FISA 702 and what intelligence laws mean for the cloud

The CLOUD Act is used in criminal investigations and requires an order in each case. Intelligence gathering works under different rules and oversight, and it is just as much part of the picture on US law and data stored in Europe.

What FISA 702 is

FISA Section 702 is part of the US Foreign Intelligence Surveillance Act. It authorises US intelligence agencies to collect communications of people who are not US persons and are reasonably believed to be outside the United States. Collection relies on US providers of communication services, which can be directed to assist.

Section 702 works through annual approval. A special court, the FISA Court, approves the framework for the programme and the rules to be followed each year. No separate order is needed for each person targeted. It is this arrangement that the EU has examined.

In April 2024 the provision was extended by new legislation, which also widened the range of providers that can be directed to assist. It now includes other service providers with access to equipment on which communications are transmitted or stored.

Where things stand in autumn 2026

The provision was extended in stages during the year. On 18 April 2026 Congress extended it to 30 April, and on 30 April to 12 June 2026. Congress then did not agree on a further extension, and the provision lapsed on 12 June 2026.

According to the Congressional Research Service, orders and directives already issued remain in force until they expire. The FISA Court approved the programme for a year in March 2026, so it can continue until March 2027. If Congress has not renewed the provision by then, the government will generally need a separate court order for each target, under another part of the law. This reflects the position on 18 October 2026.

EO 12333 and the EU’s assessment

Alongside FISA sits Executive Order 12333 from 1981. It governs other US intelligence activity, including collection outside the United States, and is not subject to review by any court.

In the Schrems II ruling in 2020, the EU Court of Justice found that surveillance under 702 and EO 12333 was not limited to what is strictly necessary and that people in the EU lacked effective remedies. The United States responded in 2022 with Executive Order 14086, which requires intelligence gathering to be necessary and proportionate and set up a court to hear complaints from people in the EU. The order underpins the current framework, discussed in Is the EU-US Data Privacy Framework enough?

What it means for you

Section 702 does not depend on anyone being suspected of wrongdoing. The question is which providers can be directed to assist, and that turns more on who the provider is than on where its servers are. Factor that in when deciding where your most sensitive data should sit.

So find out whether the provider, or any company among its sub-suppliers, is a US provider of communication or cloud services. Because the position keeps shifting, it is also reasonable to ask how the provider tracks developments on 702 and what they mean for your contract. Check, too, which data is passed on to other services, such as public AI services.

For the most sensitive data, local AI keeps both documents and prompts inside your own environment, however the provision develops.

How it works in iSearch

iSearch can run on your premises, with the whole chain in your own environment and no public AI services. The data then stays with you.

iSearch can also be hosted by us. The hosting runs in Sweden, by a Swedish company with no US owners and no US-owned sub-suppliers for the hosting. Every customer gets a separate environment. Hosted by us, iSearch can run entirely without public AI services, with the language model in the Swedish hosting.

If you choose to use public AI services, the reasoning above can apply to the data sent there. Read more about offline AI in your own environment or book a walkthrough.