What changed for buyers
NIS2 is the EU's updated cybersecurity directive. It covers far more sectors than its predecessor and pulls in many mid-sized companies for the first time. Member states write it into national law, so the details differ slightly between Germany and Austria, but the core obligations are the same.
Two of them matter for anyone selling software into those companies. Management is accountable for cybersecurity risk management and can be held liable for it. And the risk measures explicitly include the security of the supply chain: the suppliers and service providers a company relies on.
Why that reaches your pipeline
If your product touches a customer's data, network or operations, you are part of their supply chain. Their security team now has a documented reason to ask how you work, and their management has a personal reason to want a good answer.
In practice we see the questions move forward. Where a CISO used to join at the end of a deal, the first security questionnaire now often arrives before the business case is finished. Vendors who answer quickly look like a safe choice. Vendors who need three weeks to find someone who can answer look like a risk, whatever their product does.
What a prepared vendor has ready
None of this is exotic. It is mostly documentation that already exists somewhere in the company, collected and translated into what a European buyer expects to see.
- A data processing agreement that works under GDPR, plus a clear answer on where data is stored and processed.
- Current security documentation: certifications such as ISO 27001 or SOC 2 where you have them, and a short security overview where you don't.
- A named contact who can answer security questions within days, not weeks.
- An incident and vulnerability process you can describe in two minutes.
- For AI products, a first view of how the EU AI Act classifies what you sell. Its obligations apply in stages, and buyers already ask.
Switzerland and the UK
Neither country is bound by NIS2. Switzerland and the UK run their own rules, and the UK is updating its NIS regime as well. In practice, large Swiss and British companies with European customers tend to ask very similar questions, so the same answer pack carries over with little extra work.
This is a general overview, not legal advice. For your specific product, talk to counsel who knows the national implementation in your target market.