The programmes a European data centre answers to
Laws, standards, certification schemes, assurance reports, ratings and voluntary commitments, each with what it asks for in our own words, the editions in force, and the places where it applies and under which conditions.
- 44programmesin 6 kinds
- 220requirementsin our own words
- 40editions and amendmentswith their dates
- 1,350rules by place30 places, checked 19 Oct 2026
The catalogue says what applies under stated conditions. It never says that a site is certified or compliant, and it reproduces no clause text from a standards body: the scheme owner's own page is linked instead.
Laws
Statutes and regulations that bind a data centre or its operator. 16 programmes.
- Delegated Regulation (EU) 2024/1364: data centre reporting scheme and rating scheme Sets what a data centre operator reports to the European database each year (identification items and performance indicators on energy, water, heat reuse, renewable share) and the measurement methods; a second delegated act on the rating scheme is adopted but not yet published. 10 requirements, a duty in 27 of 30 places
- DORA Regulation (EU) 2022/2554: digital operational resilience for financial entities Obliges banks, insurers, investment firms and other financial entities to manage ICT risk, report incidents, test resilience and control ICT suppliers by contract; data centre operators meet DORA mainly as contracted suppliers, and only a designated critical provider is overseen directly. 5 requirements, a duty in 29 of 30 places
- EU Energy Efficiency Directive (EU) 2023/1791: data centre provisions Requires data centres of at least 500 kW installed IT power to report and publish energy and sustainability data every year by 15 May, sets waste-heat rules for large sites, and (Art. 10 requirements, a duty in 27 of 30 places
- EU Framework Directive 89/391/EEC on health and safety at work The EU baseline that every employer must assess workplace risks, take preventive measures, inform and train workers and consult them; national laws on electrical work, work at height and similar hazards build on it. 3 requirements, a duty in 27 of 30 places
- EU Work Equipment Directive 2009/104/EC (including work at height) Minimum EU rules for the use of work equipment, including inspection and rules for temporary work at height such as ladders and scaffolds. 2 requirements, a duty in 27 of 30 places
- F-gas Regulation (EU) 2024/573: fluorinated greenhouse gases in cooling and fire equipment Requires operators of cooling, air-conditioning, heat pump, fire protection and switchgear equipment above set gas charges to check for leaks, fit leak detection above higher charges, keep records per machine and use certified technicians. 5 requirements, a duty in 27 of 30 places
- France: Code de l'énergie L236-1 and decree 2025-1382 (data centres) French transposition of Energy Efficiency Directive Article 12 and 26: yearly declaration by 15 May, plus a cost-benefit analysis duty where waste heat is not recovered. 7 requirements, a duty in 1 of 30 places
- France: electrical authorisation (habilitation électrique), NF C 18-510 and Code du travail R4544 French rule that only workers formally authorised by their employer may work on or near electrical installations; the employer issues a personal authorisation after training and medical fitness, in line with the NF C 18-510 method. 4 requirements, a duty in 1 of 30 places
- Germany: DGUV Vorschrift 3, electrical installations and equipment (accident prevention rule) German accident prevention rule: the employer must have electrical installations built, changed and kept in order only by a qualified electrician, and have them tested before first use and at set intervals, with results documented. 4 requirements, a duty in 1 of 30 places
- Germany: Energieeffizienzgesetz (EnEfG), data centre provisions German national law with PUE limits that tighten from 2027 and 2030, a heat-reuse share for new sites, 100 percent renewable electricity from 2027, an energy or environmental management system with certification for larger sites, a yearly public report by 31 March, and customer energy statements. 14 requirements, a duty in 1 of 30 places
- Ireland: Safety, Health and Welfare at Work (General Application) Regulations 2007, Part 3 electricity Irish general application rules including a Part on electricity: suitable equipment and installations and precautions for work on electrical equipment. 2 requirements, a duty in 1 of 30 places
- Italy: work on electrical installations, D.Lgs. 81/2008 art. 82-83 and CEI 11-27 Italian law bans live working except under conditions, and ties permitted work to technical standards (CEI 11-27 is the one for electrical work) and to employer-recognised competence; medium and high voltage live work needs authorised firms. 3 requirements, a duty in 1 of 30 places
- Netherlands: Besluit activiteiten leefomgeving art. 5.16a-5.16c (data centre reporting) Dutch rules that make operators of data centres with at least 500 kW installed IT power collect and publish energy-efficiency data every year by 15 May. 5 requirements, a duty in 1 of 30 places
- NIS2 Directive (EU) 2022/2555: cybersecurity for data centre service providers Lists data centre service providers among the digital infrastructure entities that must manage cybersecurity risk, report significant incidents quickly, and answer to management-level accountability; each Member State sets the exact law, authority and fines. 14 requirements, a duty in 17 of 30 places
- Spain: Real Decreto 614/2001, protection of workers from electrical risk Spanish minimum rules for electrical risk at work: employer risk assessment, safe installations, working dead as the default, authorised workers, training. 3 requirements, a duty in 1 of 30 places
- UK: Electricity at Work Regulations 1989 Great Britain's general duty to keep electrical systems safe, maintain them, work dead unless live working is justified, and use competent people. 3 requirements, a duty in 1 of 30 places
Standards
Published standards that laws, customers or schemes cite. 2 programmes.
