In brief: two years after its transposition deadline, NIS2 is finally being enforced, and recent events have shifted the sovereignty question from who can read your data to who can switch your services off. The content delivery layer is one of the most concentrated and least examined of those dependencies, and a second delivery path you control is the cheapest insurance against it.
NIS2 is the EU's baseline cybersecurity directive. It requires organisations to manage supply-chain risk, report significant incidents within 24 hours, and hold management accountable. Transposition was due by 17 October 2024; two years on, the law is only now biting. 24 of 27 member states have Aa national law in force, with France, Ireland, and Spain still legislating.
Two years is a long time in geopolitics. Across most of Europe, organisations have moved past asking “are we in scope?” The more immediate question is: who, outside our control, could read our data or switch our services off?
That is a NIS2 question. Article 21 requires business continuity, disaster recovery, and security across the supply chain, and Article 22 adds EU assessments of non-technical risks such as foreign-government influence. Most debate has focused on one such exposure: the US CLOUD Act, which lets American authorities compel US companies to hand over data wherever it sits.
A second risk: not who can read your data, but whether a provider can be ordered to stop serving you. On 9 October, Washington extended sanctions to the International Criminal Court, barring US companies and banks from dealing with it.
That risk applies wherever your data is stored, EU data centers included. The question becomes one of sovereignty and preparedness, not just data locality: who controls the services you depend on, and what you do if they stop.
Three days earlier, the Dutch tax office abandoned its Microsoft 365 cloud rollout after an advisory council warned of lock-in to one supplier with no exit. But it is not leaving Microsoft. As State Secretary Eerenberg put it, it will still be Microsoft, just on-premises, on servers the agency controls. Owning the hardware, he argued, means you can “literally, physically” stop others reaching the data, though he did concede the legal reality may be different. That raises harder questions. Could a sanctions order still reach software running in a Dutch data center? And how much is physical control worth if the vendor remains subject to US law?
Last week also saw seven Nordic public broadcasters sign the Reykjavik Agreement, pledging mutual support to stay online and on air in a crisis. In the Nordic total-defense model, keeping the public informed is part of national security. A news outage during a cyberattack is a resilience failure, and broadcast uptime increasingly depends on delivery infrastructure the broadcaster doesn't control.
Europe's sovereignty debate has centered on hyperscalers like AWS, Azure, and Google Cloud, on Microsoft 365 and Google Workspace, and on where email and files are hosted. Far fewer programs examine the content delivery network (CDN), the layer in front of your websites, APIs, and video streams. If it stops serving you, you are offline, even if every server behind it is healthy and your data never leaves Europe. It is also concentrated. W3Techs puts Cloudflare at 25% of all websites.
NIS2 lists CDNs as Annex I digital infrastructure, so large CDN providers are regulated in their own right, a measure of how critical lawmakers judge them. For every organisation in scope, the CDN is also a supplier under Article 21. Its failure is your continuity problem: regulators can ask how you would stay online without it, and management is responsible for the reply.
Nobody buys insurance expecting a fire. They buy it because it can't be bought once the house is burning. For content delivery, an insurance policy means a second path you control: sized for critical services, kept warm behind DNS or traffic-steering failover, and tested like a backup.
Varnish CDN can be used as that path. It runs alongside your existing CDN, as a managed service on European infrastructure. Because it caches, it can keep serving content even while the systems behind it recover. The same setup covers sanctions, outages, and attacks, and shows regulators your exit plan works.
Three questions are a good place to start:
Which outside providers sit between your systems and the people who rely on them, and which jurisdiction does each answer to?
If one stopped serving you tomorrow, how long would recovery take: hours, days, or weeks?
Where you don't like the answer, what is the smallest step that gives you a way back?
NIS2 already expects boards to think this way, and the proposed Cloud and AI Development Act would build sovereignty assurance levels into public-sector cloud procurement.
Preparedness is cheap when nothing is wrong, and almost impossible to buy once something is.