Amazon: New “European Sovereign Cloud” can’t rule out US data access
Amazon Web Services (AWS) has introduced the AWS European Sovereign Cloud, a new cloud platform specifically tailored to European requirements for data protection, data sovereignty, and regulatory compliance (more information here). AWS describes it as a physically and logically separated cloud infrastructure. It will be operated entirely within the European Union and is intended to be particularly suitable for government agencies, critical infrastructure, and heavily regulated industries.
With sovereign cloud, Amazon is striking a nerve: ongoing debates about the US CLOUD Act have placed the use of US cloud providers in Europe under particular legal scrutiny. AWS is positioning its new offering precisely here.
“The Separation Is Insufficient”
Critics have doubts about whether the announced sovereignty can currently be achieved. The core of the criticism concerns actual control over central infrastructure components. “Both the domain structure and the underlying IP infrastructure are, to our current knowledge, indirectly or directly under the control of companies based in the USA,” says Florian Schweitzer, Cloud Security Expert at Certitude Consulting, based in Vienna. This would mean that the Sovereign Cloud – despite operation in the EU – is structurally tied to US law. “The announced separation is, by current standards, insufficient.”
The US CLOUD Act obligates US companies under certain conditions to disclose data – regardless of where that data is physically stored. This conflicts with the GDPR’s high requirements for government data access, particularly with the principle that access must be foreseeable, proportionate, and legally reviewable.
As long as central technical control points do not clearly lie outside the reach of US companies, the AWS European Sovereign Cloud remains, according to Schweitzer, “fundamentally CLOUD Act-exposed.”
Criticism also comes from Alexander Windbichler, founder and CEO of Austrian cloud provider Anexia. “What is being presented here is a classic smokescreen – not genuine digital sovereignty. It is the same situation as before.”
And further: “The CLOUD Act remains fully valid. According to public records, the European company is still 100% owned by a US-based Amazon company, and there is no way around that as long as ultimate control lies outside the EU,” he writes on LinkedIn. “If Europe is serious about digital sovereignty, we must clearly distinguish between risk mitigation and sovereignty. Mixing the two may be convenient – but it is not correct.”
AWS Responds Evasively to Core Criticism
When asked, AWS emphasizes that the CLOUD Act is frequently “misunderstood.” The company argues that there is no automatic or unlimited access by US authorities, but only on the basis of strict legal standards. “Since we began statistical tracking in 2020, there have been no data requests to AWS that have resulted in the disclosure of content stored outside the USA from corporate or government customers to the US government,” Amazon states. Additionally, reference is made to a blog post addressing the CLOUD Act.
Conversely, this means: while AWS claims there have been no access requests for data stored in the EU since 2020 – this does not mean such requests cannot still come. That there is no “automatic or unlimited access” is clear, but on the basis of “strict legal standards,” it certainly can occur.
AWS promotes the new cloud as a solution for particularly sensitive data. Yet this is precisely where the conflict lies: if a legal obligation to provide access to US authorities at least theoretically persists, the availability, confidentiality, and integrity of sensitive data cannot be guaranteed with the necessary legal certainty. For public authorities or operators of critical infrastructure, this would likely be a disqualifying factor.
Aspiration and Reality at Odds
The AWS European Sovereign Cloud is a politically and economically important signal: US hyperscalers recognize the growing European need for digital sovereignty. However, the current structure only partially fulfills this aspiration. As long as central infrastructure components remain under US control and thus remain CLOUD Act-relevant, the announced separation is not legally and technically in place.
