Non-EU cloud providers looking to gain the EU's cybersecurity label for sensitive data may be in for a tough go.