NIS2 and the Cyber Resilience Act for companies that own software: what changes for your applications
TL;DR: NIS2 software requirements cover how a company buys, builds and maintains its applications, not only its firewalls and policies. Each EU country writes NIS2 into national law; in Poland that is the amended KSC Act, in force since 3 April 2026, which gives essential and important entities until 3 April 2027 to implement the required measures. The Cyber Resilience Act (CRA) adds product rules for anyone selling software or connected devices in the EU: vulnerability reporting since 11 September 2026 and full requirements, including SBOMs, from 11 December 2027. If your company runs its own applications, including tools staff built with AI, those applications now sit inside the scope your management board answers for.
Table of Contents
Key dates:
- 3 April 2026: Poland’s amended KSC Act, which implements NIS2 software requirements, enters into force.
- 11 September 2026: manufacturers in CRA scope must report actively exploited vulnerabilities and severe incidents.
- 3 April 2027: essential and important entities in Poland must have their risk-management measures in place, including an information security management system.
- 11 December 2027: the CRA applies in full, with CE marking and SBOMs.
- 3 April 2028: first security audit for essential entities in Poland, and the end of the grace period on most administrative fines.
Most NIS2 software requirements about projects start with paperwork: policies, procedures, a risk register. That work matters, but a policy cannot check what the code does. The policy says “access for authorised users only”; the app that three successive vendors and one enthusiastic sales manager built says otherwise. This article explains which NIS2 software requirements and Cyber Resilience Act rules land on your applications, who is in scope, and where to start.
What are the NIS2 software requirements?
NIS2 software requirements (Directive (EU) 2022/2555) requires essential and important entities to manage cybersecurity risk through the measures listed in Article 21(2). Several of them apply directly to software:
- supply chain security, including the security of relationships with suppliers (point d),
- security in the acquisition, development and maintenance of systems, including vulnerability handling and disclosure (point e),
- policies on cryptography and encryption (point h),
- access control and asset management (point i),
- multi-factor authentication where appropriate (point j).
In practice, NIS2 software requirements come down to five questions. Which applications do you run? Who built them and who maintains them? Which components do they contain? Who can access them? How do you find and fix vulnerabilities? The directive works through national law, so the details depend on the country.
Who do NIS2 and the Cyber Resilience Act apply to?
NIS2 NIS2 software requirements applies to companies in the sectors listed in its annexes that have at least 50 employees or more than €10 million in annual turnover. The list includes energy, transport, banking, health, drinking water, digital infrastructure, ICT service management, food and chemicals production, waste management, and the manufacture of electrical equipment, electronics, machinery and vehicles. Some entities, such as DNS providers and qualified trust service providers, are covered regardless of size. In Poland alone, the amended KSC Act is expected to cover around 38,000 entities, and each company must assess for itself whether it is essential or important.
The Cyber Resilience Act is a regulation, so it applies directly across the EU without national transposition. It covers products with digital elements placed on the EU market: hardware with software inside and standalone software. Manufacturers carry most obligations, including those based outside the EU; importers and distributors have narrower duties. Products with their own sector rules, such as medical devices and motor vehicles, are excluded, and SaaS is generally out of scope unless remote data processing is essential to a product’s function.
| NIS2 (in Poland: KSC Act) | Cyber Resilience Act | |
| Who | Essential and important entities in listed sectors | Manufacturers, importers and distributors of products with digital elements |
| What it regulates | Risk management in the organisation, including its systems and suppliers | Security of the product across its life cycle |
| Key deadlines | Poland: 3 April 2027 for measures; 3 April 2028 for the first audit of essential entities | 11 September 2026 for reporting; 11 December 2027 for full application |
| Maximum fines | €10 million or 2% of turnover (essential), €7 million or 1.4% (important) | Up to €15 million or 2.5% of turnover for breaching essential requirements |
What changes for the applications you already run?
NIS2 software requirements do not start with new projects. They apply to what you run today: the customer portal, the ordering app, the ERP integration, the service desk tool. Your security team or an auditor will ask about:
- Inventory. A list of applications with a business owner, a supplier and the data each one processes.
- Access. Who holds admin accounts, whether multi-factor authentication is on, and whether former staff and former contractors have lost access.
- Components. Which libraries and versions each application contains and whether they have known vulnerabilities.
- Secrets. Whether passwords and API keys sit in the code or the repository.
- Logs and backups. Whether events are recorded and whether anyone has ever restored the system from a backup.
- Vulnerability handling. Who receives a report, how long a fix takes and how it reaches production.
- Supplier contracts. Who maintains the application, how fast they ship fixes and whether you have the source code.
In Poland, the KSC Act places duties directly on the head of the entity and allows fines on that person too. Most administrative fines can only be imposed after April 2028, but the work has to be finished a year earlier.
What about internal tools your team built with AI?
