SaaS development agency in Italy: how to choose one in 2026

Business and ScaleAug 27, 20269 min read

Five checks before signing with an Italian SaaS development agency: NIS2 supplier duties, AI Act Article 50, and EAA fines up to 40,000 euros.

In this piece

By the end of this article you will have a five-step procedure for choosing a SaaS development agency in Italy, and the questions that expose a shop that cannot ship. The steps run in order of how cheaply they eliminate a candidate: proof of production work first, regulatory exposure second, price structure last.

Candidates are not scarce. The Italian ICT ecosystem counted 132,832 companies and 638,150 people in 2025, inside a digital market worth 84.4 billion euros that grew 3.4 percent year on year. The hard part is telling a product team apart from a staffing desk that will bill you for bodies.

What you need before you talk to anyone

A written scope, even a rough one. Two pages beat a call. The shape is in how to brief a software development agency.
A budget range you are willing to say out loud. Agencies that hear a range answer with a plan. Agencies that hear silence answer with a discovery invoice.
A decision on where the code lives. Your GitHub organisation or theirs. That single line changes the whole negotiation.
One named owner inside your company. Not a committee. A person who can approve and refuse.

Step 1: which SaaS products are live, and on which stack

Ask for two products in production, with URLs, and the stack each one runs on. Then ask who on the proposed team wrote which part. A studio that ships answers in three minutes. A reseller asks to prepare a deck.

The follow-up carries more weight than the answer. Ask what broke after launch and how long the fix took. Every real product has an incident story: a migration that locked a table, a webhook that double-charged, a release that took the search page down for an hour. An agency with no incident story has either never operated what it built, or is hiding the handover.

Match matters more than fashion. If your team is two Python engineers, a .NET-only agency leaves you unable to maintain what you paid for. If nobody internal will touch the code for a year, the argument flips and their stack wins. Decide which case you are in before the first call, because the agency will decide for you otherwise.

Step 2: how they fit into your NIS2 supplier list

Italy transposed the NIS2 directive with legislative decree 138/2024, in force since 16 October 2024. If your company is in scope, a software vendor is no longer just a vendor. It is a supply-chain item you have to map, contract, and monitor.

2026 is the year that paperwork got teeth. Entities in scope file their list of relevant ICT suppliers on the ACN portal between 15 April and 31 May each year, and baseline security measures fall due on 31 October 2026. An agency that has never heard of the ACN portal will not fail you in the sprint. It will fail you in April, when you need attestations it cannot produce.

The question to ask: if we name you as a relevant supplier, what do you hand us? Three artefacts answer it. Incident notification terms with a clock on them. An audit right you can actually exercise. An exit plan naming who holds credentials and how they transfer. A vendor that answers "we are ISO certified" has answered a different question.

Step 3: what changes in your product on 2 August 2026

If the product has any AI feature, this date sits on your roadmap whether you put it there or not. From 2 August 2026 the AI Act transparency duties in Article 50 apply, together with AI literacy requirements for staff and the oversight regime for general-purpose models.

The Digital Omnibus on AI, Regulation (EU) 2026/1744, in force since 27 July 2026, moved the stand-alone high-risk regime in Annex III to 2 December 2027 and the embedded-product regime in Annex I to 2 August 2028. It left Article 50 alone. An agency telling you that "AI compliance got postponed" has read a headline rather than the regulation, which is a useful thing to learn in a sales call.

Italy adds a national layer. Law 132/2025, in force since 10 October 2025, names AgID and ACN as the national AI authorities, with ACN holding market surveillance, inspection, and sanction powers. It also requires firms and professionals to state clearly when AI is used in the service they deliver. So ask how the agency discloses its own AI-assisted development, in writing, in the contract. Plenty of Italian studios now write production code with models in the loop. That is not the problem. Not saying so is.

Step 4: accessibility belongs in the contract, not in the backlog

Legislative decree 82/2022 brought the European Accessibility Act into Italian law, and it has applied to private-sector digital services since 28 June 2025: e-commerce, banking, e-books, passenger transport. Micro-enterprises under 10 employees and 2 million euros of turnover sit outside the services perimeter. A funded SaaS company does not.

Penalties run from 5,000 to 40,000 euros per violation, and reach 5 percent of annual turnover for repeated failures or for refusing to cooperate with AgID, which adopted its final accessibility guidelines in March 2026. Those numbers are bigger than the cost of doing the work correctly the first time, which is the whole argument.

Make it an acceptance criterion. "WCAG 2.2 AA on the flows in this statement of work, verified per release" is a sentence that changes what gets built, and it costs nothing to add. We covered the craft side in accessibility-first design after the EU Accessibility Act. The commercial side is shorter: an agency that quotes accessibility as a separate line item at the end of the project has already decided to skip it.

