Hosting your data on servers in Frankfurt or Paris does not protect you from US law. The CLOUD Act applies as soon as a US entity controls the infrastructure, regardless of the country where the data resides [1]. In 2026, this legal collision between US and European regulations exposes French executives to personal, financial and operational liabilities that most executive committees have not yet measured.
The hidden legal conflict in your IT infrastructure
Most French executives believe that storing their data “in Europe” is enough to guarantee compliance with the GDPR and DORA. This belief rests on a legal error. The US CLOUD Act applies extraterritorially: the decisive criterion is not the physical location of the data, but the control exercised by a US entity [1].
The geographic sovereignty showcased by hyperscalers — European data centres, local certifications — does not change this reality: these providers cannot guarantee genuine data sovereignty in Europe [2].
The conflict is documented. The CLOUD Act allows US authorities to access data without notifying its owner, in direct breach of the GDPR’s transparency requirements [3]. The use of Microsoft 365 was found non-compliant with the GDPR in recent hearings, because Microsoft cannot guarantee compliance with the regulation given its obligations under the CLOUD Act [4].
The resulting liability falls directly on executives. Under DORA, the management of information and communication technology (ICT) risk is explicitly the responsibility of the management body [5]. Board members bear personal liability when ICT risks materialise, including those linked to jurisdictional conflicts in the cloud infrastructure [6]. This is not an IT risk that can be delegated to the IT department: it is a governance risk.
Regulators are not waiting. The ACPR has been concerned with the cloud since 2013, treating certain IT services as critical outsourcing subject to supervision [7]. The EBA reports a stepping-up of technology risk supervision since DORA came into force [8]. The European Supervisory Authorities (ESAs) have strengthened their arrangements, notably the oversight of critical third-party ICT providers [9].
Without mapping, your sovereign migration fails before it starts
Faced with the legal risk, the reflex is to migrate to European solutions. The data calls for caution. According to Gartner, 83% of migration projects fail or exceed their budgets and timelines, mainly because hidden dependencies were not fully discovered [10]. McKinsey adds to the picture: 85% of cloud migrations fail to meet their financial goals, because dependencies that looked manageable at the planning stage suddenly require dedicated owners and precise rollout schedules [11].
The scale of Europe’s dependency explains these failures. US players capture 80% of the €265 billion of annual IT spending in Europe, and 90% of Western data flows through their infrastructure [12]. More than 70% of the cloud market is controlled by three hyperscalers [13]. At this scale, migrating is not changing hosting provider: it is a global transformation that involves internal processes, the relationship with cloud services and the human organisation [14].
An exhaustive mapping of IT assets is the essential prerequisite of any sovereignty strategy. It identifies the API chains, data flows, SaaS integrations and user workflows that form an interdependent ecosystem. It also plays a role that management underestimates: it is a change management tool that describes the solutions on which business processes rely and makes it possible to anticipate resistance [15].
This mapping makes a pragmatic hybrid approach possible. Some data stays on premises, some migrates to sovereign solutions, and some temporarily remains on US infrastructure with appropriate mitigation measures. Targeted optimisation cuts cloud costs by 15 to 25% while preserving value creation [16]. The investment in mapping pays for itself before the first migration even begins.
Rebuilding your workplace: audit usage before substituting technology
Microsoft 365 shapes the daily life of French companies. SharePoint organises storage, Teams carries communication, Outlook sets the pace of the day. Questioning this suite means touching the organisation’s nervous system. Yet usage audits tell a different story from the one suggested by the licences paid for: most companies use less than 30% of the features they pay for. SharePoint serves as a simple file repository. Teams is limited to video conferencing. Copilot, rolled out with ambition, remains largely ignored. The cost of dependency is not only regulatory; it is also a cost of inertia.
The French Senate report on digital sovereignty sets out an essential economic framework: sovereign solutions cost between 200% and 1,300% more than Microsoft at list price, while confirming that replacing the office suite remains possible [17]. This finding calls for a finer reading. Sovereign collaboration platforms, designed on a modular model where you only install the applications that match real needs, turn out to be 2 to 8 times cheaper in total cost of ownership (TCO) [18]. List price is not TCO, and the gap between the two is precisely what a usage audit brings to light.
European alternatives are maturing. Six-figure Nextcloud deployments are multiplying in France, with interest from public and private organisations doubling in 2025 [19]. CryptPad (France) and SoftMaker Office (Germany) offer credible office alternatives [20]. Selective migration works: Wire and Tuta for sensitive communications, Nextcloud for collaborative storage, while temporarily keeping Outlook for critical workflows [21].
The effective approach is not total substitution but migration through a service catalogue: inventory usage by role and business process, map functional equivalence with European alternatives, and roll out gradually, prioritising substitutions with low operational impact. This method reduces TCO by 30 to 40% while eliminating productivity disruptions.
Digital sovereignty debt: the blind spot in your due diligence
No standard due diligence framework systematically assesses what could be called “digital sovereignty debt”: the target company’s structural dependency on US cloud providers and the regulatory exposure that follows.
