# Do EU rules apply to .SU domains? NIS2, the DSA and sanctions Canonical URL: https://xuid.ru/blog/su-domains-eu-rules/ Language: en Published: 2026-11-14. Category: Privacy. No EU company runs .SU, but NIS2 and the DSA are written to reach non-EU providers. See what EU rules can and can't touch when you register .SU. No EU registry, registrar or technical operator is involved in a .SU domain. Two EU laws, NIS2 and the Digital Services Act, are nevertheless written to reach domain providers outside the EU when they offer services to people inside it. In practice we have found no EU action against the .SU registry. EU sanctions so far have targeted hosting companies and media outlets rather than Russian domain registries. ## NIS2: registration data duties for domain providers The [NIS2 Directive (EU) 2022/2555](https://eur-lex.europa.eu/eli/dir/2022/2555/oj) covers TLD registries and domain registration services regardless of their size. - **Article 28** requires them to collect accurate and complete registration data, verify it, and answer lawful access requests within 72 hours. - **Article 26(3)** says a registry or registrar established outside the EU, but offering services in the EU, must designate a representative in a member state. Without one, any member state may take legal action against it. Whether a provider "offers services in the EU" depends on targeting. NIS2's recitals say that a website merely being accessible is not enough. Indicators include EU languages, EU currencies or references to customers in the EU. For .SU, the registry is RIPN in Moscow ([IANA record](https://www.iana.org/domains/root/db/su.html)), operating under Russian [Decree No. 1119](http://publication.pravo.gov.ru/document/0001202609010015). Its registration-data rules are Russian. Since 5 October 2026, for example, .SU WHOIS shows a link to the registrar's contact form [instead of the holder's email and phone](https://ripn.su/news/izmeneniya-v-whois-domena-su/). We have found no EU enforcement under NIS2 against a Russian registry. ## The Digital Services Act: registries as intermediaries The [Digital Services Act (EU) 2022/2065](https://eur-lex.europa.eu/eli/reg/2022/2065/oj) treats TLD registries and registrars as intermediary services in its recitals. The DSA gives them a liability exemption as "mere conduit" services, along with some obligations. - **Article 2(1)** applies the DSA to services offered to people in the EU, irrespective of where the provider is established. - **Article 13** requires a provider without an EU establishment to appoint a legal representative there. These rules apply to the providers, not directly to you as a domain holder. In principle, national authorities can address Article 9 orders against illegal content to any intermediary offering services in the EU. We have found none issued against the .SU registry or its registrars, and none of them has an EU establishment against which one could be enforced. ## Sanctions: aimed at hosts and outlets EU sanctions on Russia have reached internet services in two main ways. [Council Regulation (EU) 833/2014](https://eur-lex.europa.eu/eli/reg/2014/833/oj) bans the broadcasting of listed Russian media outlets, including through internet service providers. The EU's hybrid-threats regime has also listed infrastructure companies. In May 2025, [Council Decision (CFSP) 2025/966](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=OJ:L_202500966) listed Stark Industries Solutions, a web hosting company. We have found no EU measure against the .SU or .RU registries. ## What EU rules can still reach in your setup The EU's reach depends on where your other providers operate: - EU-based hosting, CDN and DNS providers must follow EU law, including the DSA and any sanctions. - EU internet service providers apply EU blocking measures to their own users, whatever domain a site uses. - EU payment providers and email services follow EU rules for their customers. Your audience matters too. A .SU domain does not change the law that applies to activity aimed at people in a particular country. ## Why the domain layer still matters With .SU there is no EU-established registry or registrar for an EU authority to order to lock or transfer the name. At xUID a trustee supplies the registration identity, so your own details are not on the registration. Combined with Russian court-based dispute rules and no UDRP, .SU sits outside the usual EU registrar-level processes. The Russian rules do apply. They include annual ESIA identification of the registrant of record and suspension on Russian state requests. Read [Is .SU a lawless offshore haven?](https://xuid.ru/blog/is-su-lawless-offshore-haven/) before treating the extension as a way around every rule. ## Register .SU through xUID Base .SU registration with a shared trustee costs $75/year. Private Identity provides a dedicated trustee for a total of $825/year. Full Bulletproof, with abuse-complaint handling within the service agreement, totals $8,075/year. Renewals use the same fees. For the US side, see [Can US authorities seize a .SU domain?](https://xuid.ru/blog/su-domains-us-jurisdiction/), or start with [why choose .SU](https://xuid.ru/blog/why-su-anonymous-domain/). When you're ready, [search .SU names](https://xuid.ru/domains/su/).