| GDPR · transfers to IndiaReg. (EU) 2016/679 · Chapter V · SCCs: Decision (EU) 2021/914 | In forceIndia is not on the Commission's adequacy list; 17 countries and bodies are, including the UK, Switzerland, Japan and Brazil32. | Transfers to India need an Art. 46 tool. In practice that means the Commission's standard contractual clauses; Clause 14 requires the parties to assess the destination's laws and practices, a transfer impact assessment (TIA)34. | Implication: any Mumbai access to EU personal data, including remote support, is a transfer.
Response: EU hosting by default, processor SCCs (module 2/3) with a documented TIA, encryption with EU-held keys via Cloud HSM, and privacy operations. |
| Digital Omnibus (data and GDPR)Commission proposal of 19 Nov 2025 | ProposedStill in Parliament committee in Aug 2026, with about 1,840 amendments; MEPs aim for a committee vote before Feb 202724. EDPB/EDPS joint opinion of 13 Feb 202623. | Proposals include a refined personal-data definition, a legitimate-interest route for AI with an unconditional right to object, breach notice only for high risk within 96 hours instead of 72, one incident-reporting entry point for NIS2, GDPR, DORA, eIDAS and CER, and cookie rules moved into the GDPR23. | Implication: nothing changes until adoption; current GDPR rules apply.
Response: design incident runbooks for 24 h (NIS2) and 72 h (GDPR) today, and track the single entry point. |
| EU–US Data Privacy FrameworkAdequacy decision of 2023 · Latombe case | Valid · under appealThe General Court upheld it on 3 Sep 2025; an appeal to the Court of Justice was filed on 31 Oct 202533. | Covers certified US commercial organisations only. It does not help transfers to India32. | Implication: buyers using US hyperscalers carry appeal risk; sovereignty questions stay live.
Response: offer EU-only data paths and partner sovereign options as the alternative. |
| GDPR Art. 27 representativeControllers or processors not established in the EU | In forceApplies wherever the GDPR reaches a non-EU business under Art. 3(2)31. | A non-EU controller or processor that offers goods or services to people in the EU, or monitors them, designates in writing a representative in a member state where those people are, unless an exemption applies31. | Implication: XcellHost India selling direct to EU customers needs a representative until an EU entity exists.
Response: appoint one in phase 1 (Ireland or the Netherlands, matching the entity plan). |
| EU Data ActRegulation (EU) 2023/2854 | In forceApplies from 12 Sep 2025. Switching and egress charges must go by 12 Jan 202740. | Data holders give users access to connected-product data. Cloud and edge providers remove switching barriers40. | Implication: incumbents lose lock-in; buyers re-tender.
Response: no exit fees, documented export formats and a migration offer timed to Jan 2027. |
| NIS2 DirectiveDirective (EU) 2022/2555 · national transposition | 24 of 27 transposedFour states lacked a law in May 202625; the Commission referred Ireland, Spain, France and the Netherlands to the CJEU on 8 Jul 202626. The Netherlands' law took effect on 15 Aug 2026; France, Spain and Ireland were still pending in Oct 202627. | Risk management, management accountability and incident reporting (24 h early warning, 72 h notification). Under Art. 26, cloud, data-centre, CDN and managed (security) service providers fall under the state of their main establishment; if not established in the EU they must designate a representative in a state where they offer services30. | Implication: XcellHost's cloud and MSSP services are in scope as a provider, and customers push NIS2 clauses down to us.
Response: NIS2 representative, then main establishment via the EU entity; managed SOC, GRC and supplier assurance. |
| Cyber Resilience Act (CRA)Regulation (EU) 2024/2847 | Reporting liveReporting duties apply from 11 Sep 2026. Most obligations apply from 11 Dec 202739. | Manufacturers of products with digital elements report actively exploited vulnerabilities and severe incidents: early warning in 24 h, notification in 72 h, through ENISA's Single Reporting Platform39. | Implication: machine, device and software makers need vulnerability handling now.
Response: code signing, security testing and a 24 h reporting runbook. |
| eIDAS 2.0 · EUDI WalletRegulation (EU) 2024/1183 | In forceIn force since 20 May 2024. Each member state offers a wallet by 24 Dec 202641. | From 24 Dec 2027, private relying parties that must use strong user authentication, such as banking, energy, transport, health and telecoms, and very large platforms must accept the wallet41. | Implication: regulated firms need wallet acceptance and stronger PKI. XcellHost is not a qualified trust service provider.
