EU compliance for SaaS companies refers to the set of regulatory obligations (including GDPR, NIS2, DORA, the AI Act, and the European Accessibility Act) that software and technology companies must satisfy to lawfully operate in the European market, protect EU user data, and avoid penalties reaching up to 7% of global turnover.
The European Union is the world's most regulated digital market — and the most lucrative. With over 450 million consumers, a GDP of EUR 16.6 trillion, and enterprise buyers who increasingly demand regulatory compliance as a procurement prerequisite, the EU represents enormous opportunity for SaaS and tech companies. But that opportunity comes with a regulatory stack that can overwhelm even experienced compliance teams.
GDPR, NIS2, DORA, the AI Act, and the European Accessibility Act — five major regulations, each with its own scope, timeline, and penalty structure. This playbook cuts through the complexity with a practical, step-by-step approach designed for non-EU tech companies entering the European market and EU-based companies scaling their compliance programmes.
| Quick Reference | Details |
|---|---|
| Regulations covered | GDPR, NIS2, DORA, AI Act, European Accessibility Act |
| Primary audience | SaaS companies, tech companies, non-EU companies serving EU customers |
| Compliance timeline | 90-day foundational plan (see roadmap below) |
| Maximum penalty exposure | Up to EUR 35 million or 7% of global turnover (AI Act) |
| Key principle | Compliance = competitive advantage, not just risk mitigation |
| EU Representative required | Yes, if processing EU personal data without EU establishment |
| Certifications that accelerate deals | ISO 27001, SOC 2 Type II, ISO 42001 |
Key Takeaways
- Five EU regulations form the core compliance stack for tech companies: GDPR, NIS2, DORA, AI Act, and the European Accessibility Act
- GDPR applies to any company processing EU residents' personal data — regardless of where the company is headquartered
- Non-EU SaaS companies must appoint an EU Representative under GDPR Article 27 if they have no EU establishment
- NIS2 expanded cybersecurity obligations to cover cloud providers, SaaS platforms, and managed service providers since October 2024
- The AI Act is now fully in force for high-risk systems — companies deploying AI in the EU must classify and manage AI risk
- Demonstrable compliance accelerates enterprise sales cycles by 40–60% and is increasingly a procurement prerequisite
- A structured 90-day roadmap can bring a tech company from zero to foundational compliance across all applicable regulations
- SaaS compliance is not a one-time project — build continuous compliance operations from day one
Table of Contents
- The EU Regulatory Landscape for Tech Companies
- Which Regulations Apply to You?
- GDPR: The Foundation of EU Compliance
- GDPR for US Companies: Special Considerations
- NIS2: Cybersecurity Obligations
- DORA: Digital Resilience for Financial Services
- AI Act: Artificial Intelligence Regulation
- European Accessibility Act
- Regulation Comparison Matrix
- The 90-Day Compliance Roadmap
- Per-Regulation Compliance Checklists
- Compliance Cost Estimates
- Common Mistakes and How to Avoid Them
- Demonstrating Compliance to European Buyers
- KPIs and Governance Cadence
- Frequently Asked Questions
The EU Regulatory Landscape for Tech Companies
The EU's digital regulation strategy is built on a simple principle: the more impactful the technology, the more obligations it carries. Understanding how these regulations interact is the first step toward efficient compliance.
The Five Pillars of EU Tech Regulation
| Regulation | Full Name | In Force Since | Scope | Max Penalty |
|---|---|---|---|---|
| GDPR | General Data Protection Regulation | May 2018 | Personal data protection | EUR 20M or 4% of global turnover |
| NIS2 | Network and Information Security Directive | Oct 2024 | Cybersecurity for essential/important entities | EUR 10M or 2% of global turnover |
| DORA | Digital Operational Resilience Act | Jan 2025 | ICT risk in financial services | 1% of average daily global turnover |
| AI Act | Artificial Intelligence Act | Phased 2025–2027 | AI systems on EU market | EUR 35M or 7% of global turnover |
| EAA | European Accessibility Act | Jun 2025 | Digital accessibility for B2C products/services | National penalties (vary by member state) |
Why Compliance Is a Competitive Advantage
EU compliance is often framed as a cost centre. In practice, it's the opposite for companies that approach it strategically:
- Faster enterprise sales — 78% of European enterprise buyers require compliance evidence before contract signature (Gartner, 2025). Prepared companies close 40–60% faster.
- Higher deal values — Compliant vendors command 10–15% price premiums in regulated sectors like finance and healthcare.
- Market differentiation — In crowded SaaS categories, compliance certifications (ISO 27001, SOC 2) are decisive differentiators.
- Reduced risk — Systematic compliance practices prevent incidents that cost 5–10x more than prevention.
- Investor confidence — VCs and PE firms increasingly require regulatory due diligence; compliance-ready companies attract better terms.
The bottom line: Don't think of EU compliance as the cost of entering Europe. Think of it as the price of admission to the most demanding — and most valuable — enterprise market in the world.
Which Regulations Apply to You?
