Software products and SaaS platforms face the broadest new EU regulatory scope. CRA applies from 2027, AI Act from 2024–2026, NIS2 catches managed service providers — and AVG applies to every customer you have in the EU.
CRA requires security-by-design for all products with digital elements — meaning your entire product development lifecycle must change. AI Act imposes conformity assessments for high-risk AI. NIS2 catches MSPs and cloud providers as essential or important entities.