- EN 50600 data centre facilities and infrastructures series A multi-part European series on how to plan, build and operate data centre buildings, power, cooling, cabling and security, plus the key performance indicator methods (such as PUE, renewable share, energy reuse, water use) that EU and German law now cite. 6 requirements, voluntary, assessed in 30 places
- PCI DSS (payment card data security standard) Security requirements for any environment that stores, processes or transmits payment card data; colocation and hosting providers are in scope for physical security and as service providers when they manage in-scope systems. 6 requirements, a duty in 30 of 30 places
Certification schemes
Schemes where an independent body issues a certificate or an award. 15 programmes.
- ACN qualification of cloud infrastructures and services (Italy) Italy's qualification scheme that decides which cloud infrastructures and services public administrations may use, with a published catalogue. 2 requirements, a duty in 1 of 30 places
- ANSI/TIA-942 data centre infrastructure standard and certification A US-origin but globally used standard for data centre telecom, power, mechanical, architectural, fire and security design, with a TIA-run certification scheme at four rating levels. 5 requirements, voluntary, assessed in 30 places
- Cyber Essentials certification (UK, NCSC) UK government-backed scheme built on five technical controls (firewalls, secure configuration, security update management, user access control, malware protection) for the IT infrastructure of an organisation; asked for in UK public and private supplier tenders. 0 requirements, places not yet assessed
- Esquema Nacional de Seguridad (ENS), Spain Spain's national security framework for public bodies and their private suppliers, with a conformity process (adaptation, implementation, audit, certification) and a public register of certified entities. 2 requirements, a duty in 1 of 30 places
- HDS (hébergeur de données de santé) certification French certification for anyone hosting personal health data for care providers or patients, including infrastructure and operation of health information systems; data centre operators serving French health clients need it or a customer that holds it. 4 requirements, a duty in 1 of 30 places
- ISO 14001 environmental management system certification An audited environmental management system: environmental aspects, legal obligations, objectives, operational control and review; used by data centre operators to manage energy, refrigerants, water, waste and noise. 5 requirements, voluntary, assessed in 30 places
- ISO 22301 business continuity management system certification An audited management system for continuity: impact analysis, recovery strategies, plans and exercises so critical services keep running or return within set times. 5 requirements, voluntary, assessed in 30 places
- ISO 27001 certification on the basis of IT-Grundschutz (BSI, Germany) The German national route to an ISO 27001 certificate that also proves the BSI baseline protection catalogue is met; common for German public sector and critical infrastructure suppliers. 3 requirements, voluntary, assessed in 30 places
- ISO 45001 occupational health and safety management system certification An audited health and safety management system: hazard identification, worker participation, operational controls, incident investigation and improvement; relevant to electrical, height, fuel and battery risks on data centre sites. 6 requirements, voluntary, assessed in 30 places
- ISO 50001 energy management system certification An audited energy management system: energy review, baseline, performance indicators, targets, operational control, measurement, internal audit and management review; the standard route to meet EU and German energy-management duties for large energy users and data centres. 16 requirements, a duty in 27 of 30 places
- ISO 9001 quality management system certification An audited quality management system: documented processes, customer requirements, internal audit, management review and continual improvement; in a data centre it underpins consistent operations, maintenance and customer service. 5 requirements, voluntary, assessed in 30 places
- ISO/IEC 27001 information security management system certification An audited management system for information security covering risk assessment, a chosen set of security controls (including physical and environmental protection of data centres), monitoring and improvement. 8 requirements, voluntary, assessed in 30 places
- Uptime Institute Tier Certification of Constructed Facility After construction, Uptime checks the built facility against the design and runs live demonstrations of the systems under real conditions to confirm it can meet its Tier objective. 4 requirements, voluntary, assessed in 30 places
- Uptime Institute Tier Certification of Design Documents Uptime reviews the design drawings and specifications of a planned data centre against its Tier Standard for topology (mechanical, electrical, structural and site) and awards a design-stage rating. 5 requirements, voluntary, assessed in 30 places
- Uptime Institute Tier Certification of Operational Sustainability (TCOS) Assesses how a Tier-certified site is actually run (policies, procedures, behaviours and risks of operations) on a points basis, graded Bronze, Silver or Gold; sites without a Tier certification can use the separate Management and Operations Stamp of Approval. 5 requirements, voluntary, assessed in 30 places
Assurance reports
Independent auditor's reports on controls over a period or at a date. 5 programmes.