Use this decision matrix to determine which EU regulations apply to your company:
| Your Activity | GDPR | NIS2 | DORA | AI Act | EAA |
|---|---|---|---|---|---|
| Process personal data of EU residents | Yes | — | — | — | — |
| Provide cloud/SaaS/managed IT services | Likely | Yes (if >50 employees or >EUR 10M turnover) | — | — | — |
| Serve the financial sector (banks, insurers, investment firms) | Likely | Yes | Yes | — | — |
| Develop or deploy AI systems in the EU | Likely | — | — | Yes | — |
| Offer B2C digital products/services | Likely | — | — | — | Yes |
| Operate online marketplaces or search engines | Likely | Yes | — | Possibly | Yes |
| Provide data centre or DNS services | Likely | Yes | — | — | — |
Typical Profiles
| Company Type | Applicable Regulations | Priority Order |
|---|---|---|
| B2B SaaS (general) | GDPR, NIS2 | GDPR → NIS2 |
| B2B SaaS (financial clients) | GDPR, NIS2, DORA | GDPR → DORA → NIS2 |
| B2C SaaS / app | GDPR, NIS2, EAA | GDPR → EAA → NIS2 |
| AI-powered SaaS | GDPR, NIS2, AI Act | GDPR → AI Act → NIS2 |
| Fintech | GDPR, NIS2, DORA, possibly AI Act | GDPR → DORA → AI Act → NIS2 |
| Infrastructure / cloud provider | GDPR, NIS2, possibly DORA | GDPR → NIS2 → DORA |
First step, always: Conduct an inventory — what data do you collect, what systems do you operate, who are your customers, and what AI do you use? The inventory determines your regulatory profile.
GDPR: The Foundation of EU Compliance
Regulation (EU) 2016/679 is the most broadly applicable EU regulation and the one most non-EU companies encounter first. If you process personal data of anyone in the EU, GDPR applies to you — regardless of where your company is headquartered.
Core GDPR Obligations
| Obligation | Requirement | Deadline/SLA |
|---|---|---|
| Lawful basis | Document a legal basis for every processing activity | Before processing begins |
| Transparency | Clear, accessible privacy notice in plain language | Published and easily accessible |
| Data subject rights | Access, rectification, erasure, portability, restriction, objection | 30 days to respond |
| Records of Processing | Maintain Article 30 records of all processing activities | Continuously updated |
| Security measures | Appropriate technical and organisational controls | Ongoing |
| Breach notification | Notify supervisory authority of personal data breaches | 72 hours from awareness |
| Data Protection Impact Assessment | Conduct DPIA for high-risk processing | Before processing begins |
| EU Representative | Appoint representative if no EU establishment (Article 27) | Before offering services to EU |
| Data Protection Officer | Appoint DPO if required (public body, large-scale monitoring, special category data) | Before processing begins |
Six Lawful Bases for Processing
| Basis | When It Applies | Common SaaS Use Case |
|---|---|---|
| Consent | Individual freely gives informed, specific agreement | Marketing emails, analytics cookies |
| Contract | Processing necessary to perform a contract | Account creation, service delivery |
| Legal obligation | Required by EU or member state law | Tax records, employment law |
| Vital interests | Protect someone's life | Emergency health situations |
| Public task | Exercise official authority | Government services |
| Legitimate interest | Balancing test: business need vs. individual rights | Fraud prevention, security, direct marketing to existing customers |
SaaS tip: Most product functionality relies on contract (Article 6(1)(b)). Marketing and analytics typically require consent or legitimate interest with a documented balancing test. Getting the lawful basis wrong is the #1 GDPR mistake for SaaS companies.
Data Transfers Outside the EU
If your company stores or processes EU personal data outside the EU (which most non-EU SaaS companies do), you need a valid transfer mechanism:
| Transfer Mechanism | Description | Best For |
|---|---|---|
| Adequacy decision | EU Commission has determined the country provides adequate protection | US (via EU-US Data Privacy Framework), UK, Japan, South Korea, Canada, and others |
| Standard Contractual Clauses (SCCs) | Pre-approved contractual terms between data exporter and importer | Most common mechanism; works for any country |
| Binding Corporate Rules (BCRs) | Internal policies approved by supervisory authority | Large multinational groups |
| Transfer Impact Assessment (TIA) | Supplementary assessment when destination country laws may undermine SCCs | Required alongside SCCs where adequacy is uncertain |
For US companies: The EU-US Data Privacy Framework (DPF) provides an adequacy decision for US organisations that self-certify with the US Department of Commerce. This is the simplest path, but requires active certification and compliance with DPF principles. For a deeper understanding of where data must reside and how sovereignty rules affect architecture decisions, see our Data Sovereignty in the EU Guide.
GDPR Penalties: What They Look Like in Practice
| Violation | Penalty Tier | Notable Examples |
|---|---|---|
| Administrative/documentation failures | Up to EUR 10M or 2% of global turnover | Insufficient Article 30 records, missing DPO appointment |
| Rights violations, unlawful processing, transfer breaches | Up to EUR 20M or 4% of global turnover | Meta: EUR 1.2B (transfers), Amazon: EUR 746M (targeting) |
| Failure to cooperate with supervisory authority | Discretionary | Can trigger investigations and escalated penalties |
GDPR for US Companies: Special Considerations
US-based SaaS companies face unique GDPR challenges. This section addresses the most common questions and pitfalls.
