Of the three EU regimes that get cited at you in security questionnaires, exactly one actually contains the words “penetration testing”. It is DORA, and it applies to financial entities. GDPR does not say it. NIS2 does not say it either.
That matters because they hit different companies and get enforced in different ways. Treat “EU compliance” as one thing and you end up buying the wrong test, or buying none and assuming a firewall covers Article 32.
This is general information rather than legal advice. NIS2 in particular is a directive, so what binds you is your own member state's law, not the directive text.
GDPR: testing is required, the method is yours
Article 32(1)(d) of the GDPR requires appropriate measures including “a process for regularly testing, assessing and evaluating the effectiveness” of your technical and organisational security measures. No method is named. No frequency is given. The standard is appropriateness to the risk.
So a penetration test isn't mandatory under GDPR. It's also the usual way to evidence that clause for an internet-facing app that handles personal data. Both are true, and supervisory authorities work in the gap between them.
Who it catches: pretty much anyone processing personal data of people in the EU, whatever the size or sector. There's no employee threshold. A four-person SaaS company with EU customers is in scope.
What to have on file: evidence that testing happens on a schedule, the reasoning behind the schedule you chose, and proof you acted on the results. A report with open high-severity findings and no remediation record is worse than no report, because it documents that you knew.
NIS2: effectiveness assessment, by whatever means your regulator accepts
Directive (EU) 2022/2555 lists ten minimum risk-management measures in Article 21(2). Two are relevant here. Point (e) covers security in acquisition, development and maintenance, including vulnerability handling and disclosure. Point (f) requires policies and procedures to assess the effectiveness of your cybersecurity risk-management measures.
Point (f) is the testing hook. It does not say how. In practice national implementations and sector guidance are where penetration testing shows up by name, which is why two companies in the same sector in different member states can face different expectations.
Who it catches, roughly:
- Sector plus size. You have to be in one of the sectors in Annex I (energy, transport, banking, financial market infrastructure, health, drinking water, waste water, digital infrastructure, B2B ICT service management, public administration, space) or Annex II (postal and courier, waste management, chemicals, food, manufacturing, digital providers, research), and meet a size threshold.
- The size threshold comes from Commission Recommendation 2003/361/EC: you're in scope if you qualify as a medium-sized enterprise or bigger. In practice that means 50 or more staff, or turnover and balance sheet both above EUR 10 million. Most genuinely small companies fall outside the default scope.
- Exceptions cut both ways. Some entities are in scope regardless of size, including certain DNS service providers, TLD registries and sole providers of a critical service in a member state. Don't stop at the headcount test.
- Essential or important. The split changes supervision, not the measures. Essential entities get proactive supervision; important entities are supervised after the fact.
Timing is what people get wrong. Member states had to adopt and publish their implementing laws by 17 October 2024 and apply them from 18 October 2024. Most missed it, and the Commission opened infringement proceedings against 23 of them that November. If your national law is late, the obligation lands when it lands. The questionnaires from your enterprise customers didn't wait.
There's also a pass-through effect that catches companies well below the threshold. Point (d) covers supply chain security, so in-scope entities push security requirements onto their suppliers by contract. A ten-person vendor selling into a hospital group gets NIS2 obligations through the contract, not through the statute.
DORA: the one that names it, twice
Regulation (EU) 2022/2554 has applied since 17 January 2025. As a regulation it binds directly, with no national transposition, and it's far more specific than the other two. It sets two separate testing obligations.
Baseline testing, yearly. Financial entities other than microenterprises must ensure appropriate tests are conducted at least yearly on all ICT systems and applications supporting critical or important functions. Article 25 sets out what counts, and the list is broad: vulnerability assessments and scans, open source analyses, network security assessments, gap analyses, physical security reviews, source code review where feasible, scenario-based testing, compatibility, performance and end-to-end testing, and penetration testing by name.
Advanced testing, at least every 3 years. Entities identified by their competent authority must carry out threat-led penetration testing, covering several or all critical or important functions, performed on live production systems. The competent authority can move that frequency in either direction based on your risk profile. Microenterprises and entities under the simplified ICT risk management framework can't be picked for TLPT.
TLPT is a different product from a web application pen test. It's red teaming driven by real threat intelligence, scoped with the regulator, with rules on who the testers can be. If a bank asks you for TLPT, a $495 external test isn't the answer, and anyone telling you otherwise is selling you something.
Who it catches: banks, payment and e-money institutions, investment firms, insurers and intermediaries, crypto-asset service providers, trading venues, fund managers, and ICT third-party service providers that the European Supervisory Authorities designate as critical. That last group is the surprise. A software vendor can end up under direct EU oversight without being a financial firm at all.
Not designated? If you sell software to a DORA-regulated firm, their contracts with you are now shaped by Chapter V. Expect audit rights, exit plans and requests for testing evidence.
Which one is talking to you
This settles most cases:
- Regulated financial entity, or designated critical ICT provider to one? DORA. Yearly baseline testing, and TLPT every three years if you are identified for it.
- In an Annex I or II sector and at or above the size cap? Your member state's NIS2 law. Build an effectiveness assessment programme and check national guidance for whether penetration testing is named explicitly.
- Selling into either of the above? Neither law binds you directly. The contracts do. In our experience this is the most common reason a small company buys its first test.
- Processing EU personal data and none of the above? GDPR Article 32 only. Test on a schedule you can justify and keep the remediation record.
One more for the calendar: the Cyber Resilience Act, which covers products with digital elements. Its vulnerability and incident reporting duties started on 11 September 2026, and the main manufacturer obligations apply from 11 December 2027. If you ship software or connected hardware into the EU, read it now and plan. It's not what this year's questionnaire is asking about.
Where we fit
For GDPR Article 32 evidence, for NIS2 point (f) on an internet-facing application, or for the baseline band of DORA Article 25, an external web application test is a proportionate thing to buy, and we write the report to hand to whoever is asking.
It isn't a TLPT engagement, an internal network test or a certification. If you have been asked for threat-led testing under DORA Article 26, you need a specialist red team provider and a regulator-approved scope.
For how other regimes compare, our UK requirements post covers the post-Brexit picture, and the US regulations post goes through the American rules sector by sector. What a $495 pen test covers sets out the scope in detail.
The free scan shows what's visible on your domain right now. It's a useful first look before you work out which of these regimes you're actually answering to.