A director told me recently, with some pride, that his organisation had gone "fully European" on AI. European vendor, European data centre, every box ticked. When I asked what his people did when that one European tool was a little too slow or too limited, the room went quiet.
That is exactly the gap. The employee in a hurry does not paste into the tool that took months to negotiate. He pastes into ChatGPT, because it is faster. And at that moment the data no longer sits in Europe, it sits under US law.
Digital sovereignty is arranged in the boardroom. But it is decided in the prompt field.
The question is not where your data sits, but under whom
We talk about sovereignty as if it were a question about maps: are the servers in the EU or not? That is a reasonable question, but it is not the one that matters. The one that matters is which government can legally compel your data. And that does not depend on where the disk spins, but on which law the provider falls under.
That distinction is the whole game. You can host data perfectly within Europe and still fall under a foreign law, simply because the company behind it is foreign. Sovereignty is therefore first a legal question, and only then a technical one.
Why hosting is the wrong question
The US CLOUD Act of 2018 requires American companies to hand over data when the US government asks, regardless of where that data is held. A server in Frankfurt changes nothing as long as the parent company is in the US. Jurisdiction travels with the company, not with the disk.
And that is exactly where the CLOUD Act collides with the GDPR. Article 48 says that a judgment from a foreign court or authority is only a valid basis to transfer data if it rests on an international agreement, such as a mutual legal assistance treaty. An order under the CLOUD Act does not, by itself, meet that bar. So a US company with European customers can be required to hand over data under US law and forbidden from doing so under the GDPR at the same time. Two legal systems demanding the opposite, with your data caught in between.
This is not legal scaremongering. In 2025, a Microsoft executive was asked, under oath, before the French Senate: can you guarantee that European data is never handed to the US government? The answer was no. The company has to comply with US legal orders, and such requests do occur.
That shifts the whole conversation. European hosting is a precondition, not a guarantee. And the uncomfortable part is this: at the very moment the data leaves, in a prompt field, you see none of it. No flag, no country of incorporation, no clause of law. Just an empty text box asking what you are working on.
Most AI tools fall under US law
Look at what is used every day. ChatGPT at OpenAI, Copilot at Microsoft, Gemini at Google, Claude at Anthropic: all American companies. Whatever is pasted into them falls under US jurisdiction, with or without a European data centre. Add to that the US surveillance laws, in particular FISA Section 702 and Executive Order 12333.
This is not a fringe concern; it is precisely why European data rules and US law have collided for years. In 2020, in the Schrems II case, the EU Court struck down the arrangement of the day, Privacy Shield, because that US surveillance was incompatible with European fundamental rights. Its successor, the 2023 EU-US Data Privacy Framework, keeps transfers legal for now. But it is shaky: a fresh case is before the Court, FISA 702 survives on short extensions, and the US body meant to police the arrangement has been hollowed out. Two earlier frameworks did not last. Building your most sensitive data on this one is, in effect, a bet on how a court case turns out.
DeepSeek showed that this can come from an entirely different direction too: a Chinese model storing data in China, blocked by Italy in 2025. But that is one example of a broader principle, not an everyday European problem. The question that does come up daily is the US jurisdiction of the tools everyone already has open.
That Europe takes this seriously shows in the counter-movement: in late 2025 member states adopted a declaration for European digital sovereignty, and the Commission launched a sovereign-cloud procurement. Admirable, at the infrastructure level. But all of that effort is undone in two seconds by a single paste into the wrong tool.
The objection, taken seriously
The fair objection: "We only use vendors under the Data Privacy Framework, or that host in Europe. This is handled."
A good step, and the right direction. But the Framework is a legal basis, not a sovereignty guarantee, and it is under pressure. European hosting under an American parent does not remove the CLOUD Act. And even with your contracts in order, you only cover the tools you chose. One employee using a free tool on a personal account sidelines the whole arrangement. Sovereignty at the contract level is undone by shadow AI on the floor. The agreement on paper is a precondition, not the outcome.
What to do instead
Four steps that bring the sovereignty question back to where it is answered.
- Know which law each tool falls under. Not just where the data sits, but which country the provider belongs to, and what that means legally.
- Choose genuinely sovereign options where it matters. For your most sensitive data, what counts is not only European hosting but European control.
- Signal at the moment of the prompt. Show the employee what is sensitive before the data crosses into another jurisdiction, so they can correct course.
- Measure where sensitive data goes. In aggregate, so you can demonstrate the risk without tracking individuals.
That visibility turns an abstract debate into something concrete. This is what it looks like:
Outlook
