The Cloud Act and European digital sovereignty: a conflict that remains unresolved

The previous month, the Commission had already announced stricter guidelines on the use of cloud services for sensitive public administration data, explicitly recommending that providers subject to non-European jurisdictions be avoided for classified or critical information.

But the rhetoric on sovereignty clashes with the reality of infrastructure. The main cloud contracts of the Italian and European public administrations continue, in fact, to rely on American hyperscalers. European alternatives do exist – including emerging solutions from national telecoms operators – but they suffer from a gap in scale, functionality and investment capacity that cannot be bridged by decree.

According to experts, the most effective technical solution is an architectural one: end-to-end encryption with keys controlled exclusively by the European customer. If the provider cannot access the encryption keys, it cannot technically comply with a warrant under the Cloud Act requiring readable data, thereby simultaneously meeting the technical impossibility required by US law and the protection obligation imposed by European law.

This is the approach set out in the Data Act, which requires cloud service providers to implement appropriate technical and organisational measures to prevent non-EU government access to data stored within the Union.

The problem is that many solutions marketed as ‘sovereign cloud’ by US providers do not meet this requirement. Locating servers in Europe is not enough if the encryption keys, management tools and operational expertise remain in the hands of US entities.

As Wire points out, “even if the data is hosted in Frankfurt or Paris, if it is managed by a US-based provider, it can be legally accessed by the US authorities without involving the user or any European public authority”.

For European businesses, the message is twofold. From a compliance perspective, relying on providers subject to the Cloud Act for sensitive data means exposing oneself to a regulatory risk that is no longer merely hypothetical. From a strategic perspective, dependence on non-European infrastructure limits the ability to exercise control over increasingly critical assets. The Data Act has lowered the barriers to changing providers, eliminating switching costs by January 2027 and imposing a two-month migration period. This presents an opportunity to reassess architectures and providers, but it requires investment in skills and planning that many organisations have not yet undertaken.

The outcome remains to be seen. Europe has the regulatory tools to assert its digital sovereignty, but translating these into operational independence is a long process, involving investment in infrastructure, skills development and strategic decisions that not everyone is prepared to make.