Sovereignty · Updated 10 November 2026 · 8 min read

NIS2 and DORA: what they mean for choosing a cloud or hosting provider in 2026

Who falls under NIS2 and DORA, what each law makes you ask of a hosting provider, and a contract checklist built from the legal texts.

View as Markdown

Neither law bans any provider or names an approved list. They put the duty on you, the regulated customer: NIS2 makes you manage the security of your direct suppliers, and DORA, for financial entities, spells out what must be written into the contract with every ICT provider. So the question to ask isn't "is this host NIS2 compliant?" but "can this host give me the contract terms, incident notice, audit evidence and exit route my obligations require?"

This guide summarises the legal texts. It isn't legal advice, and NIS2 reaches you through your country's national law, which can add detail.

NIS2 and DORA at a glance

Question	NIS2	DORA
Legal form	Directive (EU) 2022/2555, applied through national laws	Regulation (EU) 2022/2554, directly applicable
Applies since	National measures from 18 October 2024	17 January 2025
Who	Medium and large entities in 18 sectors, some regardless of size	Banks, payment and e-money institutions, investment firms, insurers and other financial entities
Supplier rule	Supply chain security, including relationships with direct suppliers	Detailed ICT third-party risk rules and mandatory contract clauses
Incident clock	Early warning within 24 hours, notification within 72 hours	Initial notification within 4 hours of classifying an incident as major and 24 hours of becoming aware

Who is in scope

NIS2 covers public or private entities of a type listed in its Annex I or II that are at least medium-sized and provide services in the EU. Under the Commission's SME definition, a medium-sized enterprise has fewer than 250 staff and up to €50 million turnover or €43 million balance sheet, so smaller firms are generally outside unless an exception applies. Annex I lists sectors of high criticality: energy, transport, banking, financial market infrastructures, health, drinking water, waste water, digital infrastructure, B2B ICT service management, public administration and space. Annex II adds postal services, waste management, chemicals, food, manufacturing, digital providers and research. Some entities are covered regardless of size, such as trust service providers, DNS service providers and TLD registries, and Member States can designate others.

Cloud computing, data centre and content delivery network providers are themselves in Annex I. That matters twice: your host may have its own NIS2 duties, and Commission Implementing Regulation (EU) 2024/2690 sets detailed security requirements for those providers.

DORA applies to financial entities listed in its Article 2, from credit institutions to crypto-asset service providers, crowdfunding platforms and insurance undertakings, with exclusions such as small insurance intermediaries. For these entities DORA replaces the NIS2 risk management and reporting rules, as NIS2 recital 28 explains. Microenterprises get lighter treatment in places, for example on audit rights.

What NIS2 asks of your providers

Article 21 requires appropriate and proportionate measures, including supply chain security covering your relationships with direct suppliers and service providers. You must take into account each supplier's specific vulnerabilities and the quality of its cybersecurity practices, including secure development. Your management body approves these measures and can be held liable under Article 20.

Implementing Regulation 2024/2690 binds only the digital providers it lists, but its supply chain section reads as a practical template for any buyer. It says contracts with suppliers should specify, where appropriate:

cybersecurity requirements for the supplier
a duty to notify you of incidents without undue delay
the right to audit or to receive audit reports
a duty to handle vulnerabilities that put your systems at risk
rules on subcontracting, with the same security requirements passed down
what happens at termination, such as retrieval and disposal of your information

It also lists the ability to diversify sources of supply and limit vendor lock-in as a selection criterion.

Your own reporting clock under Article 23 is tight: an early warning within 24 hours of becoming aware of a significant incident, a notification within 72 hours and a final report within one month. If your host is down, you need to hear about it fast enough to meet those deadlines.

What DORA asks of your providers

DORA keeps you fully responsible for compliance even when a provider runs the service. Before signing, Article 28 requires you to assess whether the service supports a critical or important function, run due diligence, weigh concentration risk and record every ICT contract in a register of information. You must be able to terminate for the reasons Article 28(7) lists.

Article 30(2) lists what every ICT contract must contain, including:

a full description of the services and whether subcontracting is allowed, and on what conditions
the regions or countries where services run and data is stored, with advance notice before they change
access, recovery and return of your data in an easily accessible format if the provider becomes insolvent, stops operating or the contract ends
service level descriptions
assistance during an ICT incident at no extra cost or at a cost fixed in advance
full cooperation with your supervisors
termination rights and minimum notice periods

For services supporting critical or important functions, Article 30(3) adds quantified service levels, tested business contingency plans, participation in threat-led penetration testing, unrestricted rights of access, inspection and audit for you and your supervisor, and an exit strategy with a mandatory transition period. Article 29 asks you to weigh long subcontracting chains and subcontractors in third countries.

Incident timing comes from Delegated Regulation (EU) 2025/301: an initial notification within 4 hours of classifying an incident as major and no later than 24 hours after becoming aware of it, an intermediate report within 72 hours, and a final report within a month.

Checklist for choosing a provider

Which legal entity signs the contract, where is it registered, and who owns it?
In which countries does the service run, and where are data, logs and backups stored? Will you be told in advance of a change?
Who are the subprocessors and subcontractors, which are outside the EU, and how are you notified of changes?
How fast, and through which channel, will the provider tell you about an incident that affects you?
Is there a written service level agreement with measurable targets?
Which certifications or audit reports can you see today, and which are only planned?
How do you get all your data back, in what format, and how long is the transition period after termination?
Will the provider cooperate with your supervisor, and accept audits or provide audit reports?

Where Eurobase stands

Eurobase is a business registered in Warsaw, Poland, on European infrastructure operated by Scaleway, a French provider. Here's what you can check against the list above.

Certifications: none held yet. Work toward ISO 27001 and SOC 2 is under way.
Service levels: the public terms give no SLA unless a signed agreement says so.
Subprocessors: a public list. GitHub and GitLab Inc. are US subprocessors, active only when you connect them. Material changes are announced in advance, and you can object within 30 days.
Incidents: the DPA commits to help with personal-data breach handling under GDPR Articles 33 and 34. It doesn't set a notice time for service incidents.
Audits: requests must be reasonable, scoped to your workload data and protective of other tenants.
Exit: at your choice, Eurobase deletes or returns customer personal data when the service ends.

That fits many NIS2 entities that apply supply chain diligence to a web host. For a DORA function you classify as critical or important, the public terms don't give the unrestricted audit rights or contractual transition period Article 30(3) requires, so you'd need a signed agreement or a different provider.

Frequently asked questions

Does NIS2 require my hosting provider to be based in the EU?

No. NIS2 doesn't set a location requirement for your suppliers. It requires you to assess their security and the risks they bring. A non-EU cloud provider serving the EU must designate a representative in the Union under Article 26. Location and ownership still matter for other reasons, covered in EU region vs EU company.

Is a cloud provider directly covered by NIS2?

Yes, if it qualifies. Cloud computing, data centre and CDN providers are listed in Annex I, and size thresholds apply. They fall under the Member State of their main establishment in the Union.

Does a small fintech have to apply DORA to its web host?

If you're a financial entity under Article 2, DORA applies to all your ICT contracts, but proportionality applies and microenterprises have some lighter rules. The strictest clauses apply only where the service supports a critical or important function.

What fines apply under NIS2?

Member States must set maximum fines of at least €10 million or 2% of worldwide turnover for essential entities, and €7 million or 1.4% for important entities, whichever is higher. National laws set the actual amounts.

Has NIS2 changed since 2024?

On 20 January 2026 the Commission proposed targeted amendments to NIS2. Check the Commission's NIS2 page for their status before relying on details.