Do You Need GDPR Compliance?
Yes, if any of these apply:
- You have customers or users in the EU (even one)
- Your website/app is accessible to EU residents and you offer goods or services to them
- You monitor the behaviour of individuals in the EU (analytics, tracking, profiling)
- You process data on behalf of an EU-based company (as a processor)
Common misconception: "We don't have an EU office, so GDPR doesn't apply." Wrong. GDPR applies based on the location of the data subject, not the location of the company.
EU Representative (Article 27)
If your US company processes EU personal data but has no EU establishment, you must appoint an EU Representative:
| Aspect | Details |
|---|---|
| Who | A natural person or legal entity established in the EU |
| Where | Must be in a member state where data subjects are located |
| Role | Point of contact for supervisory authorities and data subjects |
| Liability | The representative can be subject to enforcement alongside the company |
| Cost | EUR 3,000–15,000/year depending on provider and complexity |
| Exceptions | Public authorities; occasional processing not including large-scale special category data |
EU-US Data Privacy Framework
| Requirement | Details |
|---|---|
| Self-certification | Register with US Department of Commerce |
| Annual re-certification | Must renew annually |
| Privacy policy updates | Must commit to DPF principles in privacy policy |
| Dispute resolution | Must provide accessible, independent recourse mechanism |
| FTC/DOT enforcement | Subject to enforcement by US authorities |
| Human rights redress | EU individuals can seek redress through Data Protection Review Court |
Strategy for US SaaS companies: Self-certify under the DPF for the simplest transfer mechanism, and maintain signed SCCs as a backup in case the DPF faces another legal challenge (as happened with Privacy Shield in 2020).
NIS2: Cybersecurity Obligations
Directive (EU) 2022/2555 dramatically expanded the scope of EU cybersecurity obligations. Member states transposed it into national law by October 2024, and it now applies to a much broader range of companies than its predecessor.
Does NIS2 Apply to You?
NIS2 applies to essential entities and important entities in these sectors:
| Essential Entities (stricter obligations) | Important Entities |
|---|---|
| Energy (electricity, gas, oil, hydrogen, heating) | Postal and courier services |
| Transport (air, rail, water, road) | Waste management |
| Banking and financial market infrastructure | Chemical manufacturing |
| Healthcare | Food production and distribution |
| Drinking water and wastewater | Manufacturing (medical devices, electronics, machinery, vehicles) |
| Digital infrastructure (IXPs, DNS, TLD registries, cloud, data centres, CDNs) | Digital providers (online marketplaces, search engines, social networks) |
| ICT service management (B2B managed services, managed security) | Research organisations |
| Public administration | |
| Space |
Size threshold: Generally applies to medium enterprises (50+ employees or EUR 10M+ turnover) and large enterprises. Some sectors have no size threshold (e.g., TLD registries, DNS providers).
Key NIS2 Obligations for SaaS Companies
| Obligation | Details | Timeline |
|---|---|---|
| Risk management | Implement cybersecurity policies, risk analysis, and security measures | Ongoing |
| Incident reporting | Early warning within 24 hours, detailed report within 72 hours, final report within 1 month | Per incident |
| Supply chain security | Assess and manage risks from third-party suppliers and service providers | Ongoing |
| Business continuity | Backup management, disaster recovery, crisis response procedures | Ongoing |
| Vulnerability handling | Disclosure and management of vulnerabilities | Ongoing |
| Management accountability | Senior management must approve security measures; personal liability for failures | Ongoing |
| Training | Cybersecurity awareness training for all staff, including management | Regular |
NIS2 Penalties
| Entity Type | Maximum Penalty |
|---|---|
| Essential entities | EUR 10 million or 2% of global annual turnover |
| Important entities | EUR 7 million or 1.4% of global annual turnover |
| Management liability | Personal liability for senior management; potential temporary bans |
DORA: Digital Resilience for Financial Services
Regulation (EU) 2022/2554 on Digital Operational Resilience has applied in full since 17 January 2025. If you serve the financial sector, DORA likely applies to you.
Who Must Comply
| Financial Entities | ICT Third-Party Providers |
|---|---|
| Banks and credit institutions | Cloud service providers serving financial entities |
| Investment firms | Data analytics platforms for financial services |
| Insurance and reinsurance companies | SaaS tools used by banks, insurers, or investment firms |
| Payment institutions | Managed IT service providers for financial sector |
| Crypto-asset service providers | Outsourced ICT infrastructure providers |
| Central counterparties | Software providers for trading, risk, or reporting |
Key DORA Obligations
| Obligation | Requirement | Key Detail |
|---|---|---|
| ICT risk management | Comprehensive framework: identify, protect, detect, respond, recover | Must be approved by management body |
| Incident reporting | Initial notification: 4 hours; intermediate: 72 hours; final: 1 month | Faster than NIS2 for financial sector |
| Resilience testing | Regular testing of ICT tools and systems | TLPT every 3 years for significant entities |
| Third-party risk management | Due diligence, contractual requirements, concentration risk assessment | Exit strategies required for critical providers |
| Register of Information | Maintain detailed register of all ICT service provider arrangements | First submission: 30 April 2025 |
| Information sharing | Participate in cyber threat intelligence sharing | Voluntary but encouraged |
Critical for SaaS providers: If your customers include banks, insurers, or investment firms, they will flow DORA requirements down to you contractually. Expect requests for: incident notification SLAs, right-to-audit clauses, exit/transition planning, and Register of Information data.
