Does NIS2 Apply to My Dubai Software Company or MSP? (2026 Guide)
24 of 27 EU states have transposed NIS2 and four were referred to the Court of Justice in July 2026. If you manage, host or patch systems for European clients from Dubai, it already reaches you.
- PUBLISHED
- 03 NOV 2026
- READ TIME
- 13 MIN
- AUTHOR
- AQUARIUS · DUBAI
- UNIT
- REV 2026.09
Short answer: NIS2 almost certainly does not apply to your Dubai company directly — unless you install, manage, operate or maintain your clients’ systems. If you do that for customers in the EU, Annex I sector 9 catches you as a managed service provider, and Article 26(3) forces you to appoint a representative inside the Union. If you only build software and hand it over, NIS2 reaches you a different way: through your European client’s own Article 21(2)(d) supply-chain duty, which arrives as contract clauses, security questionnaires and audit rights rather than a letter from a regulator.
That distinction is worth real money, and most Dubai agencies get it backwards. Here is the 2026 state of play, who is actually in scope, and what it costs to clear.
Where NIS2 actually stands in November 2026
Directive (EU) 2022/2555 — NIS2 — entered into force in January 2023, and Member States had until 17 October 2024 to write it into national law. It repealed the original NIS Directive from 18 October 2024 and widened coverage to 18 sectors. Two years past the deadline, the picture is finally close to complete: 24 of 27 Member States have transposed, and the stragglers are being pushed hard.
The enforcement trail matters, because it tells you when your clients’ obligations became real:
- On 7 May 2025 the Commission issued reasoned opinions to 19 Member States for failing to notify full transposition — including Germany, France, Spain, the Netherlands, Austria, Poland and Portugal.
- On 8 July 2026 the Commission decided to refer Ireland, Spain, France and the Netherlands to the Court of Justice.
- The Netherlands then transposed on 10 July 2026, in force 15 August 2026. Germany’s law landed 5 December 2025, Austria’s on 23 December 2025 (in force 1 October 2026), Estonia’s on 30 December 2025 (in force 1 January 2026), Bulgaria’s on 5 February 2026 and Luxembourg’s on 6 May 2026 (in force 10 May 2026).
Translation for a Dubai vendor: the wave of client-side security questionnaires that began in Belgium, Italy, Croatia and Hungary in 2024 has now reached Germany, Austria and the Netherlands — three of the biggest buyers of outsourced software work in Europe. If your inbox has suddenly filled with 80-question supplier assessments, this is why.
The exposure is growing on the Dubai side too. The UAE ICT market is projected at USD 57.61 billion in 2026, up from USD 52.22 billion in 2025 and on track for USD 94.02 billion by 2031 (10.29% CAGR), with IT services alone accounting for 32.73% of the market. Dubai Internet City and Dubai Silicon Oasis together host more than 2,300 technology companies, and UAE non-oil foreign trade hit AED 1.9 trillion in H1 2026, up 13% year on year. A large slice of that services trade points at Europe — and UAE–EU free trade talks reached a seventh round by July 2026 without a signature, so there is no treaty shortcut around EU digital rules.
The one test that decides your status
Everything hinges on Article 6(39), which defines a managed service provider as:
“an entity that provides services related to the installation, management, operation or maintenance of ICT products, networks, infrastructure, applications or any other network and information systems, via assistance or active administration carried out either on customers’ premises or remotely.”
Read the verbs: installation, management, operation, maintenance, active administration. Not “design”. Not “develop”. Not “license”. A Dubai studio that ships a custom application and walks away is outside the definition. The same studio on a monthly retainer that patches the servers, rotates the keys and owns the on-call rota is inside it.
Annex I sector 9, ICT service management (business-to-business), lists exactly two entity types: managed service providers and managed security service providers. Here is how the common Dubai business models map:
| Your business model | Directly in NIS2 scope? | What actually hits you |
|---|---|---|
| Bespoke app or web development, handover at launch | No | Client’s Article 21(2)(d) clauses, questionnaires, audit rights |
| Web design and UX only | No | Light supplier screening, usually a short form |
| SaaS licence, no customer-system administration | No (not as an MSP) | Supply-chain clauses; check cloud-service classification separately |
| Support and patching retainer on client infrastructure | Yes — MSP | Article 21 measures, Article 23 reporting, EU representative |
| Managed hosting, DevOps-as-a-service, 24/7 ops | Yes — MSP | Full Annex I duties plus the CIR (EU) 2024/2690 baseline |
| SOC, managed EDR, managed firewall | Yes — MSSP | Same, with the heaviest supervisory attention |
| Cloud computing, data centre or CDN service | Yes — digital infrastructure | Essential-entity treatment is common; EU representative required |
The size thresholds
From 50 employees, or where annual turnover and balance sheet total each exceed EUR 10 million (about AED 41.5 million), an MSP is normally an important entity. From 250 employees, or turnover above EUR 50 million with a balance sheet above EUR 43 million, it becomes an essential entity. Micro and small firms — under 50 staff with turnover and assets both under EUR 10 million — are generally outside direct regulation.
