True EU sovereignty is not a data-center pin on a map. It is an architectural decision covering European data, European compute, European models, and zero extraterritorial legal exposure. Without control at every layer, the claim of sovereignty is incomplete and potentially misleading.
Many providers currently market EU residency while quietly routing inference through US-hosted frontier models. This practice leaves sensitive data within reach of US extraterritorial law, regardless of where the initial server is located. The gap between residency and sovereignty exposes organizations to legal risk they often do not see until it is too late.
This is not hypothetical. In May 2026, the Dutch outlet Vrij Nederland reported that Microsoft had shared the names of civil servants at two Dutch regulators, the Authority for Consumers and Markets and the Data Protection Authority, with the US House of Representatives, with the names left unredacted in emails and meeting documents. The officials were reportedly working on enforcing the EU's Digital Services Act. Microsoft is accused rather than proven to have acted improperly, and the agencies are investigating, but the Dutch government took it seriously enough that the State Secretary for Digital Economy and Sovereignty raised it directly with the US ambassador. It is the residency-versus-jurisdiction gap this series is about, playing out with a named provider and a government's own regulators.
The mechanism behind it is the US Clarifying Lawful Overseas Use of Data Act, the CLOUD Act, enacted in 2018 (Public Law 115-141, codified at 18 U.S.C. section 2713). It compels US-headquartered providers to produce data they control in response to valid US legal process, wherever that data physically sits. We covered how that plays out across the stack in Part 1. This article shows how we engineered our way out of it, one step at a time, building technical and legal realities directly into the stack.