It is a well known fact that any US owned electronic communication or remote computing services company is subject to the US CLOUD Act, which means that US authorities can access data held by any US owned company regardless of where in the world they are located. In response to this, several US companies have spent a lot of money creating what they call the EU Data Boundary or the European Sovereign Cloud – a technical infrastructure network of data centers across Germany, France, the Netherlands, Norway and other European countries.
The purpose is multi-fold — to ensure that data remains local, that processing complies with EU regulations, and that European customers don’t abandon US providers. It looks good on paper — data compliance with the GDPR is a must for European customers, be it companies, organizations or governments. But in practice it doesn’t change the fact that the companies are still US owned companies and subject to the US CLOUD Act. Let’s look at how this presents a problem.
85% of the European cloud market is held by US companies
The three largest cloud providers in the world are Amazon Web Services (AWS), Microsoft Azure and Google Cloud, all American owned. About 85% of the European cloud market is held by US companies, and the top three control over 70%. Europe’s total cloud spending amounting to an estimated €229 billion to €265 billion annually. That is a huge amount of money.
The problem is that the data these US owned companies hold is subject to the US CLOUD Act, no matter where the server is located. If Microsoft stores data on a server in Frankfurt, US authorities can access the data with a warrant or subpoena. Microsoft’s own chief legal officer in France has confirmed this under oath, and European regulators have said the same thing in regards to European data repeatedly: location alone doesn’t protect EU citizen data under GDPR if the provider behind it is still under US jurisdiction.
Read: A guide to GDPR
The EU Data Boundary
What Amazon, Microsoft, Google and other companies have done in an effort to come up with a solution is to create what they call the “EU Data Boundary” or the “European Sovereign Cloud“, which is essentially European sovereign clouds with local data control where data is stored and processed entirely within Europe. The illusion here is that the data is protected from the CLOUD Act and US authorities because it sits inside a EU boundary.
You will find pages about compliance and how the data is stored and processed on company web pages, but the reality is that US authorities can still access that data – if the provider holds or can recover the encryption keys, it doesn’t matter if the data is encrypted or not. A provider can challenge a request in a US court, although that challenge mechanism has never been successfully tested in public. In practice, the GDPR cannot protect the data.
Read: Europe’s Digital Independence
The conflict between GDPR and the CLOUD Act
The conflict between the GDPR and the CLOUD Act comes down to two legal systems in direct opposition to each other.
If a US provider operating a data center in Frankfurt is served with a CLOUD Act warrant for a German customer’s emails, European law simply forbids compliance. Under GDPR Article 48, a third-country court order is not a valid basis for transferring EU citizens’ data out of the EU unless it rests on an international agreement such as a mutual legal assistance treaty. A unilateral US demand does not qualify. Producing the data would breach European law, with fines of up to 4% of global annual turnover.
US law, meanwhile, requires compliance. Refusing the warrant puts the company in contempt of court in the United States.
The company must choose which law to break — comply with the US order and violate the GDPR, or refuse, and answer to a US court. No contract or certification can resolve this, because the conflict lies between two legal systems claiming authority over the same data.
Read: Runbox vs. the CLOUD Act
Do Sovereign cloud partnerships really work?
The short answer is yes for regulatory compliance, but not for absolute legal immunity. Even separate EU subsidiaries are ultimately controlled by a US parent company. The US parent has “possession, custody, or control” over the platform.
1. Where they work: Operational and regulatory sovereignty
If your goal is satisfying European regulators regarding GDPR, NIS2, or DORA, these partnerships work excellently. By ensuring that technical support engineers sitting in the US cannot access EU data without real-time, European-approved logging (such as Microsoft’s Data Guardian), they effectively block accidental and unauthorized data leaks. The providers have also rolled out a useful toolkit around the edges: customer “lockbox” approvals before provider access to your data, bring-your-own-key encryption (BYOK), just-in-time access (JIT) limited to what a specific task requires, commitments to challenge demands in court and disclose only the minimum if they lose, notification of government requests where legally permitted, and transparency reports. That is not nothing — it raises the bar for casual snooping and badly scoped support access, and covers incidental exposure. It is not immunity though.
2. Where they fail: Corporate jurisdiction & the CLOUD Act
A rebranding or a regional corporate structure does not change who owns the company. Because AWS, Microsoft, and Google are US corporations, a US court can still serve a warrant to the American parent company.
The US government argues that if a US company controls the software updates, holds the equity, or ultimately commands the European subsidiary, it legally “controls” the data. The only exception is completely air-gapped, software-only deployments where the US firm physically has zero operational access keys (like Google’s GDC Hosted running in a local telecom’s datacenter). And even there, read the fine print: sovereignty over the legal entity isn’t the same as independence from the supply chain. When the software stack is licensed from California, patches, updates and security fixes still flow from the US parent.
The Microsoft example
Microsoft is the best example, partly because it has gone furthest in making the case for its own compliance. Its EU Data Boundary, completed in 2025, promises that core customer data for Azure, Microsoft 365, and Dynamics 365 is stored and processed entirely within the EU and EFTA. It introduced a “data boundary guardian” role, customer-managed encryption keys, and an EU-based approval layer for any exceptional access from outside the boundary. And yet, as we said before, Microsoft’s own chief legal officer in France confirmed under oath at a French Senate hearing in 2025 that the company cannot guarantee data sovereignty for European customers.
