before an incident
7	No evidence of adoption	Regulators expect proof, not just policies	Maintain compliance workspace with policies, risk logs, training records, and audit trails
8	Treating GDPR as the only regulation	Blindsided by NIS2, DORA, or AI Act obligations	Conduct holistic regulatory mapping at the start
9	Underestimating accessibility	EAA enforcement begins June 2025; lawsuits in some member states	WCAG audit early; remediate before enforcement begins
10	No EU legal presence or representative	Cannot be reached by supervisory authorities; looks negligent to buyers	Appoint EU Representative (Article 27) or establish an EU entity

Element	Purpose
Privacy policy	Demonstrates GDPR compliance; addresses data subjects directly
Sub-processor list	Shows transparency about who processes data
Security certifications	ISO 27001, SOC 2, ISO 42001 certificates/badges
Architecture overview	Data residency, encryption, access controls
Technical and organisational measures (TOMs)	Detailed security and privacy measures
Incident response summary	Demonstrates preparedness
Accessibility statement	Demonstrates EAA compliance
Compliance FAQ	Preemptively answers common procurement questions

EU Compliance for SaaS & Tech Companies: The Complete Playbook (2026)

Key Takeaways

Share article

Need help with compliance?

Table of Contents

The EU Regulatory Landscape for Tech Companies

The Five Pillars of EU Tech Regulation

Why Compliance Is a Competitive Advantage

Which Regulations Apply to You?

Typical Profiles

GDPR: The Foundation of EU Compliance

Core GDPR Obligations

Six Lawful Bases for Processing

Data Transfers Outside the EU

GDPR Penalties: What They Look Like in Practice

GDPR for US Companies: Special Considerations

Do You Need GDPR Compliance?

EU Representative (Article 27)

EU-US Data Privacy Framework

NIS2: Cybersecurity Obligations

Does NIS2 Apply to You?

Key NIS2 Obligations for SaaS Companies

NIS2 Penalties

DORA: Digital Resilience for Financial Services

Who Must Comply

Key DORA Obligations

DORA vs NIS2

AI Act: Artificial Intelligence Regulation

AI Act Risk Classification

GPAI (General-Purpose AI) Obligations

AI Act Penalties

European Accessibility Act

Who Must Comply

Key Requirements

Micro-Enterprise Exemption

Regulation Comparison Matrix

Where Regulations Overlap

The 90-Day Compliance Roadmap

Phase 1: Discovery and Assessment (Days 1–20)

Phase 2: Design and Documentation (Days 21–50)

Phase 3: Implementation (Days 51–75)

Phase 4: Verification and Launch (Days 76–90)

Per-Regulation Compliance Checklists

GDPR Checklist

NIS2 Checklist

DORA Checklist (Financial Sector / ICT Providers)

AI Act Checklist

Accessibility Checklist

Compliance Cost Estimates

By Company Size

By Cost Component

Common Mistakes and How to Avoid Them

Demonstrating Compliance to European Buyers

1. Build a Trust Centre

2. Prepare Contractual Documentation

3. Master Security Questionnaires

4. Publish Thought Leadership

KPIs and Governance Cadence

Compliance KPIs

Monthly EU Governance Council

Annual Activities

Frequently Asked Questions

Do I need an EU legal entity to sell in Europe?

How long does compliance really take?

Do I need separate compliance for each EU country?

What if I only have a few EU customers?

Can I rely on my US SOC 2 for EU compliance?

What's the order of priority if I can't do everything at once?

How does DORA interact with NIS2?

Is it worth getting ISO 27001 certified?

Related Articles

Take the Next Step

Related Articles

Employer of Record in Croatia: Complete Compliance & Legal Guide (2026)

CSRD Reporting: The Complete Guide to EU Sustainability and ESG Compliance in 2026

Cyber Insurance Requirements: Complete Guide to Coverage, Controls, and Application (2026)

Document	Purpose	Availability
Data Processing Agreement (DPA)	GDPR Article 28 processor agreement	Signed before data processing begins
Standard Contractual Clauses (SCCs)	International data transfer mechanism	Attached to DPA where applicable
Service Level Agreement (SLA)	Availability, incident response, support hours	Part of commercial agreement
Sub-processor notification mechanism	Alert customers to changes in sub-processors	Process documented in DPA
DORA-compliant clauses	Specific requirements for financial sector customers	Addendum for financial customers

Question	What to Prepare
Where is data stored?	Data residency map showing regions and providers
Who has access to data?	Access control policy, role matrix, principle of least privilege
How are incidents handled?	Incident response procedure with SLAs for each regulation
What certifications do you hold?	Certificate copies, audit reports, penetration test summaries
How do you handle data subject requests?	Process documentation, response SLA, deletion verification
What sub-processors do you use?	Published and maintained sub-processor list with notification process
How do you manage AI systems?	AI register, risk classification, governance framework
What accessibility measures are in place?	WCAG audit results, accessibility statement, remediation roadmap

KPI	Target	Measurement
DSR response time	Median under 15 days (30-day legal maximum)	Track from request receipt to completion
Breach notification readiness	Under 120 minutes to draft regulator-ready notice (simulation)	Tabletop exercise results
DPIA completion time	Median under 12 days from feature concept to DPIA approval	Track per-feature
Access review completion	100% of privileged access reviews on schedule	Quarterly audit
Vendor DPA coverage	100% of data processors have signed DPAs	Vendor register audit
Training completion	100% of staff completed required training	LMS tracking
AI register freshness	100% of AI systems updated in last 90 days	Quarterly audit
Security questionnaire cycle time	Under 5 business days from receipt to completion	Track per-request
Accessibility score	WCAG 2.2 AA pass rate > 95%	Automated + manual testing

Agenda Item	Purpose
Risk register review	Update risk assessments, add new risks, close resolved risks
Incident review	Analyse incidents and near-misses; identify systemic issues
Audit status	Track certification timelines, remediation progress
Regulatory horizon scan	New guidance, enforcement actions, legislative updates
Customer requirements	Emerging compliance demands from sales pipeline
KPI dashboard	Review all compliance metrics; flag items below target

Activity	When	Who
Full regulatory mapping review	January	Legal + Compliance
ISO 27001 surveillance audit	Per certification schedule	Security + External auditor
SOC 2 Type II audit	Annually	Security + External auditor
Penetration test	Semi-annually	Security + External tester
DPIA review	Annually or after significant change	Privacy + Product
AI Act classification review	Annually or after new AI deployment	AI Governance + Legal
Accessibility audit	Annually	UX + External auditor
Comprehensive training refresh	Annually	All staff