Loading story…
Amazon Web Services (AWS) has been officially designated as a critical third-party provider (CTPP) by the European Supervisory Authorities under the European Union’s Digital Operational Resilience Act (DORA). This designation means AWS will be subject to direct joint oversight by the European Banking Authority, the European Securities and Markets Authority, and the European Insurance and Occupational Pensions Authority, reflecting AWS’s significant role in supporting the operational resilience of the EU financial sector. Financial institutions using AWS must now consider this regulatory oversight as part of their compliance and risk management strategies, leveraging AWS’s security and resilience features while maintaining their own compliance responsibilities.
The broader regulatory landscape in 2025 is increasingly interconnected, with DORA, GDPR, and DMARC forming a complex web of compliance obligations for organizations operating in the EU. Businesses must address overlapping requirements for data protection, operational resilience, and email security, especially when using cloud services like AWS. The integration of these frameworks underscores the need for a unified approach to digital accountability, ensuring protection of data, infrastructure, and identity across all digital operations.
See the reporting duties and controls this puts on the clock.
2 events from the most recent confirmed update back to the earliest known activity.
A compliance-focused industry article discussed DORA alongside DMARC and GDPR, reflecting ongoing business attention to meeting DORA-related regulatory obligations in 2025. This is commentary on the regulatory landscape rather than a new enforcement action.
AWS was designated a critical third-party provider under the EU Digital Operational Resilience Act (DORA), bringing it under the regulation's oversight framework for financial-sector ICT providers.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Amazon Web Services (AWS) has announced the AWS European Sovereign Cloud, a new independent cloud infrastructure designed to address the unique sovereignty, security, and compliance requirements of European public sector organizations and highly regulated industries. The AWS European Sovereign Cloud incorporates the Sovereign Reference Framework (ESC-SRF), which aligns with governance, operational control, data residency, and technical isolation criteria, and is undergoing independent third-party audits to validate its compliance with European regulatory expectations. AWS is also making the ESC-SRF available through AWS Artifact, enabling customers and partners to build upon these sovereignty controls for their own compliance needs. In parallel, AWS has reaffirmed its commitment to supporting customers in meeting the requirements of the EU's NIS 2 Directive, which aims to strengthen cybersecurity across the Union. As NIS 2 is transposed into national law across EU member states, AWS is working closely with national cybersecurity authorities and customers to ensure robust security practices and compliance. These efforts are part of AWS's broader responsibility to secure digital infrastructure in Europe and to help organizations build resilience and trust in the online environment.
Jun 29, 2026
Amazon Web Services announced the general availability of its **European Sovereign Cloud**, a physically and logically isolated cloud region designed to meet EU data residency and sovereignty requirements. The offering is operated within the EU by EU-resident staff under a new German parent company, with supporting systems such as **metadata, billing, and identity management** kept inside the EU; AWS said it will start with roughly **90 services** available from Germany and later expand via *Local Zones* in Belgium, the Netherlands, and Portugal, plus *Dedicated Local Zones* for single-tenant, highly sensitive workloads. The launch is positioned as a response to European customer concerns about exposure to **U.S. extraterritorial authorities** (e.g., the **CLOUD Act**) and broader geopolitical risk influencing cloud procurement decisions. Commentary in the accompanying opinion piece frames this as part of a wider “tech dependency” problem in which reliance on U.S.-based providers can become a geopolitical vulnerability, reinforcing why EU organizations are seeking stronger sovereignty controls and alternatives—even as some industry leaders remain skeptical that technical and legal measures (including AWS’s references to protections like the **Nitro System**) can fully eliminate foreign-jurisdiction risk.
Jun 29, 2026
Microsoft and Amazon Web Services (AWS) have announced significant enhancements to their cloud services aimed at addressing European data sovereignty and compliance requirements. Microsoft is introducing new features such as end-to-end AI data processing within Europe as part of the EU Data Boundary, in-country processing for Microsoft 365 Copilot interactions in select countries, and expanding Azure Local capabilities to support larger, more sovereign private clouds. These measures are designed to reassure European customers amid ongoing concerns about the reach of US laws like the CLOUD Act and shifting geopolitical dynamics, particularly following recent changes in US leadership. AWS has released a whitepaper detailing the design and objectives of its upcoming AWS European Sovereign Cloud, which will launch its first region in Brandenburg, Germany by the end of 2025. The new infrastructure will feature dedicated physical resources, logical isolation from other AWS regions, independent operational controls, and a distinct EU-based corporate governance structure. Both providers are responding to increasing demand from public sector and highly regulated industries in Europe for greater control over data residency, operational autonomy, and protection from extraterritorial legal requests.
Jul 2, 2026