DORA and NIS2 shape cloud outsourcing from two sides: DORA, Regulation (EU) 2022/2554, requires financial entities to record every arrangement with an ICT third-party service provider, sign contracts with prescribed content and prepare their exit, while NIS2, Directive (EU) 2022/2555, puts risk management and reporting duties on essential and important entities and counts cloud computing service providers themselves among them. Neither text changes a list price. The cost comes from what they ask for: a register someone maintains, contracts with extra clauses, exit plans that get tested, and resilience that holds capacity in a second region or with a second provider. Whether and how far either applies to a company is for its legal adviser and supervisor to judge.
How it works
DORA
DORA has applied directly in every Member State since 17 January 2025. Article 2 lists twenty types of financial entity, from banks to insurers, and names ICT third-party service providers as a further category. Article 3 defines ICT services broadly as digital and data services provided through ICT systems on an ongoing basis, excluding only traditional analogue telephony. Four duties in Chapter V touch the cloud bill:
- Register of information. Article 28(3) requires a register of all contractual arrangements for ICT services, separating those that support critical or important functions, and at least a yearly report to the authority on new arrangements. The templates in Implementing Regulation (EU) 2024/2956 map the supply chain: the direct provider has rank 1, every subcontractor a higher rank.
- Contract content. Article 30 sets minimum terms, among them where data is processed, access to data and its return on insolvency or termination, and the provider's duty to assist with an ICT incident at no additional cost or at a cost fixed in advance. For critical or important functions it adds precise service levels, unrestricted access, inspection and audit rights, and a transition period for exit.
- Exit strategies. For critical or important functions, Article 28(8) requires documented exit plans, sufficiently tested and periodically reviewed, with transition plans to another provider or in-house.
- Concentration risk. Before contracting for critical or important functions, Article 29 asks whether the provider is hard to substitute and whether arrangements concentrate on it, weighing the benefits and costs of alternatives.
The three European Supervisory Authorities (ESAs) designate critical ICT third-party providers under Article 31. Their first list, of 18 November 2025, names 19 companies, among them Amazon Web Services EMEA SARL, Google Cloud EMEA Limited and Microsoft Ireland Operations Limited. Designation puts the provider under direct oversight.
NIS2
NIS2 works through national law: Member States had to transpose it by 17 October 2024 and apply it from 18 October 2024. Annex I lists cloud computing service providers in the digital infrastructure sector. Listed types are covered from medium size upwards, some regardless of size; Annex I entities above the medium-sized thresholds are essential entities, the rest important entities. A cloud provider falls under the Member State of its main establishment in the Union (Article 26).
Article 21 requires, among other measures, business continuity with backup management and disaster recovery, and supply chain security covering the entity's own service providers. Article 23 sets deadlines for significant incidents: an early warning within 24 hours, a notification within 72 hours and a final report within one month after that. Implementing Regulation (EU) 2024/2690 specifies the requirements for cloud providers; an incident counts as significant there, among other cases, when a service is completely unavailable for more than 30 minutes. For financial entities, DORA displaces the NIS2 duties where it is at least equivalent (Article 4).
Germany transposed NIS2 by an act promulgated in the Federal Law Gazette on 5 December 2025, whose core is a new BSI Act with risk management measures (section 30), reporting (section 32), registration (section 33) and duties of management (section 38). On the day read, EUR-Lex lists two Commission proposals to amend NIS2, neither adopted.
What the providers publish
| AWS | Microsoft | Google Cloud | |
|---|---|---|---|
| On the ESA list | Amazon Web Services EMEA SARL | Microsoft Ireland Operations Limited | Google Cloud EMEA Limited (per Google with subsidiaries in France, Italy and Poland) |
| DORA contract terms | DORA Financial Services Addendum, on request | existing contract terms incl. Financial Services Amendment; DORA mapping on request | updated Article 30 terms, on request; Article 30 mapping |
| Help with the register | not named on the DORA page | not named on the DORA page | a register of information guide |
| Further material | DORA user guide; Level 1 workbook and Level 2 guide in AWS Artifact | Compliance Program for Microsoft Cloud, a premium support service | ICT risk management guide |
| NIS2 | guide NIS 2 Considerations for AWS Customers | NIS2 and DORA as standards in Defender for Cloud | security commitments in the Cloud Data Processing Addendum |
What it means for your cost
The cost sits in work, contracts and capacity held in reserve, and each part maps to a duty:
| Duty | Basis | Where cost arises | Where it shows in cost data |
|---|---|---|---|
| Maintain the register | DORA Art. 28(3) | recording every arrangement including subcontractors | no line of its own |
| Incident assistance | DORA Art. 30(2) | support contract or agreed price | support plan |
| Test the exit | DORA Art. 28(8) | parallel running, data export, migration work | data transfer, duplicate resources |
| Concentration and continuity | DORA Art. 29, NIS2 Art. 21 | second region or provider, backups | backup, replication, inter-region transfer |
| Audit and reporting | DORA Art. 30(3), NIS2 Art. 23 | audit rights, logging, on-call readiness | logging and monitoring services |
Support billing is covered in support plans and how they are billed; whether a given plan meets Article 30 is a contract question. What a provider may still charge for a switch is in the Data Act and switching charges, the cost of copies and recovery regions in backup, snapshots and disaster recovery.
The register and the cost data share a source: the invoices. Every account, marketplace seller, SaaS subscription and model API that bills rests on a contract, so the billing data checks the register for completeness, and the register links each cost line to an arrangement. How exit and concentration enter decisions is in cost in architecture and procurement reviews, contracts in cloud procurement: routes, contracts and renewals.
Where it goes wrong
- The provider's compliance page read as one's own. Designation and a DORA addendum move no obligation; the financial entity remains responsible (Article 28(1)), as Microsoft and Google also state.
- An exit plan without a cost. The plan names a target provider but no parallel running, data transfer or migration work, and the first test finds the gap in the budget.
- A register that stops at the cloud platform. SaaS tools, monitoring, model APIs and marketplace purchases often come from separate providers under separate contracts.
- The supply chain is missing. The templates ask for subcontractors with their rank, and the sub-processor list AWS's Data Processing Addendum points to changes over time.
- Terms never requested. AWS and Google issue their DORA terms on request, through the AWS account manager or the Google Cloud representative.
- NIS2 assumed to sit with the provider. That a cloud provider is covered by NIS2 says nothing about whether the customer is an essential or important entity; that follows from national law.
Whether a company falls under DORA or NIS2, whether an arrangement supports critical or important functions and which clauses suffice are for legal counsel and the supervisor to decide.
Sources
Read on 2026-10-16. EUR-Lex Regulation (EU) 2022/2554 (DORA), Implementing Regulation (EU) 2024/2956 on the register of information, Directive (EU) 2022/2555 (NIS2) and Implementing Regulation (EU) 2024/2690; ESMA ESAs designate critical ICT third-party providers and list of designated providers; German Federal Law Gazette BGBl. 2025 I No. 301 and BSI Act; AWS DORA, NIS 2 and AWS's responsibility and Data Processing Addendum; Microsoft What is DORA? and regulatory compliance in Defender for Cloud; Google Cloud EU DORA and EU NIS2.