Data Sovereignty Concerns Rise

Microsoft's Own Lawyer Lit the Fuse

On June 10, 2025, Anton Carniaux, Microsoft France's Legal Director, testified before the French Senate. Senators asked directly: can you guarantee French data will not reach U.S. authorities? His answer:

Microsoft's Own Lawyer Lit the Fuse

On June 10, 2025, Anton Carniaux, Microsoft France's Legal Director, testified before the French Senate. Senators asked him directly: can you guarantee French data will not reach U.S. authorities? His answer: "No, I cannot guarantee that" it-daily.net. That single sentence collapsed years of reassurances from Microsoft about its EU Data Boundary protections.

The damage did not stop there. In May 2026, the Chief Prosecutor of the International Criminal Court was briefly cut off from Microsoft services after a U.S. sanctions order openPR. European officials called it proof that U.S. cloud platforms could be "weaponized" at any moment. France's government responded in April 2026 by ordering all ministries to eliminate "extra-European digital dependencies" by autumn 2026 The Geopolitical Economist.

The Shared Responsibility Model Is Broken

For years, cloud security worked on a "shared responsibility" model: providers secure the infrastructure, customers secure their data. But MSSP Security Consulting founder Richard K. Stephens says that framework has collapsed. "The shared responsibility model is broken," Stephens said. "MSSPs are now the only neutral party qualified to audit where data lives" openPR. The problem is no longer a technical one — it is a legal one that no firewall can fix.

MSSP's analysis notes that roughly 99% of cloud security failures still come from customer misconfigurations — weak passwords, poor identity governance, and exposed storage buckets openPR. But when the failure is jurisdictional, liability is shifting to the provider. Organizations now need a third-party auditor to map exactly where data sits, who can legally touch it, and which tools comply with local law.

Sovereign Cloud Spending Explodes as Workloads Head Home

The money is moving fast. European sovereign cloud spending nearly doubled from $7 billion in 2025 to $12.5 billion in 2026, and analysts forecast another near-doubling to $23.1 billion in 2027 CIO Dive. Globally, sovereign cloud infrastructure spending will hit $80 billion in 2026 — a 35.6% jump in a single year. Cloud Security Posture Management, the tool used to track where data lives and whether it complies with local rules, is the fastest-growing security segment of all, projected to triple from $4.7 billion to $16.2 billion by 2030 at 33.4% annual growth openPR.

About 20% of workloads are now moving back from global public clouds to local or on-premises providers, reversing a decade of cloud-first thinking openPR. France is turning to alternatives like OVHcloud and T-Systems. Notably, North America itself accounts for 44% of the global sovereign cloud market — meaning this is not just a European revolt against U.S. tech, but a worldwide reckoning with who controls data and under whose laws openPR.

Microsoft Pushes Back, But Critics Call It a Smokescreen

Microsoft has not given up without a fight. The company, led by President Brad Smith, offers what it calls a "contractually binding court-fight clause" — a promise to sue the U.S. government rather than hand over European data without a fight openPR. It launched localized sovereign cloud products in Europe in early 2025, alongside AWS, pitching them as the best of both worlds: American innovation with European legal control CIO Dive.

Privacy experts are unconvinced. Analyst Davi Ottenheimer points out that Microsoft's own transparency reports show the company already honors hundreds of content warrants for data stored outside the U.S. openPR. For institutions like École Polytechnique, handling sensitive research and personal data, that track record makes Microsoft's pledges hard to trust — and the suspension hard to reverse.