An AI provider that runs your prompts in a European data centre is EU-hosted. That doesn't automatically make it EU-owned. If the company operating the service, or its parent, is based in the United States, US law can still require it to hand over data it controls, wherever the data sits. So if your team sends contracts, customer records or source code to an AI model, you need to know whose law the provider answers to as well as where its servers are.
This is part 1 of two. Here we explain the difference and what the US CLOUD Act does. Part 2 is a step-by-step guide to checking an AI provider yourself.
This article is general information, not legal advice. For decisions about your own data processing, talk to your data protection officer or legal counsel.
Why this matters more for AI than for cloud storage
Most cloud software stores your data once and reads it now and then. With AI inference, every request sends your content to a model: the question, the document you pasted in, the pages your knowledge base retrieved, the code your assistant is editing. A busy team sends thousands of these a day, and usually through several companies at once: the tool, maybe a gateway, the inference provider and the data centre underneath.
EU-hosted vs. EU-owned
EU-hosted
What it means. Data is stored and processed in data centres located in the EU.
What it tells you. Data residency, meaning where the data physically is.
Typical example. An EU region of a US hyperscaler.
Covers the CLOUD Act risk? Not on its own.
EU-owned
What it means. Every company that operates or controls the service is established in Europe, with no non-European parent controlling the data.
What it tells you. Jurisdiction, meaning whose law can compel access to it.
Typical example. A European company running its own infrastructure in European data centres.
Covers the CLOUD Act risk? Generally yes, if no US entity in the chain controls the data.
Marketing pages tend to use "EU data residency", "sovereign" and "GDPR-ready" as if they meant the same thing. They describe different properties.
What the US CLOUD Act does
The CLOUD Act (Clarifying Lawful Overseas Use of Data Act) became US law in March 2018. It ended the Microsoft Ireland case, in which Microsoft argued that a US warrant couldn't reach emails stored on servers in Dublin. Congress settled the question: providers subject to US jurisdiction must produce data in their possession, custody or control, wherever it is stored.
In practice, a server in Frankfurt or Paris doesn't protect data held by a US provider, because the law follows control. The order goes to the provider rather than to you, and it can come with a non-disclosure requirement, so you may never hear about it. Whether an EU subsidiary of a US group is covered depends on how much control the US parent has over the data, and lawyers disagree on that point.
The Act has limits. It covers targeted requests in criminal investigations; concerns about large-scale surveillance relate to other US laws, such as FISA Section 702. Providers can challenge orders, but the Act's own procedure for that only applies to countries with a US agreement, and the EU has none. Encryption with customer-held keys limits what a provider can hand over, but a model has to read your data in plain text to answer it, so that protection only goes so far for inference.
The conflict with GDPR
Under Article 48 of the GDPR, a foreign court order or authority decision requiring the transfer of personal data is only recognised if it rests on an international agreement, such as a mutual legal assistance treaty. The EU and the US have no CLOUD Act agreement yet. A US provider served with an order can end up caught between the two: complying with US law may mean breaching EU law, and the reverse.
What about the EU-US Data Privacy Framework?
The Data Privacy Framework (DPF), adopted in July 2023, covers transfers of personal data from the EU to certified US companies. It doesn't switch off the CLOUD Act, and its own future is uncertain. The EU General Court upheld it in September 2025, but that judgment is under appeal at the Court of Justice. After a June 2026 US Supreme Court ruling on the independence of federal agencies such as the FTC, noyb called on the European Commission to withdraw the DPF, and the European Data Protection Board asked the Commission to assess the impact. The DPF is still in force, but advisers recommend documenting a fallback, such as standard contractual clauses.
Do the hyperscalers' sovereign clouds solve the problem?
The large US cloud providers have answered with dedicated offerings: Microsoft's EU Data Boundary, Google's sovereign cloud partnerships such as S3NS with Thales, and the AWS European Sovereign Cloud in Brandenburg, opened in early 2026 with an EU-based legal entity and EU-resident staff.
These offerings lower the risk of data leaving the EU through operational access, and for moderate requirements they may well be enough. Critics, including European cloud providers and legal analysts, point out that the ultimate parent is still a US corporation and that none of these offerings claims full legal immunity from US orders. The providers reply that their corporate structures, staffing and technical isolation make access far harder in practice than in standard regions. In June 2025, testifying under oath before a French Senate inquiry, Microsoft France's director of public and legal affairs said the company could not guarantee that French public-sector data would never be handed to US authorities, while adding that no such request had ever been made.
Our reading is that sovereign clouds narrow the gap between EU-hosted and EU-owned without closing it.
Where Melious fits
We built Melious AI for teams that want the EU-owned side of that comparison.
Melious AI is a company based in Saarbrücken, Germany. Today, every request to our API is processed in European data centres, and nothing is routed outside Europe. This November we are moving our models onto our own hardware in data centres in Germany, Ireland, France and Finland. After the move, if our hardware ever has a problem, requests fail over to EU-based partner providers, so your service keeps running and your data stays in Europe.
We don't log the content of prompts or responses (files you add to a knowledge base stay until you delete them), we never train on customer data, and our DPA is public.
Keep your code. Change the URL.
Our API speaks both the OpenAI and the Anthropic format, so Claude Code, Cursor, LangChain or n8n work once you change the base URL.
Frequently asked questions
Does storing data in an EU data centre protect it from the US CLOUD Act?
Not on its own. The CLOUD Act applies to providers subject to US jurisdiction and covers data they control, wherever it is stored. It depends on who operates and controls the service.
Is the EU-US Data Privacy Framework still valid?
As of November 2026, yes. An appeal is pending at the Court of Justice, noyb has called for its withdrawal and the European Data Protection Board has asked the Commission to reassess it.
Are AWS, Azure and Google's European sovereign clouds subject to the CLOUD Act?
Their parent companies are US corporations. The providers say their EU structures make access very difficult; critics say the legal exposure remains as long as the parent is American. Neither side claims the question is settled.
Does EU-hosted mean GDPR-compliant?
Not automatically. GDPR compliance also depends on your contracts, legal basis, retention, security measures and who can access the data.
Further reading
- US Department of Justice: CLOUD Act resources, including the full text
- GDPR, Article 48: Transfers or disclosures not authorised by Union law
- European Data Protection Board: letter to the European Commission on Trump v. Slaughter and the Data Privacy Framework (31 July 2026)
- Microsoft tells French lawmakers it can't protect user data from US demands (SDxCentral)