What is the Cloud Act and what does it allow US authorities to do?

The Cloud Act is a US federal law that allows US authorities to demand access to data controlled by a American company, wherever that data is processed. Its full name is Clarifying Lawful Overseas Use of Data Act, and it was signed in 2018 [27].

A response to Microsoft v. United States

According to the analysis published on Cairn, the Cloud Act is a direct consequence of the case Microsoft v. United States [9]. This academic source is the closest to the text among those in the file. The available extracts do not detail the facts of the case, so we do not repeat them here.

What the law allows

Secondary summaries converge on the mechanism:

• US authorities can demand access to data controlled by a US company [3].
• The law authorizes the US government to retrieve data stored on American servers, including foreign data, without users being informed [23].
• A company concerned must provide the requested data, under penalty of sanctions [24].

The providers concerned

The Cloud Act applies to providers of electronic communication, processing or storage services, cloud computing, or remote IT services [23]. Cloud-based AI service providers fall into these categories as soon as they process or store data for their clients. This is our reading of that definition, which the sources do not state in these terms. The decisive criterion is control exercised by a US company, not the nationality of the client. The file does not specify the connecting condition that brings a provider within the scope of the law (the extract from [23] is truncated). It must be verified against the text itself.

A controversial law

The firm Dreyfus & associés emphasizes that the Cloud Act is controversial because it conflicts with several national and international laws, including the GDPR [24].

Several of these sources are summaries from practitioners or market players (firms, publishers, hosting providers). They do not replace reading the US text itself. Assessing a company's exposure is for the company and its advisers.

My host is in Europe: am I protected from the Cloud Act?

No, not automatically: according to the sources consulted, the decisive criterion is the provider's connection to US law, not the location of the servers. The Cloud Act allows US authorities to demand access to data controlled by a US company [3]. This applies to data from US providers even when it is hosted in Europe [7]. Hosting in Paris or Frankfurt therefore does not suffice to rule out the risk: the Cloud Act applies as soon as a US entity is involved [19]. This last formulation comes from a commercial provider, but it matches the analysis of other sources, according to which the Cloud Act and FISA 702 give US authorities extensive access to data stored in American cloud services, whether or not the servers are located in Europe [40].

The trap of the "European" provider built on American infrastructure

An offer marketed by a European company is not necessarily safe. One guide cites as a classic mistake assuming that a "European" provider is protected when it relies on an underlying American infrastructure (IaaS) [28]. The sources in the file do not detail how the text applies to each link in such a chain. The questions to ask a provider are therefore:

• What is the parent company, and is there a US entity in the group?
• On what infrastructure does the offer actually rely?
• What subcontractors take part in processing and storage?

Encrypted data: a claim to qualify

One source asserts that access would be possible even to encrypted data [4]. It comes from a commercial player, and the file contains no primary source confirming it. It should therefore be treated as a hypothesis to verify, not as an established fact.

The sources in this section are secondary analyses and provider content, not the text of the law itself. Assessing the exposure of a given provider is for the company and its legal advisers.

Cloud Act and FISA 702: what is the difference, and why cite them together?

The Cloud Act and FISA 702 are two US texts of different nature: the first belongs to criminal justice, the second to intelligence [30]. They are nonetheless cited together because the debate over US authorities' access to cloud data, including European data, regularly links them [40].

Two frameworks, two purposes

Text	Domain	What the source says
Cloud Act	Criminal justice	Targeted requests addressed to providers [30]
FISA 702	Intelligence	A framework belonging to intelligence, not criminal procedure [30]

This distinction matters for a lawyer or DPO: the purpose, the competent authority and the procedure are not the same. The file does not contain the text of Section 702. Its exact scope is therefore not detailed here, and it must be checked against the official texts.

Why they are linked in the debate

The two texts are grouped together because, according to one source in the file, they give US authorities extensive access to data stored in American cloud services, whether or not the servers are located in Europe [40]. Another source notes that American companies (cloud providers, technology services) can be compelled to provide data even when it is stored outside the United States [38].

