The CRA's 24-hour reporting duty has applied since 11 September 2026. Check whether it reaches you
Start the system

For hosting, cloud and data centre providersall of the EU

Your customers' data runs on you. Show it is safe, and portable.

NIS2 names cloud and data centre providers in Annex I, and the Data Act has set how your customers switch away since 12 September 2025.

Start your compliance system Check if NIS2 applies to you
Example data

The rules that reach you

What reaches a hosting provider, and from when

One law names you, one sets how customers leave, one comes with their data, and one standard they ask for.

NIS2

Directive (EU) 2022/2555 · EU cybersecurity law

Medium-sized and up

Annex I point 8 lists cloud computing service providers, data centre service providers and DNS service providers.

DNS at any sizeCloud and data centre providers from medium-sized upArt 2(2)(a)
One stateThe authority where your main establishment in the Union isArt 26
RegistrationYour details go to your authority for ENISA's registryArt 27
Risk measuresSpelled out for cloud and data centre providersIR 2024/2690
Annex I, 8Applies since Register by Each member state applies NIS2 through its own law, and transposition varies. State by state

Data Act

Regulation (EU) 2023/2854

Applies

Chapter VI lets your customers switch provider or leave, on terms written into your contract, with switching charges ending.

Art 25Art 29Since No switching charges from

GDPR

Regulation (EU) 2016/679

Applies

As a processor of your clients' personal data, you work under an Article 28 contract with each of them.

Art 28Since

ISO 27001

ISO/IEC 27001:2022 · a standard

Not a law

Clients and tenders ask for the certificate, and its controls map onto the measures NIS2 Article 21 asks for.

Annex A, 93 controlsYour clients set the date

In numbers

A deadline, the regulators and the buyers

until switching charges must end for good.

Source: Regulation (EU) 2023/2854, Article 29(1)

24 of27

member states have communicated an act transposing NIS2 to the Commission.

Source: EUR-Lex, national transposition measures, read 23 October 2026

621

EU tender notices mentioned both ISO 27001 and cloud in the year to 10 October 2026.

Source: TED, the EU's tender journal, read 11 October 2026

What StandardOS does for a hosting provider

Your NIS2 file and exit terms, kept on one record

Every tile is a screen in the product today.

Your ISMS and NIS2 file

ISO 27001 and NIS2 on one record, with the policies drafted for you to approve.

Your switching terms, drafted

The Data Act switching pack drafts the Article 25 clauses, the Article 26 information and the Article 28 statement.

Questionnaires answered from your records

Paste a client's questions and each answer is drafted from your controls and evidence, with its source.

Trust center, then the audit

Show clients where you stand, and find an accredited auditor when you want the certificate.

One subscription

Every rule on this page, on one record.

ISO27001CRANIS2DORAISO42001AIACTISO9001MRGDPRDATAACTISO27701EAAISO14001PLDREDGPSRNIS2IRRoHSREACHWEEEPPWRWBBATPTDEUDREEDCER

The 4 on this page, and 23 more for the same price

€249/mo

Every framework included.

excl. VAT, per organization

  • Unlimited users, auditors included
  • 7 days free, no card, no sales call
Start your compliance system

Or one file, once: NIS2 Registration Pack, €199See the pack

Done for you: NIS2 registration, done in a week, €490See the offer

Questions

What hosting providers ask first

Short answers, each with the article it rests on.

Are we in NIS2 as a hosting company?

If you provide cloud computing or data centre services and are medium-sized or larger, yes, under Annex I point 8. A DNS service provider is in at any size.

Annex I, 8Art 2(2)(a)
Which state supervises us?

The state of your main establishment in the Union, wherever your customers are.

Art 26(1)(b)
When do switching charges have to end?

On 12 January 2027. Until then you may charge only reduced fees, no higher than your direct costs of the switch.

Data Act Art 29(1)Data Act Art 29(3)
Does the Data Act apply to services we build for one customer?

Partly. Article 31(1) lifts the switching charge rules and some contract duties for services mostly custom-built for one customer and not offered at broad commercial scale.

Data Act Art 31(1)
Do we sign a processor contract with every customer?

Yes, where you process personal data on its behalf. Article 28(3) lists what that contract must contain.

GDPR Art 28(3)

Start with your own file. Keep it current.

7 days free, no card and no sales call.

Start your compliance system Check if NIS2 applies to you

This page in:DeutschFrançaisNederlandsEspañolDansk