Response: managed PKI, CLM and PQC work; partner with a qualified provider for qualified signatures. |
| EUCS · revised Cybersecurity ActEU cloud certification scheme · CSA2 proposal | Not adoptedThe EUCS final draft was still pending in Feb 2026. The Commission proposed a revised Cybersecurity Act on 20 Jan 202642. | CSA2 proposes 12-month deadlines for developing certification schemes and a "cyber posture" scheme to help multi-country entities show NIS2 compliance42. Until then, national schemes rule: BSI C5 (DE), SecNumCloud (FR), ACN (IT), ENS (ES)51535554. | Implication: no single EU cloud label yet; XcellHost holds none of the national ones.
Response: deliver regulated workloads on certified partner infrastructure; map our ISO 27001/27017/27018 and SOC 2 controls to each scheme. |
| EU AI Act + Digital Omnibus on AIReg. (EU) 2024/1689 · amended by Reg. (EU) 2026/1744 | In force · phasedBans from 2 Feb 2025; GPAI duties from 2 Aug 202538. The Omnibus took effect on 27 Jul 202637. | Transparency duties apply from 2 Aug 2026, with watermarking for systems already on the market due by 2 Dec 2026. Annex III high-risk moves to 2 Dec 2027 and Annex I to 2 Aug 2028. The AI-literacy duty now requires providers and deployers to take measures to support it37. | Implication: customers need an AI inventory, risk classification and staff training.
Response: vCAIO advisory, ISO/IEC 42001, AI security assessments and AI literacy cohorts. |
| DORARegulation (EU) 2022/2554 · ESAs oversight | In forceApplies from 17 Jan 202544. The ESAs designated 19 critical ICT third-party providers on 18 Nov 20253536. | ICT risk management, incident reporting, resilience testing and ICT third-party risk for financial entities. Designated CTPPs (hyperscale cloud, DC, network and financial-technology providers) face direct ESA oversight3635. | Implication: banks and insurers audit every ICT provider, XcellHost included, and weigh concentration on CTPPs.
Response: a DORA contract annex, audit and exit rights, and the BFSI Cloud evidence pack. |
| European Health Data Space (EHDS)Regulation (EU) 2025/327 | In force · phasedIn force since 26 Mar 2025; general application 26 Mar 2027; first data exchanges from 26 Mar 2029, more from 26 Mar 203143. | Patient summaries and ePrescriptions first, then images, lab results and discharge reports; secure processing environments and data-access rules for secondary use43. | Implication: hospitals and health-tech vendors upgrade EHR hosting and interfaces.
Response: Healthcare Cloud in EU partner DCs*, DLP and secure processing environments. |
| Trade agreements · India corridorIndia–EU FTA · India–EFTA TEPA · India–UK CETA | EU: concluded, not signedConcluded 27 Jan 2026; the Commission proposed signature and conclusion to the Council on 11 Sep 202617; signing expected in Brussels in Dec 202618. TEPA in force1 Oct 202520. CETA in force15 Jul 202621. | TEPA: EFTA states aim to mobilise US$100B of investment in India over 15 years and one million direct jobs20. CETA covers 137 services sub-sectors for India21. EU FTA services terms are not in force until it is ratified. | Implication: the corridor is political momentum, not yet EU market access.
Response: target Indian firms in Europe and EFTA firms investing in India first. |
| VAT on cross-border servicesVAT Directive · OSS since 1 Jul 2021 | CurrentB2B services are taxed where the customer is established (Art. 44)47; the business customer generally accounts for VAT by reverse charge46. | For B2C services, a non-EU business can register once in any member state under the OSS non-Union scheme and charge each customer's local VAT45. | Implication: B2B invoices from India carry no EU VAT but must show reverse charge; B2C (training seats) needs OSS.
Response: OSS registration before any B2C training sales; adviser sign-off on each flow. |
| Permanent establishment & entityIreland · Netherlands · treaty-based PE | PlanIreland: 12.5% on trading income, 25% non-trading, 15% minimum for groups of €750M+ (PwC, 11 Aug 2026)48. Netherlands: 19% to €200,000, then 25.8% (PwC, 29 May 2026)49. | Local sales staff who habitually conclude contracts, or a fixed place of business, can create a taxable presence under the relevant India tax treaty. This is a general principle we did not re-verify per treaty. | Implication: partner-led and representative-only phases limit PE exposure; hiring changes that.
Response: open an Irish Ltd or Dutch BV before hiring sellers in Europe; take tax advice per country. |