Does software development fall under NIS2?
Software development as an activity is not explicitly named in the annexes of the NIS2 directive. There is no sector called "software builders." What is listed are related categories: cloud computing and cloud services fall under digital infrastructure, and managed ICT services and managed security services fall under ICT service provision. If you build bespoke software for customers without yourself providing a cloud service or managed service, you are unlikely to fall directly under the directive.
That does not mean software development falls out of scope. Three things together determine your position: the exact nature of what you supply (sector), the size of your organisation, and whether your customers themselves are under the directive. The last point affects far more development companies in practice than the first.
Sector: what the annexes do and do not name
The directive distinguishes essential sectors (Annex I) and important sectors (Annex II). Digital infrastructure and ICT service provision are in Annex I, and the latter category specifically covers parties that manage or monitor the ICT environment of others — think managed service providers. If you deliver a SaaS product where you manage the infrastructure for customers, or if you offer management, monitoring or hosting alongside your software, you move towards that category. If you supply only an application that the customer manages and hosts themselves, that is different.
The classification is less about what you call yourself and more about what you actually do for the customer. Two companies that both call themselves "software developers" can thus have different outcomes once one of them also takes on management. A structured assessment along sector, size and supply chain position gives clearer answers faster than a loose conversation about checklists. in a few questions see where your company stands
Size: the threshold applies even if the sector matches
Even if your activity falls within a named category, size thresholds apply: the directive distinguishes between medium-sized and large enterprises, with a different outcome for smaller organisations. A small development team that happens to also offer hosting does not automatically fall into the same category as a large cloud service provider. The precise thresholds and the exceptions that apply are in the directive and the national transposition; these are not something you should decide on the basis of a rule of thumb.
Supply chain position: caught without being obliged yourself
For most software companies, this is where the practical side of the story lies. The duty of care (Article 21) obliges essential and important entities to also assess the security of their suppliers. If you build software for a hospital, an energy company or a municipality, that customer is likely to send you a security questionnaire about your development process — regardless of whether you yourself fall under the directive.
These questionnaires rarely ask about abstract policy principles. They ask concretely how you identify and fix vulnerabilities, how patches reach the customer, and who within your company has access to the source code and production environment. Those seeing such questions for the first time often experience it as a surprise that puts the contract under pressure; with a fixed set of answers, the second time goes significantly faster. the topics selected for each situation
Two layers of security: the product and the development pipeline
In software development, two questions tend to overlap, and it is useful to keep them separate. The first concerns what you build: is there a process for identifying and resolving vulnerabilities in the code, are dependencies and libraries tracked, and how quickly does a security update reach the customer? The second concerns how you build: who has access to the source code repository, how is the CI/CD pipeline secured, and who is actually allowed to deploy to production?
A security questionnaire from a client typically touches both layers at once, even if the client does not distinguish between the two themselves. Supervisors and clients look at these kinds of questions to see whether a recognizable process exists and whether that process is documented, not only at the intention behind it.
What you can do now
Whether software development in your case falls under NIS2 depends on the precise service you deliver, the size of your organization, and the sector in which your customers operate. A definitive "yes" or "no" for the entire industry does not exist, and the final assessment of your situation belongs with a lawyer or the supervisory authority, not in a blog article.
What can be done is: determine which of the three positions you are in — subject to the obligations yourself, affected through a client, or not yet affected — and from there determine what questions you can expect. More about how this classification is made and where the sources used come from can be read on the page on our methodology. If you want to make that first classification for your own business, that is done in a few minutes, without requiring an account. the frequently asked questions on the classification provide an additional picture of how other software development companies face the same question.