US law and data stored in Europe

Many organisations use cloud services with servers in Europe, and for good reasons. The services are mature and quick to adopt. Yet the storage location alone does not determine which laws apply to the data. If the supplier is a US company, or is controlled by one, US authorities can in some circumstances require it to hand the data over.

These laws serve criminal investigations and national security, and each has its own limits and oversight. For an organisation in Europe, the practical question is which data belongs where. AI has made that question more pressing, because a prompt to an AI assistant often carries passages from the documents behind the answer.

The US laws involved

The CLOUD Act was passed in 2018. It requires a provider of communication or cloud services to disclose data in its possession, custody or control when a US court order demands it, whether the data is held inside or outside the United States. The law is used in criminal investigations and is covered in What the CLOUD Act means for your data.

FISA Section 702 allows US intelligence agencies to collect communications from people outside the United States with the help of US providers. A special court approves the framework once a year, and no individual order is needed for each person. The provision lapsed in June 2026. According to the Congressional Research Service, collection continues under the approvals granted in March 2026, which run for a year. The position may change, and FISA 702 and what intelligence laws mean for the cloud sets it out with dates.

What the EU has said

In 2020 the EU Court of Justice struck down the framework then used for transfers to the United States, in the ruling known as Schrems II. The United States has since introduced new limits and a new route for complaints, and in 2023 the European Commission adopted the EU-US Data Privacy Framework. The EU General Court dismissed a challenge to it in September 2025. That judgment is under appeal, but the framework applies today. Its scope is the subject of Is the EU-US Data Privacy Framework enough?

In 2019 the European Data Protection Board and the European Data Protection Supervisor concluded that disclosure based solely on a CLOUD Act order generally lacks a legal basis under the GDPR. A supplier subject to both regimes can therefore be caught between two laws, while responsibility for the data remains with you as the customer.

The position in Sweden

Swedish public bodies are bound by the Public Access to Information and Secrecy Act. Since 2023 an authority may pass confidential information to a supplier that only processes or stores it technically, unless doing so would be inappropriate. The assessment can take into account where the data is handled and which sub-suppliers can reach it. In May 2026 the government adopted a cloud policy for public administration that emphasises control over data and the ability to change supplier. The rules are covered in Cloud services and confidentiality in the public sector.

Law firms, healthcare providers, insurers and others bound by professional secrecy must follow the GDPR rules on third-country transfers as well as their own confidentiality rules. For them too, it comes down to who can reach the data, and under which country’s law.

US providers now also offer European cloud services with operations and staff in the EU, which reduces several risks. Whether a US parent company is still considered to control the data has not been tested in court. That question is taken up in Is a sovereign cloud enough?

What you can do

Start by mapping which data is sensitive and where it is processed today, including in the AI services your staff use. Much of it fits well in a standard cloud service, while the most sensitive data may need a different arrangement. Ask suppliers who owns the company, where it operates and which sub-suppliers can reach the data. Decide in advance what you would do if the conditions for transfers to the United States changed. Data sovereignty brings these questions together.

How it works in iSearch

iSearch can run on your premises, with the whole chain in your own environment. The software, the documents and the language model then sit together, with no public AI services.

iSearch can also be hosted by us. The hosting runs in Sweden, by a Swedish company with no US owners and no US-owned sub-suppliers for the hosting. Every customer gets a separate environment that is never shared with others. Hosted by us, iSearch can also run entirely without public AI services, with the language model in the Swedish hosting. Then nothing leaves Sweden or our control.

If you still choose to use public AI services, the data sent there leaves that control, and the laws described here can apply. Your data is never used to train models, and you can move between hosting with us and on your premises.

Read more about choosing between on-premises and cloud, about security or book a walkthrough.