Guidelines on outsourcing to cloud service providers

Start application: 01/07/2021

End application: 17/01/2025 (see here)

EIOPA identified the need to develop these specific guidance on outsourcing to cloud service providers in the context of the analysis performed to answer the European Commission FinTech Action plan (COM(2018) 109 final) and following discussions and exchanges with stakeholders.

Cloud services are a combination of a business and delivery models that enable on-demand access to a shared pool of resources such as applications, servers, storage and network security. The services are, typically, delivered in the form of Software as a Service (“SaaS”), Platform as a Service (“PaaS”) and Infrastructure as a Service (“IaaS”).

The aim of these Guidelines is to:
(a) provide clarification and transparency to market participants avoiding potential regulatory arbitrages;
(b) foster supervisory convergence regarding the expectations and processes applicable in relation to cloud outsourcing.

This final report sets out the final text of the EIOPA Guidelines on outsourcing to cloud service providers, including the feedback statement to the public consultation, the final impact assessment and the resolution of non-confidential comments provided by the stakeholders during the Consultation on the proposal for Guidelines on outsourcing to cloud service providers.