NIS2, DORA, and the Regulatory Case for Knowing Your Dependencies

Wed, 22 Apr 2026 00:00:00 +0000

Two pieces of EU legislation, NIS2 and DORA, are fundamentally changing how European organisations must think about their technology suppliers. Neither regulation bans US cloud providers. But both make it legally necessary to understand, document, and manage the risks that come with depending on them.

Most organisations are not ready. Here is what the regulations actually require, and what compliance looks like in practice.

NIS2: Supply Chain Risk Is Now Mandatory

The Network and Information Security Directive 2 (NIS2), which EU member states were required to transpose into national law by October 2024, significantly expands the scope of cybersecurity obligations across Europe.

DORA Concentration Risk: How to Build an Exit Strategy Your Regulator Will Accept

Wed, 25 Mar 2026 00:00:00 +0000

The Digital Operational Resilience Act (Regulation 2022/2554), which applies from 17 January 2025, introduces a concept that no previous EU regulation stated so explicitly: financial entities must identify, assess, and manage the risk of depending too heavily on a single ICT provider. And they must have documented exit plans for their critical providers.

This is not optional. DORA applies to credit institutions, investment firms, insurance undertakings, payment institutions, crypto-asset service providers, and virtually every other regulated financial entity in the EU. The European Supervisory Authorities (EBA, ESMA, EIOPA) are developing Regulatory Technical Standards (RTS) and Implementing Technical Standards (ITS) to specify the details.

DORA on Sovereign Shift

NIS2, DORA, and the Regulatory Case for Knowing Your Dependencies

NIS2: Supply Chain Risk Is Now Mandatory

DORA Concentration Risk: How to Build an Exit Strategy Your Regulator Will Accept