Two caveats Dubai founders miss. First, the size exemption is not absolute: Article 2(2) lets a Member State pull in a sub-threshold provider that is the sole provider of an essential service, or that carries systemic, cross-border or regional significance — the textbook example being a small MSP running IT for a region’s hospitals. Second, the “regardless of size” carve-out in Article 2(2)(a) covers DNS providers, TLD registries, trust service providers and public electronic communications networks. MSPs are not on that list, so the 50-staff / EUR 10 million test genuinely protects a 12-person Dubai shop.
If you are in scope, Article 26 is the clause that bites
Article 26(3) names ten categories that must designate a representative in the Union when they are not established there: DNS service providers, TLD name registries, cloud computing services, data centre services, content delivery networks, managed service providers, managed security service providers, online marketplaces, online search engines and social networking platforms. The representative must sit in a Member State where you actually offer the service, and your entity is then deemed to fall under that state’s jurisdiction — one regulator, not twenty-seven.
Skip it and Article 26(4) is blunt: in the absence of a designated representative, any Member State in which you provide services may take legal action against you. That is the worst of all worlds — no single supervisor, every supervisor.
The technical baseline: CIR (EU) 2024/2690
Adopted 17 October 2024, this Implementing Regulation sets harmonised technical requirements for eleven digital entity categories, MSPs and MSSPs included, across 13 areas: security policy and risk management, incident handling, business continuity and crisis management, supply-chain security, secure acquisition and development, vulnerability handling and disclosure, effectiveness assessment, cyber hygiene and training, cryptography, HR security and access control, multi-factor authentication and secured communications, physical and environmental security, and the significance thresholds that trigger reporting. It is the closest thing to a checklist the EU has published, and far more specific than Article 21’s ten headline measures.
Reporting clocks you need to be able to hit
Article 23 runs a three-stage clock for any significant incident: an early warning within 24 hours of becoming aware, a fuller incident notification within 72 hours with a severity assessment and indicators of compromise, and a final report within one month covering root cause and remedies. If the incident is still live at the one-month mark you file a progress report, and the final report is due a month after it is actually handled. If you are an MSP, your clients will push those deadlines onto you contractually — typically as a 4-to-12 hour vendor notification window, because they need runway for their own 24-hour filing.
What non-compliance and compliance each cost
The penalty ceilings are the part everyone quotes: up to EUR 10 million or 2% of worldwide annual turnover, whichever is higher, for essential entities, and EUR 7 million or 1.4% for important entities. Less quoted but more uncomfortable: Article 20 puts cybersecurity risk management squarely on the management body, and Article 32 lets supervisors publicly disclose infringements and temporarily bar a person at executive level from management duties. For important entities, supervision is reactive — audits follow an incident or a credible suspicion, not a calendar.
Compliance is cheaper than the headline numbers, but it is not free. The Commission’s own impact assessment projected a rise of up to 22% in ICT security spending for newly covered companies and about 12% for those already under NIS1. Germany’s cabinet-approved impact assessment put national business cost at EUR 2.12 billion one-off and EUR 2.3 billion a year across roughly 30,000 affected firms, with 83% needing remediation work — an average of about EUR 71,000 (circa AED 295,000) per year for a company that still has gaps to close.
Against that, the Article 26 representative is the cheapest line item on the list:
| Line item | Published EUR range | Approx. AED |
|---|---|---|
| EU representative, smallest bands (DataRep, Engage Compliance) | EUR 150 – 990 / year | AED 620 – 4,100 |
| EU representative, larger bands | EUR 2,290 – 4,490 / year | AED 9,500 – 18,600 |
| EU representative, classified entity tiers (EDPO) | EUR 2,500 important / 5,000 essential | AED 10,400 / 20,750 |
| Typical full representative plus advisory engagement | EUR 4,000 – 12,000 / year | AED 16,600 – 49,800 |
| Average annual remediation cost, German government estimate | circa EUR 71,000 | circa AED 295,000 |
Converted at roughly EUR 1 = AED 4.15 (early November 2026). The dirham is pegged to the US dollar at 3.6725, so this pair simply tracks EUR/USD.
The amendment that may change your tier before you finish the work
On 20 January 2026 the Commission proposed targeted NIS2 amendments as COM(2026) 13, alongside a Cybersecurity Act 2. The headline change creates a small mid-cap category — fewer than 750 employees with turnover up to EUR 150 million or a balance sheet up to EUR 129 million — and defaults those Annex I entities to important rather than essential. The Commission estimates the package touches 28,700 companies, including 6,200 micro and small enterprises, and lowers costs for roughly 22,500 of them. Micro and small DNS providers come out of scope; digital wallet providers and submarine cable operators go in.
Do not plan around it yet. The Parliament’s ITRE committee only received a draft report on 24 September 2026, the Council has no general approach, trilogues have not begun, and transposition would follow roughly twelve months after adoption. The 24-hour, 72-hour and one-month reporting deadlines are untouched in the proposal. Separately, the Digital Omnibus (COM(2025) 837) would build a single ENISA entry point for incident notifications under NIS2, GDPR, DORA, eIDAS and the CER Directive — “report once, share many” — expected 18 to 24 months after that regulation enters into force.
