DORA
EURegulation (EU) 2022/2554
Financial firms must prove they can keep running when their technology fails - including when the failure is at a supplier like AWS.
The rules
The rules, in plain words.
Six regulations shape almost every architecture decision Northkeep makes.
Here is what each one actually says, why it changes a design, and where to
read the real thing.
How to use these
These are engineering explainers, not legal advice. They are written to give you the shape of a regulation in about two minutes - enough to follow a conversation, ask a better question, or decide whether it applies to you at all. How any of it applies to your organisation is a question for your counsel and your compliance function.
Every page links to the primary source. Where a date matters, it is stated; where one is uncertain or varies by country, that is said rather than guessed.
-
-
NIS2
EUDirective (EU) 2022/2555
Medium and large organisations across 18 sectors must manage cybersecurity risk properly, report significant incidents fast, and hold their management personally accountable for it.
-
US CLOUD Act
USUS federal law, enacted 2018
US authorities can compel a US-based provider to hand over data it controls, even when that data is stored on servers in Europe.
-
EU AI Act
EURegulation (EU) 2024/1689
AI systems are sorted by how much harm they could do, and the riskier ones carry real obligations - documentation, human oversight, logging and data governance.
-
EU Data Act
EURegulation (EU) 2023/2854
Cloud customers get a legal right to switch provider, and the fees that made switching painful are being removed entirely.
-
Regulation (EU) 2016/679
Personal data can only leave the EU under specific legal conditions - and whether your architecture actually meets them is an engineering question, not just a contractual one.
Start here
Which of these actually binds you?
That is the first question a readiness assessment answers - not all six at once, but the ones that genuinely apply to your estate, and what your architecture can currently evidence against them.