The CLOUD Act allows US authorities to require any American company to produce data stored anywhere in the world — without going through traditional diplomatic channels (MLAT). AWS, Google, Microsoft are American companies. Their European subsidiaries remain subject to this law through the parent company. The GDPR says European data is protected. The CLOUD Act says American companies must produce it if required. The CJEU ruled in Schrems II (16 July 2020): US surveillance (FISA §702 · Executive Order 12333) is structurally incompatible with European fundamental rights. The Privacy Shield was invalidated. Its successor (Data Privacy Framework, 2023) faces the same structural critiques.

For data to be processed — read by an application, indexed by an algorithm — it must be decrypted in RAM on the machine's processor. That processor belongs to the hyperscaler. It is subject to the CLOUD Act. Encryption protects data at rest. Data being computed is in clear text in the RAM of an American server. BYOK is a secure tunnel that delivers goods in clear text directly inside the supplier's factory. As long as the physical chip belongs to a third party subject to the CLOUD Act, sovereignty over data is non-existent at computation time. Intel ME / AMD PSP (documented in The Material Black Box, 4p) are non-auditable sub-processors, active with server off, subject to US law.

In May 2019, the US government placed Huawei on its Entity List. Google suspended Android services (Google Play, Gmail, Maps) for new Huawei devices on government order. Within 90 days, the world's second-largest smartphone maker lost access to the dominant application ecosystem. Not a hypothetical — a documented executive decision. Any organisation whose critical tools depend on an American ecosystem faces the same exposure.

In March 2022, Visa and Mastercard suspended Russian operations within 48 hours of sanctions announcements. Payment card systems — critical infrastructure of daily commerce — cut by a private decision of American companies. Dependency on foreign payment infrastructure proved to be a lever of immediate economic paralysis.

US export restrictions (EAR) progressively cut China's access to advanced chips by TSMC and ASML lithography equipment. Documented in The Taiwan Bottleneck (6p). The semiconductor supply chain is a geopolitical lever — whoever controls chip fabrication controls nations' industrial capacity.

The CJEU invalidation of the Privacy Shield demonstrated that political data protection agreements are structurally insufficient against US surveillance laws. Its successor (Data Privacy Framework, 2023) faces the same critiques. Legal dependency is not resolved by diplomatic agreements — it requires real infrastructural independence.

Facing European regulatory pressure, hyperscalers created local legal structures. Bleu (Microsoft + Orange + Capgemini) · S3NS (Google + Thales). These entities operate servers physically in France, with French staff, under French law. Their communication: 'You are sovereign.' True for the entity's legal standing. False for the technical reality of the code.

Even with geographically isolated servers operated by local staff, the cloud service catalogue and orchestrator code (hypervisor, scheduler, identity management) depend on a continuous flow of code, security patches, and telemetry from the American editor — Microsoft or Google.

The local infrastructure is a remote logical extension. It obeys source code. In a major geopolitical crisis: 1) stopping security updates makes the platform vulnerable · 2) stopping the licence flow disables services. De jure sovereignty collapses before the monopoly of source code.

SecNumCloud qualification requires immunity from extraterritorial laws. No American hyperscaler can guarantee CLOUD Act immunity for subsidiary entities as long as the parent remains American. Microsoft can create Bleu — Microsoft Corporation remains subject to the CLOUD Act. This is the Sovereign Cloud paradox (physical ✓ / legal ✗) documented in The Cloud-Washing — applied at national scale.

The ultimatum of 8 September 2026 makes four demands of AWS, GCP and Azure. Through the technical and financial lens: FinOps. Through the geopolitical lens: national emergency security measures.

1 · Cancellable commits : a State whose digital infrastructures are committed for 3-5 years without exit has no diplomatic room to manoeuvre. A multi-year non-cancellable commitment is the equivalent of sovereign debt on critical infrastructure.

2 · Elimination of egress fees : the data exit cost is a ransom penalising migration toward independence. For a public administration, it is taxpayer money paid to remain captive.

3 · Guaranteed data portability : without real technical portability, changing provider is theoretically possible and practically impossible.

4 · Clarification of CLOUD Act position : a European public organisation must know whether its provider will produce its data on American request. Deliberate ambiguity is unacceptable for a public administration.