In both cases, the common point is the provider's connection to US law, not the physical location of the data. For a European company using a US AI provider, the question is therefore about the nature of the provider more than the location of its servers.

A reading caution

These claims come from web sources [30][40][38], not from official texts. The file contains no primary source on this point. Their precise scope, and their application to a given provider, remain to be assessed by the company with its advisers, against the texts themselves.

Why does the Cloud Act conflict with the GDPR?

The Cloud Act conflicts with the GDPR because it can place a European company under two contradictory obligations. The Cloud Act and the GDPR embody two opposing visions of data protection, which creates legal risk [2].

The dilemma described by the sources

Faced with a request from US authorities, the company has two options. It can comply and risk violating the GDPR, or refuse and expose itself to legal consequences in the United States [25][29]. According to another commentator, it cannot predict with certainty which jurisdiction will prevail [16]. One source indicates that European companies may oppose a transfer that would breach local laws [10]. The file does not show how such an objection would be decided.

What the GDPR provides

The GDPR only allows personal data to be transferred or processed in a third country if an adequate level of protection is ensured (Art. 45) [14]. Article 48 governs transfers requested by foreign courts or authorities [36]. It applies to any company, European or not, that handles data of European users [36].

Consequences for the company

• Sanction: a CNIL sanction for GDPR non-compliance is possible [18].
• Loss of control: the company loses control over data that is sometimes sensitive [18].
• No notification: the company is not necessarily informed of the transmission, due to the absence of a notification obligation [21]. It can therefore never know with certainty whether its data has been accessed [16].

A risk to document

According to Intelligence Privée, the G29, now the EDPB, has indicated that using a provider subject to the Cloud Act constitutes a risk to GDPR compliance, "which must be documented and justified" [20]. This source is secondary, and the file does not contain the original text. It should therefore be verified with the EDPB before being cited in a compliance file.

Assessing the compliance of a given processing activity remains the responsibility of the company and its advisers.

Why does AI increase data exposure?

AI services hosted by US providers are described as accessible to US authorities under the Cloud Act, even when their servers are located in Europe. According to one commercial source, this text allows US authorities to access data from AI systems hosted by US providers, regardless of where the servers are located [31]. The mechanism is the one described above: the text allows access to be demanded for data controlled by a US company [3]. An AI model, its queries and its associated data are therefore exposed under the same conditions as any cloud service.

A poorly measured dependency

The risk is heightened by a lack of visibility into what one is using. Golem.ai, an AI publisher, estimates that nearly three companies in four remain exposed to foreign legislation that could compel access to, exploitation of, or transfer of sensitive data [17]. According to the same study, this vulnerability is compounded by a widespread lack of knowledge about where AI models are actually hosted [17]. This is a finding from a commercial player and should be read as such. It nonetheless highlights a practical point: a company cannot assess its exposure if it does not know where and by whom its model is actually hosted.

Uses already built into everyday tools

Two examples recur in the sources, both commercial:

• Office suites with AI. France Nuage, which promotes an alternative, asserts that Office 365 and Copilot remain subject to the US Cloud Act, even when hosted in Europe [34].
• Legal AI. A guide for French lawyers, published by the legal AI publisher Harvey, indicates that European companies' data remains accessible to US authorities under the Cloud Act when they use a US provider [35].

These claims describe a legal risk, not an established practice of data access. Their concrete scope depends on the contract, the technical architecture and the provider's connection to US law, and is for the company and its advisers to assess.

Is the risk really as high as some claim?

The risk is real according to some of the sources, but its magnitude is debated, and the question calls for a nuanced rather than a binary answer.

Sources that rate the risk as high

For LeMagIT, in a B2B cloud market largely dominated by US publishers (Microsoft, Amazon, Google, Salesforce, Oracle), the Cloud Act "represents a real risk to the data sovereignty of European companies" [26]. Patrick Blum, quoted by Hosteur, speaks of a "real danger" [13].

