Do cybersecurity rules apply to a cloud provider?
Short answer
Yes for named providers under NIS2, and graded protection duties apply to networks operated in China.
Read against the registers 2026-08-26.
Who the role is
Whoever runs infrastructure, hosting or a platform for someone else's data and traffic.
What the topic covers
All three regimes ask for measures, an incident report and a named accountable person. They differ in who is covered and how fast the report has to leave the building.
Duties the EU acts name for this role
- NIS2 — Directive (EU) 2022/2555, Article 21: Keep risk management measures in place for the service, the supply chain included.
- NIS2 — Directive (EU) 2022/2555, Article 23: Report a significant incident to the national authority within the deadlines in the act.
The rows behind the answer
European Union
- NIS2 — Directive (EU) 2022/2555: Covers named essential and important entities, with management accountability and staged incident reporting.
United States
- NYDFS Cybersecurity Regulation: Applies to entities licensed in New York: written programme, CISO reporting and 72 hour notification.
- GLBA Safeguards Rule: Requires a written information security programme for financial institutions, with a qualified individual in charge.
China
- Cybersecurity Law of the People's Republic of China: Sets graded protection duties, network operator obligations and incident response requirements.
- Data Security Law of the People's Republic of China: Classifies data by importance and attaches handling and reporting duties to each class.
Where companies usually start
- Map which entities in the group are in scope in each jurisdiction.
- Write one incident procedure with the shortest applicable clock at the top.
- Keep the evidence of measures in a form an auditor can read without a walkthrough.
This page reads published registers and describes common practice. It is not legal advice and it is not a compliance verdict.
Other questions for cloud service provider
- Do ai governance rules apply to a cloud provider?
- Do personal data rules apply to a cloud provider?
- Do cross-border data rules apply to a cloud provider?
- Do health data rules apply to a cloud provider?
- Do online platforms rules apply to a cloud provider?
- Do consumer rights rules apply to a cloud provider?
- Do product safety rules apply to a cloud provider?
- Do climate disclosure rules apply to a cloud provider?
- Do export controls rules apply to a cloud provider?
ExploreWorldAI is operated by Valkiv Ventures AB (Reg. no. 556995-1311), Kungsgatan 8, 111 43 Stockholm, Sweden. EU-hosted, with data processing assessed against the GDPR. Contact: hello@exploreworldai.com.
Machine-readable summaries for AI agents: /llms.txt and /llms-full.txt.
