Accusation Audit

Digital Sovereignty Package vs. CLOUD Act Exposure

Standard: EU Digital Sovereignty commitments; May 2026 Tech Sovereignty Package

VERDICT: FAIL · Published · Updated

The European Commission's Tech Sovereignty Package — its flagship digital independence initiative — counts US-owned "sovereign cloud regions" toward European sovereignty targets. AWS European Sovereign Cloud, Oracle EU Sovereign Cloud, and IBM Sovereign Core all qualify under the package's definitions despite being owned by American parent companies fully subject to the US CLOUD Act.

The CLOUD Act allows the US government to compel American companies to produce data stored anywhere in the world, including in EU-incorporated subsidiaries, without requiring a mutual legal assistance treaty. A German legal entity staffed by German employees operating an AWS data centre does not change this jurisdiction. Jurisdiction follows the parent company. The parent company is American. See the Ownership-Control Criterion.

The package was written on terms that the hyperscalers themselves had been lobbying for in Brussels for three years. It produces vocabulary. It does not produce sovereignty. See Sovereignty Washing.

The test is simple: if a US court issues a CLOUD Act order tomorrow against data held in the European Sovereign Cloud of any American hyperscaler, the data is produced. Nothing in the Tech Sovereignty Package changes that outcome.

The charge: Europe's flagship sovereignty package launders American cloud dependency as European achievement.

Evidence

  • EC Tech Sovereignty Package, May 2026
  • AWS European Sovereign Cloud product documentation
  • CLOUD Act (Clarifying Lawful Overseas Use of Data Act), US, 2018
  • OneNext 2026 Brussels cloud summit: "Many AI factories recreating dependency instead of sovereignty" — OpenNebula VP
  • Gaia-X CTO: "No US company can guarantee the US government will never access your data"
  • Belgian DPA criminal proceedings against Temu, May 2026 — enforcement teeth exist but are not applied to jurisdiction question

All audit entries are living documents. Updates are published with date stamps. Verdicts may be revised as evidence develops. Predictions are resolved — confirmed, denied, or extended — at the stated resolution date.