Flex Routing: The boundary that bends
In April 2026, Microsoft rolled out Flex Routing for Copilot: during peak demand, the processing of your prompts and responses can be diverted to data centers in the US, Canada or Australia. It was switched on by default for new and existing EU tenants alike. Data “at rest” stayed in the EU; data “in use” — the prompts, and the context pulled from your inbox and files — could leave it entirely. And Copilot doesn’t send just your typed sentence: it bundles the relevant emails, files and metadata along with it. Under the GDPR that is a transfer of personal data to a third country.
Microsoft has also been using Anthropic as a subprocessor since January 2026, and up until now, Microsoft’s own documentation has stated that Anthropic-processed data falls outside the EU Data Boundary (“Anthropic models are out of scope for the EU Data Boundary and when available, in-country LLM processing commitments”). In November 2026, Microsoft announced that Claude models will move inside the boundary by the end of the year, so that Claude processing will take place within the EU boundary. But even inside the boundary, your prompts are processed by US companies — and reachable by the CLOUD Act.
Read: Outlook stores email in Microsoft Cloud
AWS and Google: Same path, different packaging
AWS and Google have followed a similar path. AWS launched its European Sovereign Cloud in January 2026 in Brandenburg, Germany, operated through German subsidiaries with EU-resident staff. This is a physically separate environment with a €7.8 billion investment pledged through 2040, and run by a new German parent company with an advisory board of European citizens and residents. Google has expanded its sovereign cloud offering with data boundary controls and customer-managed encryption. But AWS’s German subsidiaries are still subsidiaries. A European data center operated by a US company is still, legally, a US company’s data center. The more honest way to look at these launches is not as a legal fix but as an operational one: they make it harder for a support engineer in Virginia to browse your data.
Read: Are AI Tools such as Gemini Reading Your Emails?
The EU’s answer: The Cloud and AI Development Act
The EU’s legislative response to all this is the Cloud and AI Development Act (CADA), which was proposed by the European Commission in June 2026. CADA grades cloud providers on four sovereignty tiers, from EU-based processing at the bottom to EU ownership, operational control and supply-chain transparency at the top. At the most sensitive tiers — defence, national security, critical infrastructure — US hyperscalers are barred, because they cannot remove their legal connection to the US parent company. CADA still needs Parliament and Council approval, with final adoption targeted for late 2027.
European providers started worrying about this before the law even existed. In March 2026, CISPE — an association representing 38 European cloud providers — sent the Commission an open letter signed by 25 European cloud CEOs. Their argument was simple: sovereignty must be defined by control, not by presence. A data center in Europe is not sovereignty if operational and legal control stays with a company answerable to a foreign government. “CADA is a once-in-a-lifetime opportunity to put Europe back on the front foot in the digital economy,” said CISPE Secretary General Francisco Mingorance, “and we must not squander it by legitimising sovereignty-washing.”
The concern was legitimate. In April 2026, the Commission awarded four contracts under its €180 million sovereign cloud tender — the first procurement to apply explicit sovereignty criteria to cloud services. Three of the winners develop their own technology and reached the framework’s SEAL-3 level. The fourth, a consortium led by Belgian telecom Proximus, runs on S3NS — a joint venture between Thales and Google Cloud — and only reached SEAL-2, the minimum. In other words, one of the four “sovereign” contracts runs on technology ultimately owned by a US company. CISPE said this “threatens to institutionalize sovereignty washing at the highest levels.” When a joint venture with a US hyperscaler qualifies as sovereign, the label stops meaning anything.
What actual sovereignty looks like
The only architecture that eliminates this entire conflict is a provider that isn’t subject to US law at all — incorporated and headquartered in Europe, with no US parent company and no ownership chain that creates jurisdictional exposure. But the definition is stricter than “European headquarters.” The Dutch National Cyber Security Centre has suggested that even a European company could fall under the CLOUD Act if it employs US nationals with access to the data. And in September 2025, an Ontario court ordered OVHcloud — a French provider — to hand over subscriber data held in France, through its Canadian subsidiary. A foreign subsidiary with access to the data is a foreign legal foothold.
The only real fix: A provider outside US jurisdiction
For organisations that need their data to fall under European law and nothing else, the only real fix is a provider that isn’t subject to US jurisdiction in the first place. EU Data Boundaries and European Sovereign Clouds are useful for satisfying a checkbox on data residency, but residency and sovereignty are not the same thing. The location of the server has never been the deciding factor — the ownership of the company is.
Europe has relied on US tech companies for so long that much of its digital infrastructure is built on top of them. Decades of investment, skills and tools have gone into AWS, Azure and Google Cloud. Sovereignty comes from building European infrastructure and moving all data onto it, which takes time and costs serious money. This is the real choice in front of Europe. Either invest heavily in European tech infrastructure, or stay dependent on US companies and be potentially reachable by the US government.
European governments and public administrations run on US cloud services
And it is not just companies. European governments and public administrations run on US cloud services too, and they hold the most sensitive data there is: citizen records, tax files, health data. The dependence is not only financial and legal, it is also operational. Just this week, a Microsoft outage took Outlook and Teams down for more than twelve hours, and European governments were among those affected. In Norway, that included the Parliament, the public government portal with its tax services, the Defence, the Police, and the Digitalisation Agency itself. That is not a sovereignty problem in the legal sense; nobody’s data was read. But when an entire country’s public sector loses its email, it shows what relying on a handful of US providers means in practice.
At Runbox, we are a Norwegian company operating our own servers in Norway. We are not subject to the CLOUD Act — a US warrant has no legal force over us. Your data is governed by Norwegian law and the GDPR — we are literally “sovereign”.