DORA vs NIS2
| Aspect | DORA | NIS2 |
|---|---|---|
| Nature | Regulation (directly applicable) | Directive (transposed into national law) |
| Scope | Financial sector + their ICT providers | Cross-sector (essential + important entities) |
| Incident reporting | 4 hours initial | 24 hours early warning |
| Testing | TLPT required for significant entities | Risk-based testing |
| Relationship | Lex specialis — DORA takes precedence | Applies where DORA does not |
AI Act: Artificial Intelligence Regulation
Regulation (EU) 2024/1689 on Artificial Intelligence is the world's first comprehensive AI law. Its obligations are phased in through 2027, with prohibited practices already in force and high-risk requirements applying from August 2026.
AI Act Risk Classification
| Risk Level | Examples | Key Obligations | Effective Date |
|---|---|---|---|
| Prohibited | Social scoring, exploitative AI, real-time biometric ID in public spaces (with exceptions), emotion recognition at work/school | Must not deploy | 2 Feb 2025 ✅ |
| High risk | AI in recruitment, credit scoring, critical infrastructure, education, law enforcement, migration | Conformity assessment, risk management, human oversight, technical documentation, CE marking | 2 Aug 2026 ✅ |
| Limited risk | Chatbots, deepfakes, emotion recognition (where permitted), AI-generated content | Transparency — users must know they interact with AI | 2 Aug 2025 ✅ |
| Minimal risk | Spam filters, recommendation engines, most business software | No specific requirements; voluntary codes of conduct | N/A |
GPAI (General-Purpose AI) Obligations
All providers of general-purpose AI models must:
- Maintain technical documentation (training methodology, data sources, capabilities, limitations)
- Provide adequate information to downstream deployers
- Comply with EU copyright law and honour opt-out mechanisms
- Publish training content summaries per AI Office template
GPAI models with systemic risk (>10^25 FLOP compute or Commission-designated) face additional obligations: model evaluations, systemic risk mitigation, incident reporting, and cybersecurity.
AI Act Penalties
| Violation | Maximum Penalty |
|---|---|
| Deploying prohibited AI | EUR 35 million or 7% of global annual turnover |
| Non-compliance with high-risk requirements | EUR 15 million or 3% of global annual turnover |
| Providing incorrect information | EUR 7.5 million or 1.5% of global annual turnover |
European Accessibility Act
Directive (EU) 2019/882 — full application from 28 June 2025. This regulation is often overlooked by tech companies but applies broadly to B2C digital products and services.
Who Must Comply
The EAA applies to companies offering these products and services to EU consumers:
| Products | Services |
|---|---|
| Computers and operating systems | E-commerce websites and mobile apps |
| Smartphones, tablets | Banking services (ATMs, online banking) |
| TV equipment with interactive computing | Telephony and messaging services |
| E-book readers | Transport services (ticketing, real-time info) |
| Self-service terminals (ATMs, kiosks, check-in) | E-books and dedicated software |
Key Requirements
| Requirement | Standard | Details |
|---|---|---|
| Web accessibility | WCAG 2.2 Level AA | Perceivable, operable, understandable, robust |
| Mobile accessibility | WCAG 2.2 Level AA + platform guidelines | Native app accessibility features |
| Accessibility statement | Published and machine-readable | Conformance status, known issues, contact info |
| Feedback mechanism | Users can report accessibility barriers | Accessible contact method for issues |
| Documentation | Accessible product documentation | User guides, help content in accessible formats |
Micro-Enterprise Exemption
Companies with fewer than 10 employees and annual turnover or balance sheet total not exceeding EUR 2 million may be exempt from service obligations — but only if compliance would cause disproportionate burden. The exemption must be documented and reassessed.
Regulation Comparison Matrix
This matrix helps you understand how the five regulations interact and overlap:
| Aspect | GDPR | NIS2 | DORA | AI Act | EAA |
|---|---|---|---|---|---|
| Type | Regulation | Directive | Regulation | Regulation | Directive |
| In force | May 2018 | Oct 2024 | Jan 2025 | Phased 2025–27 | Jun 2025 |
| Scope | Personal data | Cybersecurity | Financial ICT resilience | AI systems | Digital accessibility |
| Applies to non-EU | Yes (extraterritorial) | Limited | Limited | Yes (extraterritorial) | Yes (if selling to EU consumers) |
| EU Representative | Required (Art. 27) | Not explicitly required | N/A | Required for non-EU providers | N/A |
| DPO / officer | DPO (if applicable) | CISO / responsible officer | ICT risk management function | AI compliance officer (recommended) | Accessibility officer (recommended) |
| Incident reporting | 72 hours | 24h / 72h / 1 month | 4h / 72h / 1 month | Serious incident reporting (GPAI systemic risk) | N/A |
| Documentation | Records of processing, DPIA | Security policies, risk assessments | ICT risk framework, register of information | Technical documentation, conformity assessment | Accessibility statement |
| Certification | Not required (but helpful) | National schemes possible | N/A | CE marking (high-risk) | Self-declaration or testing |
| Max penalty | EUR 20M / 4% | EUR 10M / 2% | 1% daily global turnover | EUR 35M / 7% | National (varies) |
Where Regulations Overlap
| Overlap Area | Regulations Involved | How to Handle |
|---|---|---|
| Security measures | GDPR + NIS2 + DORA | Implement once, document for each framework |
| Incident reporting | GDPR + NIS2 + DORA | Single incident process with regulation-specific notification paths |
| Risk assessment | All five | Unified risk methodology with regulation-specific modules |
| Vendor management | GDPR + NIS2 + DORA | Combined vendor assessment questionnaire |
| Documentation | All five | Central compliance documentation repository |
| Training | GDPR + NIS2 + DORA + AI Act | Integrated compliance training programme |
Efficiency principle: Never build five separate compliance programmes. Build one integrated compliance framework with regulation-specific modules. This cuts cost by 40–60% and reduces operational friction.