More nuanced views

• The contextualized analysis from Sciences Po (HAL) cites an op-ed by Maxwell entitled "The US Cloud Act does not allow spying on European companies" [32]. The available extracts do not detail its argument.
• Another source, a LinkedIn post, indicates that European companies may oppose a transfer of data to the United States under the Cloud Act if it violates local laws [10].

An unpredictable outcome

Being able to oppose a transfer does not guarantee winning the case. A European company cannot predict with certainty which jurisdiction will prevail in a conflict [16].

Reading the sources with perspective

Several sources come from cloud players or self-described sovereign alternatives, for example a hosting provider [13] or a site offering an alternative to Microsoft 365 [34]. Their reading is not neutral. The same finding also circulates in almost identical terms from one site to another [26][13][37], which adds no independent evidence.

Checking the framework in force

The Oxeva blog on transfers to the United States states that, "pending a new agreement," these transfers are "for now illegal" except with standard contractual clauses [39]. This wording refers to an earlier state of the law and should not be repeated as is. The framework applicable to transfers must be verified against the official texts (EUR-Lex, Légifrance) and with data protection authorities.

What is the European Union preparing in response to these risks?

The European Union is moving on several fronts: a regulation dedicated to cloud and AI, data law texts that oppose foreign access requests, and a judicial cooperation project. The file does not allow their content to be detailed, nor does it say where they stand as of 13 October 2026.

The responses cited in the file

• The regulation on the development of cloud computing and AI. The European Commission states that it "will strengthen Europe's sovereignty and competitiveness" [1]. A blog post from a video conferencing publisher, therefore a commercial player, presents what Europe sets against US law with the "CADA" [7]. The available extracts specify neither the obligations imposed on providers nor the timeline.
• The Data Act and the GDPR. According to a security solutions publisher, these two texts oppose the access requirements of the Cloud Act [8]. This is the reading of a commercial source, not of an institution.
• The e-evidence project. An academic analysis sets it against the Cloud Act [9]. It calls it a "project": the file does not indicate its stage of progress.

A separate framework: the AI Act

The European AI regulation does not address foreign authorities' access to data. It relies on a risk-tiered approach, which imposes transparency, documentation and human oversight on AI systems [5]. It is presented as a flagship EU regulation for framing the development and use of AI [6]. It therefore complements the legal exposure analysis without replacing it.

Where to check the state of the law

Before any decision, consult the official texts: the Commission's page dedicated to the cloud and AI regulation [1], then EUR-Lex and the Official Journal of the European Union for the adopted versions and their application date. Assessing compliance remains the responsibility of the company and its advisers.

How to reduce the exposure of AI uses, and who assesses compliance?

Reducing the exposure of AI uses means controlling the chain of providers, beyond the mere place of hosting. The sources converge on four avenues, to be applied tool by tool.

• Document and justify every use of a provider. According to Intelligence Privée, the G29 (now the EDPB) has indicated that using providers subject to the Cloud Act constitutes a risk for GDPR compliance, "which must be documented and justified" [20].
• Analyze third parties and the underlying infrastructure. A classic trap is believing that a "European" provider is safe when it relies on an American infrastructure (IaaS) [28].
• Reduce dependence on infrastructures subject to US law. For institutions as well as companies, this is the issue identified in the face of a dual risk: loss of control over data and weakening of digital sovereignty [22].
• Consider European alternatives or cloud services [11][15]. Both sources are commercial players. The one at [15] claims that with a European cloud, files remain protected from foreign laws. This promise must be verified contractually and technically, down to subcontractors.

Hosting and legal connection

Oupi's AI is hosted in France (trust commitments). According to the sources, this criterion is not sufficient: hosting data in Frankfurt or Paris does not protect against US law [19]. The legal connection of the provider and its technical chain matters just as much [28]. Both elements must be examined for any AI provider, Oupi included.

Who assesses compliance?

This article explains texts and reports analyses. It does not constitute legal advice. Assessing compliance falls to the company, which is responsible for its processing, and to its advisers: DPO, lawyers, attorneys. It is for them to qualify the risk specific to each use and each provider, and to document the decision taken [20].