Ireland hosts the European datacentres of Google, Meta, Amazon, Microsoft and Apple. Not for any particular technical quality of its soil — but for its 12.5% corporate tax rate, which attracted the European headquarters of hyperscalers, bringing their datacentres in their wake. Data from hundreds of millions of Europeans thus flows through infrastructure physically located in Ireland, subject to the European GDPR, but operated by American companies subject to the CLOUD Act.

The CLOUD Act (2018) authorises US authorities to demand access to data held by American companies, regardless of where it is physically stored. An AWS datacentre in Dublin hosting a French SME's data is simultaneously subject to GDPR and the CLOUD Act. In case of conflict between the two, the legal answer remains uncertain. This uncertainty is structural, not accidental.

OVHcloud, Hetzner, Scaleway, Data4 — actors who both own and operate large-scale datacentres under European control are few. The vast majority of public cloud capacity in Europe is operated by AWS, Azure and GCP — American legal entities, subject to the CLOUD Act, whatever the physical location of their servers.

Interxion was the leading independent European neutral datacentre operator (colocation). Its 2020 acquisition transferred ownership and control of critical European infrastructure to an American company. An ordinary commercial transaction — but one that illustrates the mechanism by which European digital infrastructure sovereignty erodes not through conquest, but through acquisition.

France has real assets — low-carbon nuclear electricity, dense fibre, a market of 67 million people. But it has not developed a coherent policy of attractiveness and protection simultaneously. It attracted hyperscaler datacentres (AWS Paris region) without demanding in return any commitments on public data localisation, technology partnerships with French actors, or contributions to fibre infrastructure financing.

Datacentres are connected to each other and to the rest of the world by submarine fibre optic cables carrying 99% of international internet traffic. Since 2010, American hyperscalers own or co-finance a growing share of this capacity. In 2022-2023, several cables were severed in the Mediterranean and Baltic in unexplained circumstances — revealing a real, exploitable physical vulnerability that is nearly impossible to protect across thousands of kilometres of ocean.

GAIA-X, launched in 2019 as a European sovereign cloud initiative, was progressively diluted by the integration of hyperscaler members — AWS, Azure and GCP are GAIA-X members and influenced its standards in a direction favourable to their interests. Its partial failure is instructive: digital sovereignty is not built by including the actors one seeks to emancipate from.

A state hosting a hyperscaler datacentre has a unique negotiation moment — before the building permit, before the electrical connection, before the tax benefits. This moment is rarely used to demand sovereignty counterparts: EU localisation of public data, training of local technicians, third-party access for European actors, non-unilateral application of extraterritorial legislation to European data. These counterparts are negotiable. They are neglected because states compete with each other.

Every SRE deploying on public cloud should know: what is the legal entity operating this cloud in the relevant country, is it subject to the CLOUD Act, what are the data localisation clauses in the service contract. This information should appear in every infrastructure risk analysis — alongside the availability SLA or backup policy.

A resilient architecture does not only distribute load between availability zones (AZ) of the same provider in the same country. It considers resilience across distinct providers, distinct countries, and distinct legal regimes. Multi-cloud and multi-jurisdictional are not the same thing — but the combination of the two is true geographic resilience.

A BCP/DRP that does not model the submarine cable severance scenario affecting connectivity between regions is an incomplete plan. These incidents are documented, recurring, and slow to repair. The architectural response — backup routing, local cache, graceful degradation — must be prepared in advance, not discovered during the incident.

Each Member State should publish an annual inventory of datacentre capacity on its territory: owner, operator, volume, energy consumed, legal origin of controlling entities. This transparency does not exist today. It would allow citizens, regulators and businesses to assess their real exposure to extraterritorial legal risk.

Any tax benefit or administrative facilitation granted to a hyperscaler datacentre should be conditional on verifiable commitments: EU localisation of public data, training of local technicians, third-party access for European actors, and non-unilateral application of the CLOUD Act to European data hosted in these datacentres.

OVHcloud, Hetzner, Scaleway and their European equivalents deserve explicit preference in public procurement — not out of protectionism, but for consistency with a stated digital sovereignty policy. A state that preaches digital sovereignty while hosting its data on AWS is not practising sovereignty — it is talking about it.