The 90-Day Compliance Roadmap
This roadmap takes a tech company from zero to foundational compliance across all applicable EU regulations. Adjust scope based on your regulatory profile.
Phase 1: Discovery and Assessment (Days 1–20)
| Step | Activities | Deliverables |
|---|---|---|
| Assemble the team | Appoint project lead; form cross-functional squad (product, legal, security, engineering); establish communication channels | Team charter, RACI matrix |
| Data inventory | Map all personal data: what you collect, where it's stored, how it flows, who processes it, lawful basis | Data flow map, processing inventory |
| AI inventory | Catalogue all AI/ML systems: purpose, data inputs, outputs, affected persons, provider | AI system register |
| Vendor inventory | List all vendors processing personal data or providing ICT services | Vendor register with risk tiers |
| Regulatory mapping | Determine which regulations apply based on inventories | Regulatory applicability matrix |
| Gap analysis | Compare current state against requirements for each applicable regulation | Gap assessment report with priority ranking |
| Claims audit | Review marketing, contracts, product copy for compliance claims that need substantiation | Audit findings and remediation list |
Phase 2: Design and Documentation (Days 21–50)
| Step | Activities | Deliverables |
|---|---|---|
| Privacy documentation | Privacy policy (English + local EU languages), Article 30 records, DPA template, DPIA for high-risk processing | Documentation package |
| Security framework | Cybersecurity policies, risk assessment methodology, incident classification, access control policies | Security policy suite |
| Technical measures | Encryption (transit + rest), MFA enforcement, logging, backup strategy, vulnerability management | Technical controls matrix |
| Incident response | Unified procedure covering GDPR (72h), NIS2 (24h), DORA (4h) timelines | Incident response playbook |
| AI governance | AI risk classification per AI Act, model documentation, transparency measures | AI governance framework |
| Accessibility audit | WCAG 2.2 AA assessment of web and mobile interfaces | Accessibility audit report |
| Vendor risk programme | Vendor tiering framework, assessment questionnaire, DPA review | Vendor risk management programme |
Phase 3: Implementation (Days 51–75)
| Step | Activities | Deliverables |
|---|---|---|
| Technical controls | Deploy consent management platform, data subject request portal, data export/deletion endpoints, MFA, security monitoring | Implemented controls |
| Accessibility fixes | Remediate critical and high-priority WCAG issues; implement accessibility statement | Improved accessibility score |
| Training | All-staff compliance basics, advanced for IT/legal, AI-specific for developers, accessibility for designers | Training records with completion tracking |
| Vendor compliance | Review and sign DPAs with all data processors, verify sub-processor lists, assess critical vendor security | Signed DPAs, vendor assessment records |
| EU Representative | Appoint and register EU Representative (for non-EU companies) | Appointment documentation |
| Privacy by design | Embed privacy into development workflow: preference centres, role-based access, data minimisation | Updated SDLC with privacy checkpoints |
Phase 4: Verification and Launch (Days 76–90)
| Step | Activities | Deliverables |
|---|---|---|
| Tabletop exercise | Simulate a data breach + AI Act inspection: test incident reporting workflows, DSR handling, security controls | Exercise report with lessons learned |
| Penetration test | External penetration test covering EU data residency zones and business continuity scenarios | Pentest report with remediation plan |
| Documentation review | Finalise all compliance documentation; ensure consistency across regulations | Final compliance documentation package |
| Customer-facing materials | Trust centre, security overview, compliance FAQ, sub-processor list | Published trust centre |
| Maintenance plan | Establish quarterly review cadence, annual procedure audit, regulatory change monitoring | Compliance operations calendar |
| Sign-off | Management approval of compliance programme; assignment of ongoing responsibilities | Signed compliance sign-off |
Remember: 90 days gets you to foundational compliance. Full maturity — including ISO 27001 certification, SOC 2 Type II reports, and optimised processes — typically takes 12–18 months. Start the 90-day plan now and iterate.
