IT services company compliance: GDPR, AI Act, NIS2 & DORA

Why the 'Digital Services Companies (DSC)' sector is concerned

The ESN is simultaneously exposed through its own activities and those of its clients. When it manages an information system or provides application maintenance (TMA), it accesses personal data on behalf of the client: it acts as a GDPR processor. When it develops an AI component delivered under its own brand, it becomes a provider within the meaning of the AI Act. When it operates managed services, it falls under 'ICT service management', explicitly covered by NIS2.

The role of service provider increases liability exposure: an IT services company is a prime entry point for supply chain attacks, which is precisely the risk NIS2 seeks to reduce. An incident affecting the IT services provider propagates mechanically to all of its clients.

Finally, as soon as an IT services company counts banks, insurers or other financial entities among its clients, DORA enters the picture through contractual obligations: these clients must frame their ICT providers with precise clauses, maintain an information register and, for the most critical ones, be subject to direct European supervision.

NIS2 — ICT service management on the front line

NIS2 explicitly targets managed service providers and ICT service management (B2B). Beyond the 'medium entity' threshold (≥ 50 employees or > €10M in turnover), an IT services company qualifies as an important entity, or even an essential entity depending on its role. It must implement the risk management measures under Article 21, report incidents, and involve its management.

The most sensitive issue for an IT services company is supply chain security, of which it is itself a critical link for its clients.

Key obligations

• Risk management measures (Art. 21): access control, encryption, MFA, continuity.
• Step-by-step notification of significant incidents.
• Supply chain security.
• Management involvement and accountability.

GDPR — the IT services company as data processor

In managed services, application maintenance, or hosting, the IT services company processes personal data on behalf of its clients: it acts as a data processor and must sign a DPA compliant with Article 28, secure processing activities, govern its sub-processors, and manage transfers outside the EU.

For its own processing activities (staff, recruitment, prospecting), it is the data controller.

Key obligations

• DPA article 28 with each client.
• Processing under documented instruction.
• Governance of sub-processors and transfers outside the EU.
• Client support for rights requests and breaches.

AI Act — provider or deployer depending on the deliverable

An IT services company that develops and delivers an AI solution under its own brand is a provider and bears heavy obligations (technical documentation, risk management, transparency, conformity assessment). If it merely uses third-party tools, it is a deployer, subject to lighter obligations.

The qualification is assessed deliverable by deliverable: the same IT services company can be a provider on one project and a deployer on another.

Key obligations

• Qualify the status (provider/deployer) per project.
• Technical documentation for delivered systems.
• Transparency and human oversight.
• Contractual AI liability traceability with the client.

DORA — ICT service provider for financial entities

When an IT services company serves financial entities, it becomes a third-party ICT provider within the meaning of DORA. Its clients must govern the relationship through precise contractual clauses (security, audit, reversibility, sub-contracting) and register it in their information register. An IT services company deemed critical may be placed under the direct supervision of European authorities.

Anticipating these requirements has become a commercial advantage: financial entities prioritise 'DORA-ready' service providers.

Key obligations

• DORA contractual clauses (audit, reversibility, security, subcontracting).
• Cooperation on the client information register.
• Notification and cooperation in the event of an ICT incident.
• Preparation for potential supervisory review (critical provider).

Data Act & CRA — depending on services and edition

If the IT services company provides data processing services (managed cloud), the Data Act requires it to facilitate provider switching and data portability. If it develops and places software components on the market, the CRA qualifies it as a manufacturer: security by design, vulnerability management, SBOM, and incident notification.

Key obligations

• Portability and switching for cloud services (Data Act).
• Security by design and vulnerability management for published components (CRA).

Comparative overview of regulations

How these regulations interact

For an IT services company (ESN), everything converges around security and supply chain control. NIS2 measures (Article 21), GDPR security requirements (Article 32), DORA clauses and, where applicable, CRA obligations share a common foundation: security policy, access management, logging, vulnerability management, and business continuity planning. Building this foundation once and then adapting it regulation by regulation avoids multiplying workstreams.

The specific challenge for IT services companies is contractual: each client imposes its own requirements (GDPR DPA, DORA clauses, NIS2 security annexes). Standardising a reusable 'compliance' contractual baseline is the primary efficiency gain.

Application timeline

• 1GDPR. In force since May 2018.
• 2DORA. Applicable since 17 January 2025 (impacts IT service providers via their financial clients).
• 3AI Act. Prohibitions since February 2025; high-risk from August 2026.
• 4NIS2. French transposition nearing completion; anticipate now.
• 5Data Act. Majority of obligations applicable from 12 September 2025.

Applicable penalties

Penalty caps vary: NIS2 up to €10M or 2% for essential entities (€7M or 1.4% for important entities), GDPR up to €20M or 4%, AI Act up to €35M or 7%. NIS2 introduces personal liability for senior management. Under DORA, the ESN is not directly sanctioned as a financial entity, but a critical provider placed under supervision is exposed to periodic penalty payments of up to 1% of its average daily worldwide turnover.

The most tangible risk remains commercial: a NIS2 or DORA compliance failure disqualifies the IT services company from tenders with its most regulated clients.

Compliance roadmap

• 1Map. Identify services (managed services, TMA, cloud, AI development), processed data, and regulated clients (finance).
• 2Build the security foundation. Formalise security policy, access and vulnerability management, logging, and continuity — serving NIS2, GDPR, and DORA.
• 3Standardise contracts. Create a 'compliance' contractual framework: standard DPA, DORA clauses, and reusable NIS2 security annexes.
• 4Qualify AI. Determine, on a per-project basis, the provider/deployer status and produce the required documentation.
• 5Steer. Involve senior management, appoint a DPO and CISO (internal or outsourced), and establish a periodic review.

How Data Comply One supports the sector

Data Comply One brings GDPR, AI Act, NIS2 and DORA together on a single platform, with outsourced DPO and CISO services — a coverage that precisely matches the regulatory profile of an IT services company. The goal: a shared compliance foundation and contractual deliverables that can be reused from one client to the next.

DCO also provides templates (DPA, DORA clauses, NIS2 measures, AI Act documentation) that accelerate responses to the requirements of regulated clients.

Frequently asked questions