For storage, NIS2 (national transposition due 17 October 2024, with enforcement and national implementation ramping through 2025–2026) and DORA (in force since January 2025) demand five concrete things: state-of-the-art encryption with a written cryptographic policy, crypto-agility and post-quantum readiness, EU-resident keys you control, a register of your ICT providers, and documented exit procedures. The EU Data Act makes that exit a legal right. Everything below is how you actually prove it.
I run a storage company. So I read these directives the way an auditor reads your runbook: not for the prose, for the gaps. NIS2 and DORA are written in the house style of Brussels — "appropriate and proportionate technical and organisational measures," "state of the art," "risk-based." The vagueness is on purpose. It lets the text survive a decade of technology change. It is also exactly where procurement gets lost, because nobody can hand a salesperson a phrase that vague and expect a straight answer back. So here is the translation: the two regimes turned into the things your storage layer has to do, plus a checklist you can take into a vendor call.
Who this actually applies to
NIS2 cast a much wider net than its predecessor. Medium or large entity in energy, transport, banking, health, digital infrastructure, public administration, food, manufacturing, waste, or managed IT services? You are almost certainly in scope — labelled "essential" or "important." The pressure is not a future date; it is now. The directive's national-transposition deadline was 17 October 2024, and several member states missed it — but do not read that lag as breathing room. Transposition into national law, supervisory regimes, and Commission infringement steps have been ramping through 2025 and 2026, and the directive's security and incident-reporting duties land regardless of whether your government got its paperwork in on time. Management bodies can be held personally liable for the security measures. Read that last clause twice. The board signs off. The board is on the hook.
DORA is narrower and bites harder. It binds financial entities — banks, insurers, investment firms, crypto-asset providers — and, crucially, their ICT third-party providers. In force since January 2025. If you store regulated financial data, your cloud provider is not a vendor you bought; it is a supervised dependency that may itself fall under direct EU oversight as a "critical ICT third party." DORA does not really care about your firewall. It cares whether you survive your provider falling over.
One assumption sits under both regimes, and it is worth saying out loud: your storage is now part of your regulated perimeter, not a utility humming away behind it.
What "state-of-the-art encryption" means in 2026
NIS2 names cryptography and encryption outright in its baseline measures. The detail lives in EU Implementing Regulation 2024/2690, published November 2024, which lays out the technical measures for the digital-infrastructure sector. It does not stop at "use encryption." It wants a cryptographic policy — a written, maintained position on which algorithms you use, where, and why — plus cryptographic agility, the ability to swap an algorithm out fast when it breaks or gets deprecated. And it names post-quantum readiness as a planning horizon.
Point that at storage and three questions drop out.
One: is the data encrypted in a way that is genuinely state-of-the-art, or is it "encryption at rest" — disks the provider holds the keys to? At-rest encryption protects you against a thief walking out with a drive and roughly nothing else. The serious posture is client-side encryption, where the provider stores ciphertext it cannot read. Beebeeb does AES-256-GCM client-side, with the master key derived from your passphrase via Argon2id at login and never sent to the server. That is the architecture spelled out on our security page, not a marketing line.
Two: can your provider actually change the algorithm? Crypto-agility is an engineering property, not a press release. If the crypto is buried in a closed binary you can never open, "agile" is a word you are taking on faith. Open-source clients let you read the primitive and see how a migration would actually run.
Three, post-quantum. Nobody has to have shipped PQC for storage today — that is not the ask. What 2024/2690 wants is a plan and an architecture that can absorb the change when it comes. A monolith with one hard-coded cipher is precisely the thing the regulation is steering you off.
EU-resident keys, and why "EU region" is the wrong test
DORA and NIS2 both push toward control over your own cryptographic material — BYOK, EU-resident keys, keys held under EU jurisdiction. Here is the trap, and it catches a lot of buyers. A US hyperscaler will gladly sell you an "EU region" plus a key-management service hosted in Frankfurt. The data sits in Germany. The keys sit in Germany. And none of it is out of reach, because jurisdiction follows the company, not the datacenter.
The US CLOUD Act (2018) compels a US company to hand over data it controls, stored anywhere, on a valid US demand — even where that collides with foreign law. Nothing in 2026 repeals it. AWS did stand up its European Sovereign Cloud in Brandenburg at the end of 2025, with a new German parent company and EU-resident-only operations, and that is a genuine step, not a nothing. But the wider category is now openly contested. When the European Commission blessed S3NS — a JV built on Google technology — as "sovereign," CISPE's secretary general Francisco Mingorance called it "an own goal that institutionalises sovereignty washing." That row ran through The Register and the wider trade press across spring 2026. And in June 2025, Microsoft's France legal chief sat before the French Senate and could not guarantee that EU data would never be handed to US authorities.
