A sentence spoken under oath
In June 2025, at a hearing before the French Senate’s commission of inquiry into public procurement, the director of public affairs of Microsoft France acknowledged under oath that he could not guarantee that French citizens’ data hosted by the company would never be handed over to US authorities if they requested it. Microsoft added that, to its knowledge, no European company or administration had been affected so far. But the essential point had been made: keeping servers in Europe is not enough to protect data held by a provider subject to US law.
A year later, that statement remains the clearest illustration of what the Cloud Act means: a law that allows US authorities to require data held by a US company, wherever in the world it is stored.
A conflict of laws no contract can resolve
On the European side, Article 48 of the GDPR only allows data to be transferred on the order of a foreign authority if an international agreement provides for it. No such agreement currently covers Cloud Act orders addressed directly to providers. The provider is caught between two contradictory legal systems, and contractual clauses, however carefully drafted, cannot settle that conflict on its behalf.
For the client company, the conclusion is simple: the risk cannot be negotiated away, it can only be removed by choosing where, and by whom, its data is processed.
And what about generative AI?
The question is especially acute for generative AI. When an employee queries an online assistant, they hand over much more than a file: contracts, meeting notes, client data, sometimes an entire strategy summarised in a prompt. That content passes through the model provider’s servers, and often through those of its host.
- Prompts are data: they contain the company’s most sensitive context, written in plain text.
- So are indexed documents: an assistant connected to your document base in the cloud exposes that entire base.
- Usage logs reveal who is working on what, and when.
Sovereign clouds, qualified clouds: what are we talking about?
Several answers coexist. Offers qualified SecNumCloud by ANSSI, the French cybersecurity agency, require in particular that the provider is not subject to non-European legislation. Hybrid offers combine a European operator with US technology, with guarantees that vary from one arrangement to another. Finally, hosting on premises, or with a host chosen by the company, remains the most direct solution for the most sensitive data.
For AI, the added difficulty is that the best-known models are only available through their vendors’ services. Hosting your files in Europe achieves nothing if every question asked to the assistant goes to a model operated elsewhere.
The most direct answer: AI inside your walls
AI deployed on premises changes the nature of the problem. The model runs on a server you own, inside your network; documents, conversations and computation never leave your infrastructure. There is no longer a third party to receive an order.
That is the choice we made with MIA, our generative AI assistant, and with our local API: sovereignty is not a contractual promise, it is a property of the architecture.
Where to start?
Before choosing a solution, take stock: which AI tools are your teams already using, with what data, and for which purposes? That is precisely the purpose of an AI audit: mapping uses, measuring real exposure and deciding, use by use, what can stay in the cloud and what must come back in-house.
Sources: records of Microsoft France’s hearing before the French Senate commission of inquiry (June 2025); Regulation (EU) 2016/679, Article 48.
