Is a sovereign cloud enough?

Several providers have responded to the questions raised by US law and data stored in Europe with a sovereign cloud. For the public sector, it ties in closely with the rules described in cloud services and confidentiality in the public sector.

What a sovereign cloud is

The term is used in several ways. It usually means a cloud service whose operations, staff and access are within the EU, run by a European company with its own governance. US providers offer such services today, and in January 2026 one of the largest opened a European cloud operated from Germany. There are also European providers and shared clouds within the public sector.

A sovereign cloud reduces several risks. Day-to-day operations keep the data in the EU, support is based here and contracts can be adapted to European requirements. For much data it is a good choice.

The open question

The CLOUD Act covers data in a provider’s possession, custody or control. Whether a US parent company is considered to control data held by a European subsidiary has not yet been tested in court, and there is no settled answer today. The question is typical of extraterritorial law, where ownership and control can weigh as heavily as location.

At a French Senate hearing in June 2025, a representative of a large US provider was asked whether he could guarantee that data would never be passed to US authorities without French approval. He said he could not guarantee it, but that it had never happened. He also described how the company reviews requests and challenges those that are not well founded. The same question can be put to any provider, wherever it is based.

The same question applies to AI

Storage and operations in Europe are not sufficient if prompts to an AI assistant are passed on to a public AI service elsewhere, since prompts often carry passages from the documents. Where the language model runs, and who operates it, therefore weighs as much as where the documents are stored. That applies whichever cloud you choose. A service can keep everything in Sweden and still pass prompts on.

Making the choice

eSam distinguishes between public, shared and private clouds and notes that other countries’ laws can have an extraterritorial effect on public clouds. The Swedish government’s cloud policy from May 2026 emphasises control over data and the ability to change supplier. Both offer a useful starting point.

With a sovereign cloud, the questions are mainly about the chain of ownership. Ask the provider who owns the company that runs the service, and who owns that company in turn. Then ask who decides on governance and access, where the language model in the AI features runs and how you can move your data if circumstances change.

Much data fits well in a sovereign cloud. For the most sensitive, data sovereignty in the wider sense, and an on-premises installation, may be the better fit. The whole series is gathered in the overview, US law and data in Europe.

How it works in iSearch

iSearch can run on your premises, with the whole chain in your own environment and no public AI services. The software, the documents and the language model then sit together.

iSearch can also be hosted by us. The hosting runs in Sweden, by a Swedish company with no US owners and no US-owned sub-suppliers for the hosting. Every customer gets a separate environment. Hosted by us, iSearch can run entirely without public AI services, with the language model in the Swedish hosting. Then nothing leaves Sweden or our control.

If you choose to use public AI services, the questions above apply to the data sent there. Read more about on-premises or cloud, the procurement checklist or book a walkthrough.