Per-Regulation Compliance Checklists
GDPR Checklist
- Identified all categories of personal data and processing purposes
- Lawful basis documented for each processing activity
- Privacy notice published (in relevant EU languages)
- Records of Processing Activities (Article 30) maintained
- Data Processing Agreements signed with all processors
- Data subject request process in place (30-day SLA)
- DPO appointed (if required: public body, large-scale monitoring, or special category data)
- EU Representative appointed (Article 27) if no EU establishment
- DPIA completed for high-risk processing activities
- Breach notification procedure tested (72-hour deadline)
- Transfer mechanisms in place for non-EU data flows (DPF, SCCs, BCRs)
- Transfer Impact Assessment completed (where SCCs are used without adequacy decision)
- Cookie/consent management implemented for website and apps
- Privacy by design embedded in development processes
NIS2 Checklist
- Cybersecurity risk assessment completed and documented
- Security policies documented and approved by management body
- Incident reporting procedure in place (24h early warning / 72h detailed / 1 month final)
- Business continuity and disaster recovery plan
- Supply chain security assessment completed
- Regular system updates and patch management process
- Vulnerability disclosure and management procedures
- Incident documentation maintained
- Cybersecurity training delivered to staff (including management)
- Registered with national competent authority (where required)
DORA Checklist (Financial Sector / ICT Providers)
- ICT risk management framework established and management-approved
- Incident classification and reporting procedures (4h / 72h / 1 month)
- Resilience testing programme in place (TLPT every 3 years for significant entities)
- Third-party risk management policy and due diligence procedures
- Register of Information compiled and ready for submission
- Exit strategies documented for critical ICT providers
- Contractual requirements aligned with DORA Article 30
- Concentration risk assessment for ICT providers
AI Act Checklist
- Inventory of all AI systems in use or development
- Risk classification for each system (prohibited / high / limited / minimal)
- Prohibited AI practices verified and eliminated
- Transparency measures for limited-risk systems (user disclosure)
- Human oversight mechanisms for high-risk systems
- Technical documentation for high-risk systems
- Risk management system for high-risk systems (Article 9)
- Data governance for high-risk systems (Article 10)
- Registration in EU database where required
- Conformity assessment completed (self or third-party for biometrics)
- GPAI model documentation (if applicable)
Accessibility Checklist
- WCAG 2.2 Level AA audit completed for web and mobile interfaces
- Accessibility statement published (machine-readable preferred)
- Remediation plan for identified issues with timelines
- Feedback mechanism for users to report accessibility barriers
- Ongoing accessibility testing incorporated into development workflow
- Product documentation available in accessible formats
Compliance Cost Estimates
One of the most common questions from tech companies: "How much will this cost?" Here are realistic estimates based on company size and regulatory scope.
By Company Size
| Company Size | Annual Compliance Investment | What's Included |
|---|---|---|
| Startup (5–20 employees) | EUR 15,000–40,000 | EU Representative, DPA templates, basic security controls, privacy documentation, legal review |
| Scale-up (20–100 employees) | EUR 40,000–120,000 | DPO (outsourced), security programme, vendor management, AI governance basics, accessibility audit |
| Mid-market (100–500 employees) | EUR 120,000–350,000 | Full-time DPO, ISO 27001 certification, SOC 2, comprehensive training, automated compliance tooling |
| Enterprise (500+ employees) | EUR 350,000–1,000,000+ | Dedicated compliance team, multi-regulation programme, continuous monitoring, third-party audits |
By Cost Component
| Component | Typical Range | Notes |
|---|---|---|
| Legal counsel (EU law) | EUR 10,000–50,000/year | Higher for initial setup, lower for maintenance |
| EU Representative | EUR 3,000–15,000/year | Required for non-EU companies |
| DPO (outsourced) | EUR 12,000–36,000/year | Depends on processing complexity |
| ISO 27001 certification | EUR 20,000–80,000 (initial) | Ongoing surveillance audits: EUR 10,000–25,000/year |
| SOC 2 Type II | EUR 30,000–100,000 (initial) | Annual audit: EUR 20,000–50,000 |
| Penetration testing | EUR 5,000–25,000/test | Annual or semi-annual |
| Accessibility audit (WCAG) | EUR 5,000–20,000 | Depends on application complexity |
| Compliance software (GRC) | EUR 5,000–50,000/year | Scales with features and users |
| Training | EUR 2,000–15,000/year | Per-employee cost decreases with scale |
Cost comparison: The cost of compliance is a fraction of the cost of non-compliance. A single GDPR fine can exceed your entire compliance budget by 100x. More importantly, losing a major EU enterprise deal due to failed due diligence costs far more than the compliance investment.