The contradiction is head-on: US laws allow the authorities to access data stored by US companies anywhere in the world, while NIS2 imposes strict sovereignty requirements on European organisations [22]. In 2026, requests for compliance attestations have become common in B2B relationships [23]. An acquired company that cannot produce these attestations creates an immediate regulatory liability for the acquirer.
Hidden costs consistently exceed expectations. Digital transformation audits document a recurring gap between forecast budgets and reality: the difference can reach 15 to 40 times the initial amount [24]. Achieving DORA compliance costs between €500,000 and €2 million for a mid-sized organisation [25]. Buried dependencies (proprietary APIs, embedded SDKs, non-compliant data residency) push post-closing remediation to €3 to 5 million for a target that looked financially sound. And this risk cannot be contracted away: any contract between a European customer and a US cloud provider remains subject to US federal law [26].
Artificial intelligence is transforming this audit. Automated analysis tools identify problematic contract clauses with 98% accuracy, compared with 72% for a human auditor [27]. Detecting dependencies in source code (US SDKs, proprietary API integrations, data residency breaches) takes a few days instead of weeks [28]. This acceleration turns the sovereignty audit into a competitive advantage in acquisition processes.
Your AI copilot sends your data to the United States with every prompt
The adoption of generative AI in companies opens a new sovereignty front that most organisations have not anticipated. Every prompt sent to ChatGPT or Microsoft Copilot containing company data is a transfer of data to the United States. OpenAI confirms this in its Data Processing Addendum: personal data is subject to international transfers [29]. Microsoft states that Copilot “may process data in the United States” and is not covered by the EU Data Boundary commitment [30]. The CNIL points out that transfers to non-certified US entities require appropriate safeguards [31]. For companies subject to the GDPR and DORA, every inference is a potentially non-compliant transfer.
The point is not to give up AI, but to deploy an architecture suited to the sensitivity of the data. A three-tier framework meets this requirement. Tier one: US cloud APIs remain usable for non-sensitive data and low-risk use cases. Tier two: European sovereign APIs (Mistral deployed via OVHcloud or Scaleway in a GDPR-compliant environment [32]) cover most business use cases. Audits show that 80% of the processes that are candidates for automation can be handled at this tier. Tier three: open-weight models self-hosted on private infrastructure meet the requirements of highly sensitive data — banking, legal, medical.
Regulated sectors face additional constraints. ANSSI has published specific security recommendations for generative AI systems [33]. The European Banking Authority requires financial institutions to have stronger governance, complete documentation and continuous monitoring of AI systems [34]. The challenge for management: identify which process to automate at which tier, by cross-referencing data sensitivity, regulatory constraints and the expected return on investment.
Your teams will sabotage your sovereignty if you ignore how they work
The previous sections deal with infrastructure, regulation and architecture. This one deals with the factor that makes everything else fail: adoption.
Hybrid work is structurally rooted in France. 71% of employers did not change their remote work policy in 2025, and 63.6% of French people worked remotely at least once in the past twelve months [35]. This reality was built on US collaboration infrastructure: Teams, Zoom, Slack. The dependency is not only technical; it is behavioural.
Treating the move to sovereign tools as a mere technical substitution project guarantees failure. The figures are clear: 80% of SaaS applications in companies are used without IT approval, and 67% of employees bring in personal tools to stay productive [36]. Resistance to change and a lack of support cause 72% of transformations to fail [37]. Deprived of their usual tools without suitable support, employees immediately create shadow IT — WhatsApp for urgent exchanges, a personal Google Drive for file sharing, free ChatGPT for everyday help. Every workaround opens a sovereignty breach.
The key lies in an approach centred on the employee experience. Developing a collaborative IT culture that responds to user needs prevents the use of shadow IT [38]. AI can speed up this transition by analysing collaboration metadata (meeting frequency, document co-editing, response times) to identify in real time which teams are adopting sovereign tools and which are falling back on non-compliant solutions [39]. This monitoring turns a blind rollout into an informed steering of the transition.
Digital sovereignty is neither an IT project nor a regulatory compliance exercise. It is a strategic transformation that simultaneously affects the legal framework, the technical infrastructure, the workplace, external growth operations, artificial intelligence initiatives and the daily practices of every employee. Companies that isolate these dimensions multiply costs and failures. Those that address them as a coherent programme turn a regulatory constraint into an operational advantage.
Ellipsia supports companies through this transformation from end to end: from the audit of legal and technical dependencies to the definition of the IT master plan, from the catalogue of sovereign services to the steering of change management. Talk to our consultants →
Glossary
ACPR — Autorité de Contrôle Prudentiel et de Résolution. The French supervisory authority for banks and insurers, attached to the Banque de France.
ANSSI — Agence Nationale de la Sécurité des Systèmes d’Information. The French national authority for cybersecurity.
API — Application Programming Interface. A technical interface that allows two software systems to communicate with each other.
ECB — European Central Bank. The institution responsible for the monetary policy of the euro area and the prudential supervision of large banks.