Step 5: read the price as a structure, not as a rate

Italian hourly rates for software work get published by consumer marketplaces rather than by industry surveys, so treat them as a sanity check and nothing more. ProntoPro's 2026 price index puts junior work around 45 euros an hour and senior specialists at 90 to 120. Two agencies quoting the same rate can still be four months apart on delivery, which is why the rate decides very little.

Structure decides. Four questions do most of the filtering:

Who owns the code, and from when? IP should transfer on payment, milestone by milestone. Transfer at final delivery gives the agency a hostage for the length of the project.
What happens after launch? A named support window with response times, or an honest "nothing, you take it from here". Both are workable. Silence is not.
What is fixed and what is time and materials? Fixed price for a scope nobody has explored yet is a padded number. Time and materials with no cap is an open tab.
What does leaving cost? Ask for the exit clause before you ask for the discount. Repositories, environments, DNS, third-party accounts, and the person who can hand them over.

SOW vs MSA covers how to split those terms across documents, and eight clauses worth checking covers the ones that quietly cost you later.

How to tell whether the answers were good

Run three candidates through the five steps in the same week, with the same brief, and score them on the answer rather than on the deck.

Check	Strong answer	Weak answer
Production proof	Two live URLs, named authors, one incident story	Case studies with no links and no dates
NIS2 supply chain	Notification terms, audit right, exit plan	"We are ISO certified"
AI Act exposure	Knows Article 50 still applies from 2 August 2026	"It all got postponed to 2027"
Accessibility	WCAG 2.2 AA as an acceptance criterion	A separate quote at the end of the project
Price structure	IP on payment, named support window, exit clause	A single day rate and a total

Common failures, and how to fix them

The quote is one number

A single figure with no breakdown means the agency has not estimated anything, or does not want you comparing lines with a competitor. Ask for the same scope split into three: build, integrations, and post-launch. If the split takes more than two days to produce, they are estimating for the first time while you wait.

You have no repository access during the project

This is the most expensive default in the Italian market and the easiest to fix. Ask for read access on day one and commit history from the start. Not to review pull requests, but so that a dispute in month four is about scope rather than about whether the work exists.

Discovery is priced like a project

Discovery is worth paying for when it produces artefacts you keep: a scope, a data model, a risk list, an estimate. It is not worth paying for when it produces a slide deck and a proposal. We put real numbers on that in discovery phase cost in 2026.

The team on the call is not the team on the project

Ask for names, and put them in the statement of work with a substitution clause: replacements at equal or higher seniority, with notice. Agencies that intend to honour it agree in one email. The ones that do not will explain why naming people is impossible.

None of this needs a procurement department. Three candidates, one brief, five questions each, two weeks. The agencies that answer precisely will keep answering precisely once the contract is signed, and the ones that answer with adjectives were always going to send you a deck instead of a product.

Sources

Photo by Onnos A. ↗ on Unsplash ↗

Frequently asked questions

Does the agency have to be based in Italy?+

No, but the location changes what you have to check. An agency inside the EU keeps personal data transfers simple under the GDPR and can be named as a relevant ICT supplier on the ACN portal without extra paperwork. An agency outside the EU needs transfer safeguards and a clear answer on where your database and backups physically sit. An Italian agency also gives you one practical advantage that has nothing to do with law: the same working hours and the same public holidays, which is worth more than it sounds during an incident.

How long should the selection take?+

Two to four weeks for three candidates is enough for a first SaaS build. One week to send the same brief and collect answers, one week for a technical call each, and a few days to compare structures rather than totals. Longer than six weeks and the process starts costing more than the difference between the candidates. Shorter than two weeks and you are picking on the deck, because nobody has had time to answer the NIS2 and AI Act questions properly.

What if the agency writes our code with AI?+

Most competent Italian studios now do, and the output is not the issue. Three things are. Ask whether your code or data goes into a model provider under a zero-retention agreement, because a free consumer plan and an enterprise contract are not the same exposure. Ask who reviews generated code before it merges, by name. And ask for the AI disclosure required by law 132/2025 to appear in the contract rather than in a blog post. An agency that gets defensive on these three questions is telling you it has not thought about them.

Is fixed price safer than time and materials for a first build?+

Fixed price is safer for the invoice and riskier for the product. It only works when the scope is genuinely known, which for a first SaaS build it rarely is, so the agency prices the uncertainty into the number and then defends the scope line by line when reality moves. The shape that survives contact: a paid discovery with defined deliverables, a fixed price on the part the discovery made concrete, and time and materials with a monthly cap on the rest. That way you cap the downside without paying a risk premium on the whole project.

Related services

Start a project.

We write about what we build. Tell us what you want to build.

Talk to the studio Read more articles