Hosting’s Next Six Months Are Already Scheduled: Five Dates to Prepare For

Most of what will move hosting P&Ls between now and January is not a surprise waiting to happen: the deadlines, effective dates and sale windows are published, dated and attached to countdowns. That makes the remainder of 2026 unusual in an industry that mostly reacts, because every one of the dates below can still be prepared for rather than absorbed. Here are the five that matter most, the smaller calendar around them, and what a prepared operator does before each one.

Hosting’s deadlines from August 2026 onward. Details and what to do before each date: below. Sources: European Commission, Verisign, IONOS, WebPros pricing.

September 11: Vendor Silence Gets a Deadline and a Fine

The Cyber Resilience Act’s reporting obligations activate on September 11. From that day, manufacturers of products with digital elements sold in the EU, control panels, backup agents and server software included, wherever the vendor is based, must send an early warning to ENISA and the national CSIRT within 24 hours of learning that one of their vulnerabilities is being actively exploited, with a fuller notification at 72 hours. Failing the reporting duties carries fines of up to 15 million euros or 2.5 percent of global turnover. The European Commission published practical guidance for manufacturers on July 27, a signal that it expects the date to be taken literally. For hosting providers the effect is second-hand but real: vendor security posture stops being a trust exercise and becomes an auditable data stream. Before the date: inventory the EU-marketed software in the stack, identify which vendors carry CRA duties, and ask for vulnerability-notification clauses in renewals while the obligation is new enough to be negotiable.

September 30: The Sedo Window Closes, One Way or Another

IONOS has said it aims to close the sale of Sedo by the third quarter, and no buyer has been publicly confirmed with two months left. What is on the table is one of the domain aftermarket’s largest distribution networks: SedoMLS, with more than 650 registrar and sales partners, attached to a business whose revenue fell to 291.5 million euros in 2025 from 312.2 million. It is not the only domain asset in the shop window: Team Internet still plans to sell its domains division; the group’s gross revenue declined 40 percent to 481.9 million dollars in 2025 as Google shut down AdSense for Domains. Before the date: registrars and hosts integrated with SedoMLS should scenario-plan the transition under each plausible buyer, because a partner network of that size will change hands priced off a down year.

Autumn: The Licensing Season Opens Under a New Alignment

The industry’s licensing season has a rhythm: cPanel’s owner WebPros has raised prices for seven consecutive years, each round applying on January 1, with the cumulative increase since cPanel’s 2019 licensing overhaul running past 55 percent across most tiers. The 2026 round raised most tiers by between $2 and $7 and the retail per-account rate above 100 accounts from $0.44 to $0.49. One hosting company president told HostingAdvice that compared with 2019, prices have gone up “in most cases over 300%”. This autumn’s announcement, if the pattern holds, will be the first made while WebPros’ majority investor CVC Capital Partners has also agreed, in a transaction not yet closed, to take a majority stake in Namecheap at a 1.5 billion dollar valuation: one private-equity firm aligned with both the tooling under millions of hosted sites and one of the largest retail registrars. Every hosting provider’s licensing bill and panel-migration calculus reprices on the season’s answer. Before the date: a panel-diversification assessment stops being hygiene and becomes a negotiating position; the licensee with a demonstrated alternative is the only one who negotiates.

November 1: The Most Predictable Price Increase in the Industry

Verisign raises the .com wholesale price from $10.26 to $10.97 on November 1, a 7 percent increase and the first since September 2024. The .com zone crossed 160 million domains in February, so it is the smallest number on this list applied to the largest base, flowing through every registrar’s cost sheet and every customer’s renewal. Under its contract, Verisign may raise prices up to 7 percent in each of the last four years of its six-year contract period; taken every time, that puts .com at $13.42 by the end of the cycle. The company’s 2025 gross margin was 88 percent. Before the date:registrars should decide consciously whether to absorb, pass through with notice, or pass through with margin, and say so in their renewal communications. Customers can lock the old price by renewing before the date, and the registrars who point that out first get the goodwill.

January 12, 2027: The Day Egress Revenue Ends

The Data Act’s last step lands eleven days into the new year. Until then, providers of data-processing services may charge customers for switching only at cost. From January 12, 2027, switching charges, explicitly including data egress fees, drop to zero across the EU, for IaaS, PaaS and SaaS alike. It is a deleted revenue line and a dead lock-in mechanism at the same time, and it applies to hyperscalers and to every European host whose contracts quietly monetized leaving. It is also, for whoever moves first, the cheapest acquisition argument available: moving to us is now free by law. Before the date: audit every egress and exit-fee line in the price list, model the revenue gap, and build the migration-in offer that the rule turns into a channel.

The Smaller Dates Still Have Teeth

On August 18 the e-Evidence Regulation applies: judicial authorities in one member state can compel providers in another to produce data within 10 days, or 8 hours in emergencies, and the regime arrives with most of Europe behind schedule: the accompanying directive’s transposition deadline passed in February, and on March 27 the Commission sent letters of formal notice to 22 member states for failing to communicate full transposition, opening infringement proceedings months before the rules apply. On December 9 the Product Liability Directive’s transposition deadline passes, and products placed on the EU market from that date, explicitly including software and AI systems, fall under the new liability rules. And on the far edge, December 11, 2027, the CRA’s full obligations arrive, the moment the September reporting regime grows into a complete product-security rulebook.

The Half-Year That Rewards a Calendar

None of the dates above requires a prediction, and that is the point. Each has a published countdown, and each will divide operators into the same two groups: those who priced the change while it was a calendar entry, and those who will read about it as news. The list above is the cheapest strategic document in hosting. The expensive version is the same list, read in January, in the past tense.

About the Data

Dates and figures were verified in early August 2026 against European Commission policy pages (CRA, Data Act, PLD), Verisign’s announced pricing as reported by Domain Name Wire, cPanel’s 2026 price list as relayed by resellers and trade press, and IONOS and Team Internet statements as reported by trade press. The CVC investment in Namecheap had not closed at publication, and no Sedo buyer had been confirmed. Deadlines can move; the regulatory ones rarely do.