Common Mistakes and How to Avoid Them
| # | Mistake | Consequence | Solution |
|---|---|---|---|
| 1 | "We'll retrofit compliance later" | 20–30% higher cost; delayed deals; architectural debt | Embed compliance into product development from day one |
| 2 | Copy-pasting legal documents | Inconsistencies and gaps; regulators spot generic templates | Have EU counsel co-author documents referencing your specific processing and systems |
| 3 | Technology-only approach | Gaps in processes and people | Balance technical, organisational, and training measures — compliance is people + process + technology |
| 4 | One-time project mindset | Outdated documentation within months | Quarterly reviews, annual procedure audits, continuous monitoring |
| 5 | Ignoring vendor risk | Liability for vendor failures and breaches | Vendor due diligence, signed DPAs, regular reassessment, sub-processor change notifications |
| 6 | Silence during incidents | Escalated fines under NIS2 (24h) and DORA (4h) when notification is late | Pre-draft notification templates; align legal, security, and communications teams before an incident |
| 7 | No evidence of adoption | Regulators expect proof, not just policies | Maintain compliance workspace with policies, risk logs, training records, and audit trails |
| 8 | Treating GDPR as the only regulation | Blindsided by NIS2, DORA, or AI Act obligations | Conduct holistic regulatory mapping at the start |
| 9 | Underestimating accessibility | EAA enforcement begins June 2025; lawsuits in some member states | WCAG audit early; remediate before enforcement begins |
| 10 | No EU legal presence or representative | Cannot be reached by supervisory authorities; looks negligent to buyers | Appoint EU Representative (Article 27) or establish an EU entity |
Demonstrating Compliance to European Buyers
European B2B buyers increasingly require compliance evidence before signing contracts. Being prepared shortens sales cycles and increases close rates.
1. Build a Trust Centre
A public-facing page (or dedicated site) containing:
| Element | Purpose |
|---|---|
| Privacy policy | Demonstrates GDPR compliance; addresses data subjects directly |
| Sub-processor list | Shows transparency about who processes data |
| Security certifications | ISO 27001, SOC 2, ISO 42001 certificates/badges |
| Architecture overview | Data residency, encryption, access controls |
| Technical and organisational measures (TOMs) | Detailed security and privacy measures |
| Incident response summary | Demonstrates preparedness |
| Accessibility statement | Demonstrates EAA compliance |
| Compliance FAQ | Preemptively answers common procurement questions |
2. Prepare Contractual Documentation
| Document | Purpose | Availability |
|---|---|---|
| Data Processing Agreement (DPA) | GDPR Article 28 processor agreement | Signed before data processing begins |
| Standard Contractual Clauses (SCCs) | International data transfer mechanism | Attached to DPA where applicable |
| Service Level Agreement (SLA) | Availability, incident response, support hours | Part of commercial agreement |
| Sub-processor notification mechanism | Alert customers to changes in sub-processors | Process documented in DPA |
| DORA-compliant clauses | Specific requirements for financial sector customers | Addendum for financial customers |
3. Master Security Questionnaires
Common questions from EU enterprise buyers and how to prepare:
| Question | What to Prepare |
|---|---|
| Where is data stored? | Data residency map showing regions and providers |
| Who has access to data? | Access control policy, role matrix, principle of least privilege |
| How are incidents handled? | Incident response procedure with SLAs for each regulation |
| What certifications do you hold? | Certificate copies, audit reports, penetration test summaries |
| How do you handle data subject requests? | Process documentation, response SLA, deletion verification |
| What sub-processors do you use? | Published and maintained sub-processor list with notification process |
| How do you manage AI systems? | AI register, risk classification, governance framework |
| What accessibility measures are in place? | WCAG audit results, accessibility statement, remediation roadmap |
Pro tip: Pre-populate answers in common questionnaire formats (SIG, CAIQ, VSAQ) and maintain a centralised response library. This cuts response time from weeks to days.
4. Publish Thought Leadership
Demonstrate ongoing regulatory awareness:
- Quarterly compliance updates on your blog
- Response to major enforcement actions and their implications
- Guidance on how your product supports customer compliance
- Participation in industry compliance forums and working groups
KPIs and Governance Cadence
Compliance KPIs
Track these metrics to measure and improve your compliance programme:
| KPI | Target | Measurement |
|---|---|---|
| DSR response time | Median under 15 days (30-day legal maximum) | Track from request receipt to completion |
| Breach notification readiness | Under 120 minutes to draft regulator-ready notice (simulation) | Tabletop exercise results |
| DPIA completion time | Median under 12 days from feature concept to DPIA approval | Track per-feature |
| Access review completion | 100% of privileged access reviews on schedule | Quarterly audit |
| Vendor DPA coverage | 100% of data processors have signed DPAs | Vendor register audit |
| Training completion | 100% of staff completed required training | LMS tracking |
| AI register freshness | 100% of AI systems updated in last 90 days | Quarterly audit |
| Security questionnaire cycle time | Under 5 business days from receipt to completion | Track per-request |
| Accessibility score | WCAG 2.2 AA pass rate > 95% | Automated + manual testing |
Monthly EU Governance Council
Hold a monthly governance meeting with representation from legal, security, product, and engineering:
| Agenda Item | Purpose |
|---|---|
| Risk register review | Update risk assessments, add new risks, close resolved risks |
| Incident review | Analyse incidents and near-misses; identify systemic issues |
| Audit status | Track certification timelines, remediation progress |
| Regulatory horizon scan | New guidance, enforcement actions, legislative updates |
| Customer requirements | Emerging compliance demands from sales pipeline |
| KPI dashboard | Review all compliance metrics; flag items below target |
Annual Activities
| Activity | When | Who |
|---|---|---|
| Full regulatory mapping review | January | Legal + Compliance |
| ISO 27001 surveillance audit | Per certification schedule | Security + External auditor |
| SOC 2 Type II audit | Annually | Security + External auditor |
| Penetration test | Semi-annually | Security + External tester |
| DPIA review | Annually or after significant change | Privacy + Product |
| AI Act classification review | Annually or after new AI deployment | AI Governance + Legal |
| Accessibility audit | Annually | UX + External auditor |
| Comprehensive training refresh | Annually | All staff |
Frequently Asked Questions
Do I need an EU legal entity to sell in Europe?
