CLOUD Act

Passed in the United States in 2018, the CLOUD Act allows the US administration to demand data held by a company under American jurisdiction, wherever that data is physically stored. Storage location, the usual reassurance of a European data centre, is not the operative variable. The jurisdiction of the parent company is.

That distinction decided a contract. On 16 July 2026 Airbus selected Scaleway, the cloud and AI subsidiary of iliad, as its "cloud de confiance" for aircraft design, engineering, production and intellectual property, closing a tender opened in early January 2026 that compared ten candidates. Legal and governance guarantees, including immunity from extraterritorial legislation, were the most discriminating of the three criteria. Microsoft, Google and AWS offer capability no European provider matches across the board, and none of them can exempt a customer from the CLOUD Act.

Vincent Strubel, director general of ANSSI, made the same point from the regulator's side on 6 January 2026. SecNumCloud's requirements (a European provider by head office and capitalisation, data inaccessible to non-European subcontractors, operational autonomy) exist to hold against CLOUD Act or FISA injunctions. Strubel drew the limit himself: "SecNumCloud ne signifie pas l'absence de dépendance."

The law reappeared in the European reaction to the AI Kill Switch Act, where Virkkunen invoked it. The sovereignty argument it anchors has not stayed at the infrastructure layer: the dependency now runs through the model and the agent, and no qualification scheme yet covers that ground.