Vibe coding, building software by describing it to an AI model, has given marketing, sales and operations teams their own tools: quote calculators, forms, small dashboards wired into the CRM. Many of them process customer data, and IT often does not know they exist. Under NIS2 they are ordinary assets that belong in the inventory and under access control.
The numbers explain why this matters. In an audit of 200 deployed repositories built with AI coding tools, 180 (90%) had at least one vulnerability, and broken access control was the most common class (36% of findings). The same roundup found that 57% of reachable Supabase-backed apps allowed unauthenticated table reads.
What does the Cyber Resilience Act add for manufacturers and software vendors?
If you make devices with software or sell software that customers install, NIS2 is only half of the picture. Since 11 September 2026, a manufacturer that learns of an actively exploited vulnerability in its product has 24 hours to send an early warning and 72 hours to file a full notification through the ENISA single reporting platform.
From 11 December 2027, the Cyber Resilience Act applies in full. Products must meet the essential requirements, pass a conformity assessment and carry CE marking, and manufacturers must keep a software bill of materials (SBOM) and ship security updates for the declared support period. Without an SBOM it is also hard to tell within 24 hours whether a new flaw in a popular library affects your product.
What are the NIS2, KSC and CRA deadlines?
| Date | What happens | Who it affects |
| 3 April 2026 | Poland’s amended KSC Act enters into force | Essential and important entities in Poland |
| 11 September 2026 | Reporting of actively exploited vulnerabilities and severe incidents | Manufacturers in CRA scope |
| 3 October 2026 | Self-registration window for Poland’s register of essential and important entities closes | Entities not registered ex officio |
| 3 April 2027 | Risk-management measures in place, including an information security management system | Essential and important entities in Poland |
| 11 December 2027 | CRA applies in full: CE marking, SBOM, support periods | Manufacturers, importers, distributors |
| 3 April 2028 | First security audit; most fines can be imposed | Essential entities (audit), all entities in scope (fines) |
Other EU countries have their own NIS2 laws and dates, so a company operating in several markets should check each one.
Where should you start? A five-step plan
- List your applications. All of them, including tools staff built with AI and the “temporary” integration that has been running for three years.
- Assign owners. For each application: who is accountable in the business, who built it, who maintains it now and whether you hold the source code.
- Check the most important applications technically. Start with those that handle customer data or connect to production: access control, secrets in code, dependencies, cloud and database configuration.
- Fix the critical findings. Open databases, missing authentication and leaked keys take days to fix, not quarters.
- Build the process. Vulnerability handling, dependency updates, an SBOM where the CRA requires one, and security terms in supplier contracts.
How Sanddev can help
We review the code and infrastructure of your applications, map the findings to NIS2, the KSC Act and the Cyber Resilience Act, and then fix what needs fixing or take over maintenance from the previous vendor. See what an independent check of your applications before the April 2027 deadline involves. Sometimes the review shows that repairs would cost more than a replacement; that is the moment to ask whether a good-enough app is worth keeping. We do not give legal advice: whether you are an essential or important entity is a question for your lawyers.
FAQ
Do NIS2 software requirements apply to the SaaS we buy?
Indirectly, yes. SaaS is part of your supply chain, so you must assess the provider’s security and put requirements in the contract. The Cyber Resilience Act generally does not cover SaaS on its own.
Does NIS2 apply if our sector is not on the list?
Not directly. Customers in scope may still pass security requirements down to you as their supplier, so in practice many companies outside the list are asked to meet similar standards.
Is ISO 27001 certification enough to meet NIS2 requirements?
It helps, but it is not the same thing. ISO 27001 is a voluntary standard; NIS2 and the KSC Act are law with sanctions. A certificate also does not prove that your application code does what your procedures say.
Do we need an SBOM under NIS2?
NIS2 does not require one explicitly. The Cyber Resilience Act does, for manufacturers of products with digital elements. For NIS2 entities an SBOM is still the quickest way to know which applications a new vulnerability affects.
What if a freelancer we can no longer reach built our app?
The responsibility stays with your company. First check whether you hold the source code and server access, then commission a review and decide whether to fix the application, hand it to a new maintainer or replace it.
When can fines be imposed in Poland?
In most cases, administrative fines under the amended KSC Act can be imposed from April 2028, two years after the law entered into force. CRA fines follow the CRA timeline, with full application from 11 December 2027.
Glossary
- Essential entity: an organisation in a highly critical sector, usually large; subject to regular audits.
- Important entity: an organisation in scope of NIS2 that does not meet the essential criteria; faces lower maximum fines.
- KSC Act: Poland’s National Cybersecurity System Act, which implements NIS2 after its 2026 amendment.
- ISMS: information security management system (in Polish law, SZBI), mandatory for essential and important entities in Poland.
- SBOM: software bill of materials, a list of the libraries and versions inside a product.
- Actively exploited vulnerability: a flaw that attackers have already used; under the CRA it starts the 24-hour reporting clock.