A director told me recently, with some pride, that his organisation had gone "fully European" on AI. European vendor, European data centre, every box ticked. When I asked what his people did when that one European tool was a little too slow or too limited, the room went quiet.
That is exactly the gap. The employee in a hurry does not paste into the tool that took months to negotiate. He pastes into ChatGPT, because it is faster. And at that point the data no longer sits in Europe; it sits under US law.
Digital sovereignty is negotiated in the boardroom, but it is decided in the prompt field.
The question is not where your data sits, but whose law applies
We talk about sovereignty as if it were a question about maps: are the servers in the EU or not? Reasonable, but it is not the question that matters. The one that matters is: which government can legally demand your data? And that does not depend on where the disk spins, but on which law the provider falls under.
That distinction is the crux. You can host data entirely within Europe and still be subject to foreign law, simply because the company behind it is foreign. Sovereignty is therefore first a legal question, and only then a technical one.
Why hosting is the wrong question
The US CLOUD Act of 2018 requires American companies to hand over data when the US government asks, regardless of where that data is held. A server in Frankfurt changes nothing as long as the parent company is in the US. Jurisdiction travels with the company, not with the disk.
And that is exactly where the CLOUD Act collides with the GDPR. Article 48 says that a judgment from a foreign court or authority is only a valid basis to transfer data if it rests on an international agreement, such as a mutual legal assistance treaty. An order under the CLOUD Act does not, by itself, meet that bar. So a US company with European customers can be required to hand over data under US law and forbidden from doing so under the GDPR at the same time. Two legal systems demanding the opposite, with your data caught in between.
This is not legal scaremongering. In 2025, a Microsoft executive was asked, under oath, before the French Senate: can you guarantee that European data is never handed to the US government? The answer was no. The company has to comply with US legal orders, and such requests do occur.
That shifts the whole conversation. European hosting is a precondition, not a guarantee. And the uncomfortable part is this: at the very moment the data leaves, in a prompt field, you see none of it. No flag, no country of incorporation, no legal clause. Just an empty text box asking what you are working on.
Most AI tools fall under US law
Look at what is used every day. ChatGPT from OpenAI, Copilot from Microsoft, Gemini from Google, Claude from Anthropic: all American companies. Whatever is pasted into them falls under US jurisdiction, with or without a European data centre. Add to that the US surveillance laws, in particular FISA Section 702 and Executive Order 12333.
This is not a fringe concern; it is precisely why European data rules and US law have collided for years. In 2020, in the Schrems II case, the Court of Justice of the EU struck down the arrangement of the day, Privacy Shield, because US surveillance of that kind was incompatible with European fundamental rights. Its successor, the 2023 EU-US Data Privacy Framework, keeps transfers legal for now. But it is shaky: a fresh case is before the Court, FISA 702 survives on short extensions and the US body meant to police the arrangement has been hollowed out. Two earlier frameworks did not last. Resting your most sensitive data on this one is, in effect, a bet on how a court case turns out.
DeepSeek showed that this can come from an entirely different direction too: a Chinese model storing data in China, blocked by Italy in 2025. But that is one example of a broader principle, not an everyday European problem. The question that does come up daily is the US jurisdiction of the tools everyone already has open.
The pushback shows that Europe takes this seriously: in late 2025 member states adopted a declaration for European digital sovereignty, and the Commission launched a sovereign-cloud procurement. Admirable, at the infrastructure level. But all of that effort is undone in two seconds by a single paste into the wrong tool.
But surely European cloud is enough?
The fair objection: "We only use vendors under the Data Privacy Framework, or that host in Europe. We have this covered."
A good step, and the right direction. But the Framework is a legal basis, not a sovereignty guarantee, and it is under pressure. European hosting under an American parent does not remove the CLOUD Act. And even with your contracts in order, you only cover the tools you chose. One employee using a free tool on a personal account sidelines the whole arrangement. Sovereignty at contract level is undone by shadow AI at people's desks. The contract on paper is a precondition, not the outcome.
What is still in your hands
Four steps that bring the sovereignty question back to where it is answered.
- Know which law each tool falls under. Not just where the data sits, but which country the provider belongs to and what that means legally.
- Choose genuinely sovereign options where it matters. For your most sensitive data, what counts is European control, and European hosting alone does not give you that.
- Flag sensitive data as the prompt is written. Show the employee what is sensitive before the data crosses into another jurisdiction, so they can correct course.
- Measure where sensitive data goes. In aggregate, so you can demonstrate the risk without tracking individuals.
The first step, knowing which law each tool falls under, is hard to work out from scratch for every tool. A catalogue that shows the vendor's country alongside its risk score turns that into something you can actually check, tool by tool, instead of assuming:
Outlook