Most Dubai firms get this wrong in exactly two ways
Myth 1: “We are NIS2 certified.” There is no such thing. NIS2 has no certification scheme, no accredited auditor and no badge. Any vendor selling you a NIS2 certificate is selling you a PDF. What you can evidence is an ISO 27001 certificate, a SOC 2 report, a penetration test and a mapped control set — which is why the practical route runs through ISO 27001 or SOC 2 and documented VAPT, then maps those controls onto the 13 CIR 2024/2690 areas.
Myth 2: “We are in Dubai, so EU law cannot touch us.” It does not need to. Your European client is the regulated party, and Article 21(2)(d) requires it to manage “security-related aspects concerning the relationships between each entity and its direct suppliers or service providers” — which in practice means knowing which suppliers are security-relevant, assessing their security level, and anchoring requirements in the contract. The clauses now appearing include short incident-notification windows, cooperation duties during incident handling, audit and information rights, subcontracting approval, and termination for security failure. Lose the questionnaire and you lose the renewal. No regulator involved.
This is the same pattern we mapped for financial-sector clients in DORA compliance for Dubai software vendors selling to EU banks, and for product software in the EU Cyber Resilience Act. Three regimes, one mechanism: EU obligations travel down the supply chain as contract terms.
How Aquarius handles it
We start with the scope question, because answering it correctly is often worth more than the whole compliance budget. A 20-person Dubai dev shop that stops short of active administration stays out of Annex I and needs a supplier evidence pack, not an EU representative. A managed-hosting arm of the same company needs both.
From there the work is concrete: an Article 6(39) scope memo you can hand a client’s procurement team, controls mapped to the 13 CIR 2024/2690 areas with evidence attached, an incident runbook that can produce a vendor notification inside a 4-hour contractual window and feed a client’s 24-hour filing, a redlined clause set so you are not signing unlimited audit rights, and — where Article 26(3) applies — a representative appointment in the right Member State. Build and hosting work is quoted on our standard pricing tiers.
The cost of inaction is not theoretical. The UAE Cyber Security Council reported blocking close to 750,000 cyberattack attempts in a single sweep this year, with energy and education the top targets, 128 confirmed cyber incidents across UAE entities since the start of 2026, and state-sponsored groups behind 71.4% of attacks. Your EU client’s Article 21(2)(d) assessment will ask what you do about that. Having the answer written down before the questionnaire arrives is the whole difference between a renewal and a replacement.
FAQ
Does NIS2 apply to a Dubai company with no EU office?
Only if you fall into one of the Article 26(3) digital categories and offer that service to customers in the EU — cloud, data centre, CDN, DNS, TLD, MSP, MSSP, online marketplace, search engine or social network. In that case you must designate a representative in a Member State where you offer the service, and you fall under that state’s jurisdiction. Outside those categories, NIS2 reaches you only through your client’s contract.
Is a custom software development agency an MSP under NIS2?
No. Article 6(39) turns on installation, management, operation, maintenance or active administration of systems. Building and handing over an application is not covered. Add an ongoing retainer where you patch, monitor or administer the client’s environment and you cross the line — which is why the scope answer changes the moment you sell a support contract.
What are the NIS2 fines, and can directors be held personally liable?
Up to EUR 10 million or 2% of worldwide annual turnover (whichever is higher) for essential entities, and EUR 7 million or 1.4% for important entities. Article 20 places the duty on the management body, and Article 32 allows supervisors to publicise infringements and temporarily prohibit an executive from exercising management functions. National transposition laws set the operative detail, so the regime that applies to you depends on the Member State of your representative.
Do we need ISO 27001 to satisfy NIS2?
Not legally — NIS2 mandates measures, not certificates. Commercially it is the shortest path, because an ISO 27001 certificate or a SOC 2 Type II report answers most of a client’s supplier questionnaire in one document and maps cleanly onto the 13 CIR 2024/2690 control areas. Starting from zero, expect certification to be the larger share of a first-year NIS2 budget.
How fast do we have to tell an EU client about a breach?
NIS2 itself gives the regulated entity 24 hours for an early warning, 72 hours for notification and one month for a final report. Because your client needs time to assemble its 24-hour filing, vendor contracts typically demand notification within 4 to 24 hours of your own detection — and increasingly require a named contact reachable outside Dubai business hours.
Will the January 2026 amendments reduce our obligations?
Possibly, if you are an Annex I entity under 750 employees: COM(2026) 13 would default small mid-caps to important rather than essential, cutting supervisory intensity for around 22,500 companies. But the file had no Council position and no trilogues as of late 2026, with transposition roughly a year after adoption. Comply with the law as transposed today.
Not sure which side of Article 6(39) your contracts fall on? Send us two of your EU client agreements and your service description, and we will tell you whether you need an EU representative or just a better evidence pack. Talk to Aquarius →