Not necessarily. GDPR requires a EU Representative (Article 27) if you process EU personal data without an EU establishment — this is a natural or legal person acting as your contact point, not a full subsidiary. NIS2, DORA, and the AI Act have their own applicability criteria. However, many companies find that establishing an EU entity (often in Ireland, Netherlands, or Croatia) simplifies compliance, builds customer trust, and provides commercial advantages. If you are considering hiring in Croatia specifically, our Employer of Record Croatia Guide covers the legal and operational requirements.
How long does compliance really take?
With focused effort, foundational compliance is achievable in 90 days. This means core documentation, essential technical controls, and the ability to respond to regulatory and customer inquiries. Full maturity — including certifications (ISO 27001, SOC 2), optimised processes, and comprehensive training — typically takes 12–18 months. Maintenance is an ongoing process; plan for quarterly reviews and annual audits.
Do I need separate compliance for each EU country?
No. GDPR, NIS2 (as implemented nationally), DORA, and the AI Act are EU-wide frameworks — the rules are substantially uniform. You build one compliance programme that covers the entire EU single market. National supervisory authorities handle enforcement, but one set of documentation and controls covers all 27 member states. Some variation exists in NIS2 national transpositions, particularly around registration requirements and specific sector thresholds.
What if I only have a few EU customers?
The number of customers does not determine applicability. GDPR applies based on offering goods or services to EU residents or monitoring their behaviour — even one EU user can trigger obligations. Similarly, the AI Act applies if your AI system is placed on the EU market or its output is used in the EU. The good news: compliance requirements scale with your processing activities, so a smaller EU footprint means simpler compliance.
Can I rely on my US SOC 2 for EU compliance?
SOC 2 Type II is valuable and demonstrates security maturity to EU buyers, but it does not replace EU-specific requirements. GDPR requires specific privacy controls (lawful basis, data subject rights, breach notification) that SOC 2 doesn't cover. NIS2 has its own risk management and reporting requirements. Use SOC 2 as a foundation, then layer EU-specific controls on top. Many companies pursue ISO 27001 as a more globally recognised standard.
What's the order of priority if I can't do everything at once?
Start with GDPR — it has the broadest applicability and the most aggressive enforcement history. Then address whichever regulation is most relevant to your customer base: DORA if you serve financial services, NIS2 if you're a significant digital provider, AI Act if you deploy AI systems. The European Accessibility Act should be addressed in parallel if you have B2C products. Always tackle the regulation your customers are asking about as a priority.
How does DORA interact with NIS2?
DORA is lex specialis to NIS2 — for financial entities and their ICT providers, DORA requirements take precedence where they overlap (particularly around incident reporting and risk management). If you serve both financial and non-financial customers, you'll need to comply with both: DORA for your financial sector obligations and NIS2 for your broader cybersecurity obligations. In practice, DORA is stricter, so meeting DORA requirements generally satisfies NIS2 as well.
Is it worth getting ISO 27001 certified?
For most SaaS companies selling to EU enterprises: yes, strongly recommended. ISO 27001 is the most widely recognised information security standard in Europe. It demonstrates systematic security management, satisfies many NIS2 and DORA requirements by proxy, and dramatically shortens security questionnaire responses. The investment (EUR 20,000–80,000 initially) typically pays for itself within 2–3 enterprise deals through faster sales cycles and reduced due diligence friction.
Related Articles
- GDPR Compliance: The Ultimate Guide for 2026
- NIS2 Directive: Complete Guide to EU Cybersecurity
- NIS2 Compliance Checklist
- DORA Compliance: Complete Guide to Digital Operational Resilience
- EU AI Act: The Complete Guide to Compliance
- AI Risk Assessment: The Complete Framework
- ISO 27001 Implementation Guide
- Data Protection Officer Guide
- CSRD Reporting: The Complete ESG Guide
Take the Next Step
EU compliance is not a barrier to entry — it's your ticket to the most valuable enterprise market in the world. Companies that invest in systematic, demonstrable compliance close bigger deals faster, build deeper customer trust, and operate with the confidence that comes from knowing they've done it right.
Vision Compliance helps SaaS and tech companies navigate the EU regulatory landscape, from initial regulatory mapping through full compliance programme implementation. For help selecting the right advisory partner, see our guide to the best EU compliance firms. Whether you need a 90-day launchpad or a comprehensive multi-regulation programme, our team brings the cross-functional expertise — legal, technical, and operational — that effective compliance demands.
Schedule a Free Consultation to discuss your EU compliance needs, or explore our compliance guides to build your regulatory knowledge.
This guide reflects EU regulations as of February 2026. For company-specific compliance advice, consult with qualified legal and technical professionals. Official regulation texts are available on EUR-Lex.
Robert Lozo, mag. iur., is a Partner at Vision Compliance specializing in EU regulatory compliance. He advises organizations on GDPR, NIS2, AI Act, and financial regulation, delivering audit-ready documentation and compliance roadmaps across regulated industries.