The European Union has not finalized or adopted an EU-wide cybersecurity certification scheme for cloud providers under the NIS2 Directive as of October 19, 2026. The candidate European Cybersecurity Certification Scheme for Cloud Services remains under development by ENISA, with work paused over sovereignty requirements at the highest assurance level.
NIS2 Requirements for Cloud Providers
Cloud providers that meet the thresholds of at least 50 employees or more than 10 million euros in turnover or balance sheet total fall under NIS2 as important entities. They must implement risk-management measures listed in Article 21 and report significant incidents within defined time frames. A Commission Implementing Regulation adopted in 2024 specifies thresholds such as complete unavailability exceeding 30 minutes or limited availability affecting more than 5 percent or 1 million EU users.
Article 24 of NIS2 permits Member States or future Commission acts to require certified products, services or processes, yet no mandatory cloud-specific European scheme exists. Providers therefore rely on existing standards including ISO 27001, ISO 27017, ISO 27018 and SOC 2 reports to demonstrate compliance during audits.
Germany’s updated C5:2026 criteria apply to audits starting June 2027, while France continues to promote its SecNumCloud label. These national schemes supply concrete evidence that regulators accept when assessing NIS2 obligations.
Background and Next Steps for EUCS
The first adopted European certification scheme, EUCC, covers ICT products based on Common Criteria and has applied since February 27, 2025. It does not extend to cloud services. A January 2026 proposal to revise the Cybersecurity Act seeks to shorten scheme development to roughly 12 months and broaden scope to cover entity cyber posture.
Related proposals under the Cloud and AI Development Act address sovereignty concerns separately. ENISA is expected to resume work on the EUCS candidate scheme once the revised Cybersecurity Act enters into force. The Commission would then need to adopt an implementing regulation before any scheme could become available for voluntary or mandatory use.
Until that point, cloud providers serving EU customers should maintain current certification portfolios and monitor national guidance. Companies can map existing controls to NIS2 Article 21 requirements and prepare incident-reporting procedures that align with the 2024 technical definitions.
Practical Implications for Providers and Customers
Enterprise customers increasingly request evidence of NIS2 readiness in procurement processes. Providers that already hold recognized national or international certifications can reference those documents rather than waiting for a new EU scheme. Internal teams should track the progress of the Cybersecurity Act revision and any future Commission impact assessments on mandatory certification.
Managed security service providers and 5G operators remain additional priorities in the Union Rolling Work Programme, indicating further schemes may follow the cloud track. Organizations planning multi-year compliance roadmaps should allocate resources for both existing standards and potential future European certification requirements.
Frequently asked questions
Does NIS2 require cloud providers to hold a specific EU certification?
No mandatory EU-wide cloud certification scheme exists yet. Providers can use national schemes and international standards such as ISO 27001 to demonstrate compliance with Article 21 risk-management measures.
When might the EUCS scheme become available?
Work on the candidate scheme is paused pending revision of the Cybersecurity Act. Once the revised act is adopted, ENISA could finalize a scheme within approximately 12 months, followed by a Commission implementing regulation.
What incident thresholds apply to cloud providers under NIS2?
Significant incidents include complete unavailability longer than 30 minutes, limited availability exceeding one hour that affects more than 5 percent or 1 million EU users, and any malicious data compromise.
Which national schemes are currently accepted for NIS2 evidence?
Germany’s C5:2026 criteria apply to audits from June 2027, and France’s SecNumCloud label remains in use. Both serve as accepted evidence alongside ISO and SOC 2 reports.
By YasTech Editorial
Comments 2