Definition
A 2018 US law allowing US authorities to demand access to data held by American companies, wherever it is hosted in the world.
The Clarifying Lawful Overseas Use of Data Act (Cloud Act), adopted in 2018, allows US authorities to compel any company subject to United States jurisdiction to hand over the data it holds or controls, including when that data is stored in datacenters located in Europe.
The direct consequence for European companies: choosing the “Europe” hosting region with an American provider (OpenAI, Microsoft, Google, Anthropic…) does not legally protect the data. Only an operator not subject to US law, or a deployment on your own infrastructure, structurally eliminates this exposure.
A French company stores its contracts with a US provider, in a data centre located in Paris. If a US authority requests them as part of an investigation, the provider can be required to hand over that data, even though it sits in France.
When choosing a host or an AI tool for sensitive data: what matters is the nationality of the provider, not only the location of the servers.
Is hosting your data in Europe enough to escape the Cloud Act?
No. The law targets companies subject to US law, wherever their servers are. To stay out of its reach, you need a European provider with no dependency on a US company, or hosting on your own premises.
All AI models, deployed on your infrastructure, with your documents connected.