- BSI C5 (Cloud Computing Compliance Criteria Catalogue) German minimum security criteria for cloud services, examined by an auditor under ISAE 3000 and reported to customers; relevant to data centre operators that sell cloud or managed services to German public bodies and health care. 5 requirements, a duty in 1 of 30 places
- ISAE 3402 assurance report on controls at a service organisation The international standard for an independent accountant's report on a service provider's controls relevant to customers' financial reporting; the equivalent of SOC 1 outside the US. 4 requirements, voluntary, assessed in 30 places
- SOC 1 report (controls relevant to user entities' financial reporting) A CPA's report on a service provider's controls that matter to its customers' financial statements; relevant for data centre operators whose uptime or physical security feeds a customer's financial reporting. 5 requirements, voluntary, assessed in 30 places
- SOC 2 report (security, availability, processing integrity, confidentiality, privacy) A CPA's report on how a provider's system meets chosen trust services categories (security plus any of availability, processing integrity, confidentiality, privacy); the most requested assurance report in cloud and colocation RFPs. 8 requirements, voluntary, assessed in 30 places
- SOC 3 report (general-use trust services report) A short, publishable version of a SOC 2 examination: same categories, much less detail, so a provider can show it on a website. 2 requirements, voluntary, assessed in 30 places
Rating schemes
Building and sustainability ratings that score a facility. 2 programmes.
- BREEAM sustainability assessment and certification A third-party assessed rating of a building's sustainability across design, construction and use; UK and European planning and lending often ask for it on data centre projects. 2 requirements, voluntary, assessed in 30 places
- LEED green building rating system A points-based rating of building sustainability (energy, water, materials, site, indoor environment) with prerequisites; data centres are rated through the design-and-construction and operations-and-maintenance systems. 3 requirements, voluntary, assessed in 30 places
Voluntary commitments
Industry and Commission schemes an operator joins by choice. 4 programmes.
- Baseline Informatiebeveiliging Overheid (BIO2), Netherlands The Netherlands' baseline of minimum information security requirements for government bodies and, through procurement conditions, their suppliers; version 1.3 of the measures is available. 2 requirements, a duty in 1 of 30 places
- Climate Neutral Data Centre Pact A self-regulatory pledge by European operators and trade associations to reach climate-neutral data centres by 2030; from 2025 members use mandatory EU reporting rather than separate self-audits. 2 requirements, voluntary, assessed in 30 places
- CSA STAR (Security, Trust, Assurance and Risk) registry A public registry where cloud providers publish a self-assessment against the Cloud Controls Matrix (Level 1) or a third-party audit result (Level 2). 3 requirements, voluntary, assessed in 30 places
- EU Code of Conduct for Energy Efficiency in Data Centres A voluntary programme where operators commit to apply a catalogue of efficiency best practices for cooling, power distribution, IT and monitoring; an Assessment Framework gives auditors the tools to check whether practices are applied, and annual awards recognise large energy savings. 3 requirements, voluntary, assessed in 30 places
How the catalogue is kept
- Official bodies
- Every rule links to the law, regulator or statistics office it rests on. A scheme owner is named as the owner of its scheme, never as a source.
- Our own words
- Requirements are written by us from the sources, with the evidence an auditor would expect. The scheme owner's page is the place to read the clause.
- Dated
- Each row was re-read at its source on the date shown on its page. Editions name the one they replace.
- Conditions
- Where a rule depends on size, customer sector or equipment, the condition is stated next to the place, with the authority that enforces it.