Selling into Europe? Know what European buyers will ask for.
Your SOC 2 report opens doors in the US. In Europe, procurement teams often ask for ISO 27001, a GDPR data processing agreement and, in regulated sectors, evidence for DORA or NIS2. We help you plan the order, so expansion doesn’t stall in security review.
Based in Berlin, working with startups on both sides of the Atlantic. No advisory fee: we are paid by providers when customers engage them.
What changes when you sell into Europe
Not every requirement applies to every company. Which ones matter depends on your product, your data and who you sell to.
ISO 27001
Many European buyers recognize an ISO 27001 certificate more readily than a SOC 2 report. Much of your SOC 2 work can be reused.
Read the guide → Anyone processing EU personal dataGDPR
Expect a data processing agreement, a list of sub-processors and terms for transferring data outside the EU, such as Standard Contractual Clauses or the EU-US Data Privacy Framework.
Read the guide → If your product uses AIEU AI Act
Obligations depend on the risk category of your AI system. Transparency rules apply from August 2, 2026.
Read the guide → Selling to banks and insurersDORA
EU financial firms must manage ICT third-party risk, so expect contract clauses, audits and security requirements passed down to you.
Read the guide → Selling to critical sectorsNIS2
Customers in energy, transport, health and other critical sectors pass security requirements down their supply chain.
Read the guide → Selling in GermanyC5 and TISAX
German public sector and regulated cloud buyers often ask for C5. Automotive manufacturers expect TISAX from suppliers.
Read the guide →From SOC 2 to ISO 27001, without starting over
Both cover similar security controls: access management, change management, risk assessment, incident response, vendor management. What changes is the format. ISO 27001 needs a documented information security management system and an audit by an accredited certification body.
Planned well, most of your existing policies, controls and evidence carry over.
Read the ISO 27001 guide- BeforeGDPR basics and a DPAReady before the first European contract
- NextISO 27001When a European enterprise asks; reuses SOC 2 work
- If neededDORA, NIS2 or C5When you sell to banks, critical sectors or German public buyers
- If AIEU AI Act checkConfirm your risk category early
Not a client case. Get your own roadmap in 2 minutes →
How Holam works
Holam receives a referral fee from providers we introduce when you engage them. You pay the provider directly; we add nothing to their price and you remain free to choose another provider.
- 01
Understand your expansion
Which countries, which customers and which deals are on the table.
- 02
Map what applies
Which European requirements matter for you, and which can wait.
- 03
Introduce you
To compliance platforms and specialists that fit your stack, stage and budget.
- 04
Follow through
We stay involved until you can answer your European buyer with confidence.
Questions we hear from US teams
Straight answers. If yours isn’t here, ask us directly.
We have SOC 2. Do European buyers accept it?
Some do, especially international companies. Many European enterprises, however, ask for ISO 27001 certification. Because the controls overlap, adding ISO 27001 is usually much less work than starting from scratch.
Do we need GDPR compliance before our first European customer?
If you will process personal data of people in the EU, yes. In practice your first European customer will ask you to sign a data processing agreement, so it pays to have the basics ready.
How is ISO 27001 different from SOC 2?
SOC 2 is an attestation report issued by a CPA firm. ISO 27001 is a certification of your information security management system, issued by an accredited certification body on a three-year cycle with annual surveillance audits.
How does Holam get paid?
Holam receives a referral fee from providers we introduce when you engage them. There is no advisory fee to you, and providers set their own prices. We add nothing to them.
Find out what your first European customer will ask for.
Answer six questions and get a first roadmap, or talk it through with us in 20 minutes.