CLOUD Act — Clarifying Lawful Overseas Use of Data Act. A US federal law (2018) allowing the authorities to compel US technology providers to hand over data stored abroad.
DORA — Digital Operational Resilience Act. A European regulation (in force since January 2025) imposing digital operational resilience requirements on financial entities, including ICT risk management and oversight of third-party providers.
EBA — European Banking Authority. The European regulator responsible for the prudential supervision of the banking sector.
ESAs — European Supervisory Authorities. The group made up of the EBA, EIOPA (insurance) and ESMA (financial markets).
IaaS / PaaS / SaaS — Infrastructure as a Service / Platform as a Service / Software as a Service. Three cloud service models, from the lowest level (raw infrastructure) to the highest (turnkey application).
NIS2 — Network and Information Security Directive 2. A European directive extending cybersecurity obligations to a larger number of sectors and entities, with tougher penalties.
SDK — Software Development Kit. A set of software tools provided by a vendor to integrate its services into other applications.
TCO — Total Cost of Ownership. An assessment method that includes all the direct and indirect costs of a solution over its lifetime.
ICT — Information and Communication Technology. The term used in European regulations (notably DORA) to refer to all IT and communication systems.
References
[1] Consultancy.eu, “Data sovereignty goes beyond geography, it’s about privacy, control and trust”
[2] Eliatra, “The Sovereignty Illusion: Why AWS’s European Cloud Cannot Escape US”
[3] Impossible Cloud, “How the CLOUD Act Challenges GDPR Compliance for EU Business”
[4] Village de la Justice, “L’utilisation de Microsoft 365 n’est pas conforme au RGPD” (in French)
[5] Deloitte France, “Le Règlement européen sur la résilience opérationnelle numérique (DORA)” (in French)
[6] NautaDutilh, “Counting down to DORA, governance of ICT risks and board member responsibility”
[7] Banque de France, “Rapport sur le cloud bancaire : état des lieux et perspectives” (in French)
[8] XBRL.org / EBA, “EBA finds progress in ICT risk supervision as DORA reshapes the landscape”
[9] European Banking Authority, “Annual Report 2024”
[10] Gartner, quoted by OpsWerks, “83% of data migration projects fail or exceed budgets”
[11] McKinsey, quoted by OpsWerks, “85% of cloud migrations fail to meet financial goals”
[12] LeMagIT, “Des grands groupes français s’entendent pour cartographier leurs dépendances IT” (in French)
[13] The Macro Insider, “La dépendance structurelle de l’Europe au cloud américain” (in French)
[14] BT Blue, “Cloud Souverain : Le guide pour réussir la migration” (in French)
[15] Ekialis, “Réussir la cartographie de votre système d’information en 6 étapes” (in French)
[16] GeekyAnts, citing McKinsey, “Cloud Cost Optimization: How to Migrate Without Breaking the Bank”
[17] French Senate, “Rapport sur la souveraineté numérique” (in French)
[18] Solutions Numériques, “Les plateformes collaboratives souveraines alternatives” (in French)
[19] Nextcloud, “Digital sovereignty momentum France”
[20] European Purpose, “European Alternatives to Microsoft 365 (2026)”
[21] Wire, “State of digital sovereignty in Europe”
[22] Nimeops, “NIS2, Cloud Act et FISA : l’urgence de la souveraineté numérique” (in French)
[23] MonScoreSecurite, “NIS2 et DORA : sanctions et obligations pour les PME en 2026” (in French)
[24] Xavier Minali, “Analyse du marché des logiciels ERP industriel en France 2026” (in French)
[25] OO2, “NIS 2 et DORA : Êtes-vous prêt pour les nouvelles directives européennes en 2026” (in French)
[26] Cloud-computing.developpez.com, “Cloud, données et souveraineté : les institutions européennes abandonnent les fournisseurs américains” (in French)
[27] Juwa, “Outils Audit IA : automatiser l’analyse et la conformité” (in French)
[28] Eleven Labs, “Audit de code source automatisé” (in French)
[29] OpenAI, “Data Processing Addendum”
[30] JISC / National Centre for AI, “Microsoft Copilot and Data Protection: an Update”
[31] CNIL, “Adéquation des États-Unis : les premières questions-réponses” (in French)
[32] OVHcloud, “Reference Architecture: Deploy Mistral Large Model in Sovereign Environment”
[33] ANSSI, “Security Recommendations for a Generative AI System”
[34] Rouge Hexagone, “IA finance : conformité, cas d’usage et régulation” (in French)
[35] SFR Business, “Télétravail : Bilan et perspective 2026 en France” (in French)
[36] ElectroIQ, “Shadow IT Statistics You Need to Know Now (2026)”
[37] Daniel Lock, “30+ Change Management Statistics in 2024”
[38] CEUR Workshop Proceedings, “Shadow IT risk analysis in public cloud infrastructure”
[39] Worklytics, “2025 Benchmarks: Employee AI Adoption by Department & Industry”