May 29, 2026
The New EU Cloud Rules Only Bind Governments. The Reason Behind Them Binds You Too.
On 27 May 2026 the European Commission presented its Tech Sovereignty Package, including the Cloud and AI Development Act, restricting sensitive public-sector data from US hyperscalers. The restrictions stop at the public sector, but the underlying issue, namely US CLOUD Act jurisdiction over American-incorporated providers regardless of where data is stored, applies to every regulated business. This article explains the legal mechanism, the Dutch precedent blocking the Kyndryl and Solvinity acquisition, the trap of overcorrecting toward immature European providers, and the practical steps CIOs should take around data classification, portability, hybrid and multi-cloud design, and encryption key custody.