Every aviation digital twin business case contains an unpriced architectural assumption: that the data link between physical asset and virtual model will function continuously. Three converging EU regulatory frameworks — DORA, NIS2, and the EU AI Act — are now auditing this assumption with enforceable penalties. The July 2024 CrowdStrike outage and the June 2024 counterfeit titanium investigation evidence two distinct failure modes: connectivity loss and data accuracy compromise. This note concludes that architectural redundancy within the same dependency does not create resilience, and that boards must demonstrate regulatory defensibility through architectural redesign rather than vendor assurances.
David Yeoman (Sun,) studied this question.