Analysis
The state of public compliance evidence in 2026: what 3,000 vendors actually publish
CertReports Research · 18 Sep 2026 · 12 min read
Regulations
What each regulation asks of your vendors
The third-party provisions of 9 regulations and standards, each with its citation and the vendor evidence that may support it, checked against the CertReports index. Reviewed 21 Sep 2026.
- EU regulation · European Union and EEAGDPRRegulation (EU) 2016/679Controllers and processors established in the EU, and those outside it that offer goods or services to, or monitor the behaviour of, people in the EU (Article 3).5 vendor requirements mapped to evidence
- UK law · United KingdomUK GDPRUK GDPR, with the Data Protection Act 2018Controllers and processors established in the UK, and those outside it that offer goods or services to, or monitor, people in the UK (Article 3).4 vendor requirements mapped to evidence
- EU regulation · European UnionDORARegulation (EU) 2022/2554Financial entities listed in Article 2(1), including credit, payment and e-money institutions, investment firms, crypto-asset service providers and insurers; ICT providers are reached through their contracts, and critical ones are overseen directly (Article 31).6 vendor requirements mapped to evidence
- EU directive · European Union, through national lawNIS2Directive (EU) 2022/2555Medium-sized and large entities in the sectors of Annexes I and II (Article 2(1)), plus some entities regardless of size, such as DNS service providers and trust service providers (Article 2(2)).3 vendor requirements mapped to evidence
- US regulation · United StatesHIPAA45 CFR Parts 160 and 164Covered entities (health plans, health care clearinghouses and health care providers that transmit health information electronically) and their business associates (45 CFR 160.103).3 vendor requirements mapped to evidence
- Industry standard · Worldwide, by card brand rulesPCI DSSPCI DSS v4.0.1, Requirement 12.8Merchants and service providers that store, process or transmit cardholder data, or can affect its security, under card brand and acquirer rules.2 vendor requirements mapped to evidence
- EU regulation · European UnionEU AI ActRegulation (EU) 2024/1689Providers placing AI systems or general-purpose AI models on the EU market, deployers of AI systems located in the EU, and providers and deployers elsewhere whose output is used in the EU (Article 2(1)).3 vendor requirements mapped to evidence
- International standard · InternationalISO 27001 Annex AISO/IEC 27001:2022, Annex A controls 5.19 to 5.23Organisations certified to, or aligning with, ISO/IEC 27001:2022; the Annex A controls apply where the statement of applicability includes them.4 vendor requirements mapped to evidence
- Industry standard · United States, used worldwideSOC 2 CC9.2AICPA Trust Services Criteria (2017, revised points of focus 2022), CC9.2Service organisations whose SOC 2 examination includes the common criteria, which every SOC 2 report does.2 vendor requirements mapped to evidence
What vendors publish
Across 6,433 indexed vendors, the evidence these requirements ask for most.
- SOC 2 or ISO 27001
- 758
- Published subprocessor list
- 436
- Data processing agreement
- 191
- Penetration test report
- 441
vendors, at least
vendors
vendors list one
vendors list one
Questions buyers ask
Which regulations require vendor due diligence?
GDPR and UK GDPR (Article 28 for processors), DORA (Articles 28 and 30 for ICT third-party providers), NIS2 (Article 21(2)(d) supply chain security), HIPAA (business associate agreements under 45 CFR 164.308(b) and 164.314), PCI DSS (Requirement 12.8) and, for AI, the EU AI Act (Articles 25, 26 and 53). ISO/IEC 27001 and SOC 2 carry the same expectation as controls 5.19 to 5.23 and CC9.2.
Does a SOC 2 report make a vendor compliant with GDPR or DORA?
No. A SOC 2 report or ISO 27001 certificate is evidence that may support a requirement such as GDPR Article 28(1) or DORA Article 28(5). Each regulation also asks for things a security report does not cover, such as a data processing agreement, subprocessor control, data locations and incident assistance.
How does CertReports decide whether evidence was found?
Each requirement lists the kinds of evidence that usually support it. CertReports looks for them in registry rows, trust-centre documents and statements, legal documents and subprocessor lists, each with a date and a source. A requirement shows evidence found, available on request, partial, expired or no public evidence.
Is this legal advice?
No. It maps obligations to evidence so a review starts from what is public. Scope, sufficiency and contract terms are for your counsel or auditor.
Running a vendor review
All articlesThis maps third-party obligations to the vendor evidence that may support them. It is not legal advice and never a statement that a vendor or its customers comply; confirm scope and sufficiency with your counsel or auditor. “No public evidence” means nothing public was found at the last check. Citations link to the official text.