EU market entry · GDPR · NIS2 · DORA · AI Act
EU compliance for non-EU vendors
European customers increasingly pass their own regulatory obligations down to their suppliers. If you sell software or services to EU companies from the US or elsewhere, I help you work out which rules actually reach you, what your customers will ask for, and how to answer without building a compliance department.
Who it is for
- Software vendors and service providers based outside the EU, often in the US, selling or planning to sell to European companies
- Vendors that already have a SOC 2 report and are now asked for ISO 27001, a GDPR data processing agreement or NIS2 and DORA clauses
- Suppliers to European banks, insurers or investment firms, which are bound by DORA
Typical situation
A European prospect sends a security questionnaire, a data processing agreement and contract clauses referring to NIS2, DORA or the AI Act. The deal stalls while legal, security and engineering try to work out what applies.
Most of these obligations fall on your customer, not directly on you. But your customer has to show that its suppliers meet them, so they end up in your contract, your questionnaires and your audits.
What I do
A short, fixed-fee engagement that turns a pile of EU requirements into a clear position and a plan.
Exposure mapping
Which EU rules apply to you directly (GDPR as a processor or controller, the AI Act as a provider of AI systems) and which reach you through your customers (NIS2 supply-chain security, DORA requirements on ICT third-party providers).
Gaps against what customers ask for
Your current security programme (SOC 2, policies, hosting, subprocessors, incident handling) compared with what European customers typically require, including ISO 27001 equivalence and data transfers.
Plan and positioning
Prioritised actions, reusable answers for EU questionnaires and contract clauses, and a short statement of your EU compliance position for your sales team.
Working with your counsel
Where a question is legal (data transfers, EU representative, contract wording), I frame it and work with your lawyer; I do not give legal advice.
Deliverables
- A map of the EU rules that apply to you, directly or through your customers
- A gap review against typical European customer requirements
- A prioritised action plan, including whether and when to pursue ISO 27001
- Reusable answers for EU security questionnaires and contract clauses
- A one-page EU compliance statement for your sales team
- A read-out session with management
Format and duration
- Format
- Fixed-fee engagement, fully remote, in English
- Indicative duration
- About 3 weeks
- Fees
- Fixed fee, quoted on requestEstimate the budget for this service
Frequently asked questions
Does NIS2 apply to a company based outside the EU?
Sometimes directly: certain digital service providers operating in the EU must designate a representative there. More often it reaches you indirectly: your EU customers must manage supply-chain risk and pass their requirements down to you. The mapping step establishes which case you are in.
Is SOC 2 enough for European customers?
It often helps, but many European buyers ask for ISO 27001 specifically, and SOC 2 covers neither GDPR nor EU sector rules. The two overlap heavily, so moving from SOC 2 to ISO 27001 usually takes a few months rather than a fresh start.
Do you replace our lawyer?
No. I cover security and compliance programmes; legal interpretation, data transfer mechanisms and contract drafting stay with your counsel. I make sure the two fit together.
First call
In 30 minutes we can go through the European deals you are working on, what customers are asking for, and whether this engagement is the right first step.