So the right test for key residency is not "where is the KMS." It is: who can be compelled to surrender or use these keys? If a US-incorporated entity is anywhere in that answer, your EU region is a postcode, not a shield. The most honest version of BYOK is keys the provider structurally cannot use because it never holds them at all — zero-knowledge. Beebeeb is operated by Initlabs B.V., a Dutch company (KvK 95157565), with data in Falkenstein, Germany, and no US parent anywhere in the chain. We hold ciphertext we cannot read. We did not bolt that on for compliance. It is the design.
Want the long version of the legal mechanics? Our comparison against Proton Drive and our iCloud breakdown both walk through where jurisdiction actually bites.
DORA's part: a register and a way out
DORA's most operational demand for storage is the register of information — a maintained inventory of every ICT third-party arrangement supporting a critical or important function. Not a spreadsheet you scramble to rebuild the night before an audit. A living register: who the provider is, what function it supports, what data, where, under what contract, and what happens the day they go dark.
Bolted to that is the exit procedure. DORA wants documented, tested plans for leaving a provider without snapping a critical function — data portability and a transition window included. This is where the directive stops being abstract and starts being uncomfortable. Can you get all your data out, in a usable format, on your timeline, without a ransom note dressed up as an egress invoice?
For most clouds the honest answer used to be "sort of, eventually, expensively." The EU Data Act changed that. Fully applicable since 12 September 2025, it hands you a mandatory cloud-switching right, a two-month maximum termination period, and portability obligations. Egress and switching fees are banned outright from 12 January 2027. NIS2 and DORA ask you to keep an exit plan on file; the Data Act turns the exit into a legal entitlement and strips out the financial lock-in that used to make those plans pure theatre.
Storage that helps you comply here is storage you can leave cleanly. A real export. A CLI. A standard mount. Beebeeb gives you the bb command-line tool (push/pull/sync) and a WebDAV mount, so "get my data out, scriptably" is a one-liner rather than a support ticket. Mobile and desktop apps and one-click cloud import are coming soon; the web app and the CLI are live today. I am not going to pretend otherwise.
The 2026 checklist
Take this into the vendor call. Every item maps to a NIS2, DORA, or Data Act obligation.
- Cryptographic policy on paper. Does the provider publish which algorithms it uses, and where? (NIS2 / 2024/2690)
- Client-side, not just at-rest. Is the data encrypted so the provider stores ciphertext it cannot read? And which fields are not encrypted — filenames, email, billing? (NIS2 state-of-the-art)
- Crypto-agility you can verify. Can the algorithm be replaced fast, and can you inspect how? Open source beats a sealed binary here, every time. (2024/2690)
- Post-quantum plan. Not shipped — planned, with an architecture that can absorb new primitives. (2024/2690)
- Key jurisdiction. Who can be compelled to use or surrender the keys? If any answer touches a US entity, the EU region is a postcode. (CLOUD Act reality)
- Register-ready facts. Can the provider hand you everything DORA's register needs: legal entity, location, sub-processors, data categories? (DORA)
- Tested exit plus free egress. Documented exit procedure, full export in a usable format, no switching fees, two-month termination. (DORA + EU Data Act)
- Audit honesty. Has it been independently audited — and does it say so accurately? An "audited" claim with no published report is a red flag, not a green one.
On that last point, the discipline has to cut both ways or it is worthless. Beebeeb's independent security audit is planned, not yet done — and we will not type the word "audited" until the report exists and is published. Credit where it is due: Proton Drive is open-source, audited, with a zero-knowledge free tier; Tresorit is genuinely zero-knowledge, with EU regions and a documented compliance stack. Both are good products. If a certificate on file is a hard procurement gate for you today, our Tresorit comparison says so plainly rather than spinning it. Our edges are elsewhere: jurisdiction, openness, the CLI/WebDAV exit path, and scale — up to 99 TB self-serve, custom quote beyond.
The real enemy in 2026 is not the other privacy companies. It is sovereignty washing — the category lie the EU itself is now fighting. Read honestly, NIS2 and DORA are the tools to call that bluff. Use them.