By Michał Puchała · 2026-08-20 · 4 min read
EU cloud news, week of 2026-08-20
New EU rules speed cross-border access to electronic evidence, the Netherlands activates NIS2 duties, the ECB maps Europe's exposure to concentrated US AI assets, Scaleway expands its managed cloud stack, and a Paris-labelled security zone moves to UK infrastructure.
This week, European cloud policy moved from future plans to operating obligations. New rules now affect how providers answer legal orders and how Dutch boards govern cyber risk, while two infrastructure updates show why the details beneath a service label matter.
The EU's e-Evidence Regulation becomes applicable Since 18 August, a judicial authority in one EU country can send a European Production Order directly to a service provider or its legal representative in another member state. The provider must normally respond within 10 days, or within eight hours in an emergency, while the framework also provides safeguards and legal remedies. Cloud, storage, communications and other online providers serving the EU need a designated European contact and a process that can identify, preserve and disclose the requested records on time. For customers, European hosting still provides a clear jurisdictional framework, but it does not mean data sits beyond lawful access by authorities elsewhere in the Union.
The Netherlands brings its NIS2-based Cybersecurity Act into force The law took effect on 15 August and creates new duties for more than 8,000 organisations across 18 sectors, including healthcare, digital infrastructure, transport and government. Organisations in scope must register, manage security risks and report significant incidents within the statutory time limits. The board holds final responsibility for cyber-risk management, and directors need enough knowledge and training to assess the measures in place. That makes cloud resilience evidence, supplier responsibilities and tested incident reporting a board matter rather than a document left solely with the IT team.
ECB economists warn that a US AI correction would reach Europe ECB analysis reported this week estimates that euro-area households hold hundreds of billions of euros in the seven largest US technology companies, often indirectly through funds, while insurers and pension funds have still greater exposure. The researchers argue that high AI expectations may eventually produce a market correction and that close links between US and European markets would carry part of the effect across the Atlantic. The timing and scale remain uncertain, so this is a risk scenario rather than a forecast with a date attached. Its relevance to cloud strategy is concentration: Europe's dependence on a small group of AI and infrastructure companies now reaches from technology operations into savings and institutional capital.
Scaleway moves its managed RabbitMQ service to general availability Scaleway's August changelog marks Cloud Essentials for RabbitMQ as generally available after its earlier test phase. RabbitMQ is an open-source message broker that passes jobs and events between applications, and the managed offer removes much of the routine work of running the underlying servers. This fills another practical gap between European cloud platforms and the larger hyperscalers for teams building distributed systems. CTOs should still verify regional availability, recovery options, supported features and the route for exporting configurations before treating the open-source foundation as a complete exit plan.
Broadcom relocates its Paris Cloud SWG localisation zone to Dover On 18 August, Broadcom moved the zone from Paris to a Cloud Secure Web Gateway compute point of presence in Dover, while retaining French source-address ranges that help websites return localised content. Customers using fixed allowlists or IPsec connections need to update their configurations, with old Paris ranges due to retire on 15 September. The change is narrow and operational, but it illustrates a wider procurement point: an IP address associated with one country does not prove where the supporting compute runs. Teams with residency or jurisdiction requirements need the provider's service topology and data-flow documentation, alongside tested change procedures.
Across the five stories, control became something organisations must demonstrate through response processes, supplier evidence and infrastructure details.
Thinking about migration? Book a free consultation to discuss your situation.