EU rules that shape your cloud and AI platform

Plain-language guides to NIS2, DORA, the EU AI Act, the GDPR, and keeping data in the EU. Each one shows in minutes whether the rule applies.

I'm starting to see the same five EU rules in the questionnaires, contracts, and board questions my clients get: NIS2, DORA, the AI Act, the GDPR, and its demand that data stay where a company said it would. Each guide below is short on purpose. It explains what the rule is and gives a checklist for whether it touches a company. Then it shows what the rule asks of a cloud or AI platform in engineering terms.

I'm an engineer, not a lawyer, so the guides stay on the side I can answer. That means what to build, in what order, and how to prove it. When a guide describes your situation, I highly recommend a thirty-minute call to hold your actual platform up against it. Which of the five rules keeps coming up in your deals?

This is an engineer's reading of the rules. I wrote it to help teams decide whether the rules touch their platform. It isn't legal advice. I recommend checking the current text with your own counsel before planning around a date or a threshold.

Book a call See services

NIS2

What the NIS2 directive asks of a startup's cloud platform, how to tell whether a company is in scope or a supplier to one that is, and what to fix first.

NIS2 is the EU's cybersecurity directive for the sectors that keep a country running: energy, transport, banking, health, water, digital infrastructure, cloud and managed services, and more. Each member state turned it into national law, with a deadline of 17 October 2024, and several were late. The law puts the duty on the company's management, with fines that scale with turnover. It asks for a short list of security measures that belong in any startup's platform anyway, plus incident reporting on a clock.

Read the guide

DORA

What the Digital Operational Resilience Act asks of a fintech's cloud platform, and what its contract rules mean for suppliers to banks and insurers.

DORA is an EU regulation, so it applies directly in every member state without a national version. It has applied since 17 January 2025 to financial entities: banks, payment and e-money institutions, investment firms, crypto-asset service providers, insurers, pension funds, and more. It's about the technology under the finance. That covers how a company manages ICT risk, classifies and reports incidents, tests its resilience, and controls the third parties it depends on.

Read the guide

EU AI Act

How the EU AI Act sorts AI systems into risk tiers, which tier your product is likely in, when the rules apply, and what they mean for the way a team builds.

The AI Act is an EU regulation that applies directly in every member state. It sorts AI systems by risk. The Act bans a few uses outright and lists a defined set as high-risk, with real obligations. Some systems only owe transparency, and the rest owe nothing beyond general law. A separate chapter covers general-purpose models, and it binds the model makers rather than the teams who build on them.

Read the guide

GDPR

What the GDPR asks of a startup's cloud platform in engineering terms: controller or processor, the records to keep, and the controls that prove it.

The General Data Protection Regulation has applied directly in every member state since 25 May 2018. It covers any organisation established in the EU that handles personal data. It also covers any organisation outside the EU that offers goods or services to people in the EU or watches their behaviour. Personal data means anything that relates to an identifiable person: an email address, an IP address, a user ID in a log line. For a startup, that's nearly every table in the database.

Read the guide

EU data residency on AWS, Azure, and Google Cloud

How to keep customer data in EU regions on AWS, Azure, and Google Cloud, what still leaves, and the controls that prove it to a customer or auditor.

"Our data stays in the EU" is a promise I see a lot of EU startups make. On AWS, Azure, and Google Cloud it's mostly achievable and mostly a matter of configuration. The default isn't there, though, and a few services reach outside any region a team picks. Residency, meaning where the bytes sit, differs from sovereignty, meaning who a court can compel to hand them over. It's worth asking customers which one they actually want.

Read the guide

Let's talk.

A 30-minute call, no pitch. We look at your current setup, your stage, and the thing that's bothering you about it. I give a straight opinion on what to change, what to leave alone, and whether the problem is the one it looks like. What's the one thing in your stack you'd fix tomorrow?

Book a call See pricing

Prefer email or phone? hello@netninjas.eu or +31 6 45984313