Microsoft now lets you hold the root key and has a European partner watch every engineer who visits your data. The CLOUD Act doesn’t ask who watches the visits. It asks who has custody, and only Microsoft can argue back.
Sovereign AI | theCUBE Research | Amit Eyal Govrin | October 2026
Sixteen months, one new word
On Tuesday, Microsoft published “Advancing digital sovereignty with greater control and choice,” a post by Douglas Phillips, president and CTO of Microsoft Specialized Clouds.[1] It is long, careful, and the most serious thing Microsoft has shipped on sovereignty to date.
Run the calendar back to June 16, 2025. Judson Althoff announced Data Guardian, promising that remote engineer access would be “approved and monitored by European resident personnel in real time and will be logged in a tamper-evident ledger.”[2]
Sixteen months later, Data Guardian is “rolling out,” for EU and EFTA customers only. The tamper-evident ledger now has a name, Production Touch Ledger, and a “phased rollout.”[1] One word changed along the way. The oversight is no longer done by “European resident personnel.” It is done by “a trusted EU partner.”[1][2]
That is an upgrade, and I’ll say so below. But search the post for “CLOUD Act.” Search it for “jurisdiction,” “legal process,” or “government access.”
Zero results.
That is the whole edition. Microsoft has built a very good system for supervising who visits your data. The question it doesn’t answer is who has custody of it.
Credit where it’s earned
Let’s give credit first, because there is real engineering here, and pretending otherwise cheapens the rest of the argument.
External key management with Azure Managed HSM is now generally available.[1] Your root key can sit in hardware you own, on your premises or with a third party you pick. That matters more than anything else in the post, and I’ll come back to why.
The oversight moved from Microsoft’s own people to a partner. A European company watching Microsoft engineers is better than Microsoft watching Microsoft engineers. That is not a cosmetic change, and I’d rather praise it than pretend I didn’t notice.
The Local estate is real. SQL Server on Azure Local is generally available, connected and disconnected. GitHub Enterprise Local and Foundry Local are due to reach general availability at Ignite, which runs November 17 to 20 at the Moscone Center in San Francisco.[1][3] Confidential VMs on Azure Local are generally available too. A Foundry you can run with the cable pulled is exactly what I’ve been asking hyperscalers to sell.
And in April 2025, Brad Smith promised that if any government ordered Microsoft to suspend its European cloud operations, it would “promptly and vigorously contest such a measure using all legal avenues available, including by pursuing litigation in court.”[4] That is in writing, and it counts.
Then you read the statute.
The custody clause
Here is the law the post never mentions. Under 18 U.S.C. § 2713, a US provider must disclose data “within such provider’s possession, custody, or control, regardless of whether such communication, record, or other information is located within or outside of the United States.”[5]
Read that twice. Possession, custody, or control. Not location. Not who is watching the session.
Now the part nobody puts in the sovereignty deck. The CLOUD Act does include a way to push back: a motion to quash or modify, under § 2703(h).[6] Here is who can file it: the provider. Not you. Not your ministry. Not your regulator. And the provider can file it only for content, only within 14 days, only if the customer is not a US person, and only if disclosure would risk breaking the laws of a “qualifying foreign government.”[6]
A qualifying foreign government is one whose CLOUD Act executive agreement with Washington has entered into force. As far as the public record shows, two countries have one: the United Kingdom and Australia.[7][8] EU talks resumed in 2023 and have since stalled.[7][8]
So the parent company holds custody, and the parent company is the only one with standing to contest it. If you’re in Frankfurt, Paris or The Hague, the legal remedy for your data belongs to Redmond. Your role in the hearing is to be notified, if you’re lucky.
Supervised visits. Full custody. Different parents.
Microsoft has tried supervised visits before
This is not the first time Microsoft has tried to fix an access problem by putting a supervisor in the room.
On July 15, 2025, ProPublica reported that China-based Microsoft engineers were supporting Defense Department cloud systems, under the supervision of US “digital escorts.”[9] The escorts held security clearances. Many reportedly lacked the technical depth to judge the work they were watching. One told ProPublica: “We’re trusting that what they’re doing isn’t malicious, but we really can’t tell.”[9]
Three days later, Microsoft said no China-based engineering teams were working on Defense Department cloud services anymore. Defense Secretary Pete Hegseth wrote that foreign engineers “should NEVER be allowed to maintain or access DoD systems.”[10]
I’m not saying Data Guardian is that program. It isn’t. The partner is European, the scope is narrower, and every touch goes in a ledger. But the lesson from the escort story is the one this post skips: supervision is only as strong as the supervisor’s authority to say no. Microsoft’s post tells you the partner will oversee access. It doesn’t say what the partner does when the request comes with a US warrant attached.
A supervisor who can’t say no is a witness.
The two receipts
Microsoft France already answered the custody question under oath. On June 10, 2025, Senator Dany Wattebled, the inquiry’s rapporteur, asked Anton Carniaux, Microsoft France’s director of public and legal affairs, to guarantee under oath that French citizens’ data entrusted to Microsoft through Ugap, the state purchasing agency, would never be handed over on a US government injunction without the explicit agreement of French authorities. His answer: “Non, je ne peux pas le garantir” (No, I cannot guarantee it), adding that it had never happened yet.[11]
That was an honest answer. A ledger doesn’t change it. A ledger timestamps it.
The second receipt came from a client, not a regulator. On October 5, the Dutch State Secretary for Finance, Eelco Eerenberg, told parliament that the Tax and Customs Administration, Customs and the Benefits agency are choosing “een on-premises oplossing in combinatie met open source” (an on-premises solution combined with open source).[12] Mail and calendar move on-premises in 2027. European open-source storage and collaboration follow in 2027 and 2028.[12]
The migration had been paused in July, after the government’s ICT review board, the AcICT, delivered its advice in June.[13] The board reportedly warned of “unacceptable vendor lock-in” and said a workable exit strategy was missing.[14] By then, about 5,000 staff were reportedly already on the new platform, out of a workforce of roughly 47,000.[14][21]
In October 2025, the previous Dutch cabinet had called Microsoft 365 “de enige realistische optie” (the only realistic option).[15] It took one year to discover a second option. It will take two more to finish moving to it.
The Dutch didn’t leave because Microsoft’s engineering was bad. They left because nobody had priced the door.
The five pillars, under pressure
Same test as always. The seat I’m grading from is a European enterprise or ministry on Microsoft’s public sovereign cloud, with Data Guardian and customer-held keys switched on. I’m grading the dependency, not the company.
01 Territorial
The question. Where do your data and compute physically reside, at rest and in motion?
The story. EU regions, plus oversight by an EU partner for EU and EFTA customers.[1]
Under pressure. A ministry needs a guarantee that data never leaves the EU. It gets one, for the data.
Verdict. Pass. The data stays home. The custody papers are filed in Washington.
02 Operational
The question. Who runs it, who holds the keys, who gets paged, and who can pull the plug?
The story. Just-in-time access, Customer Lockbox, Data Guardian, Production Touch Ledger, and keys in your own HSM.[1] This is the best operational package any hyperscaler has put on a public cloud. It also arrives sixteen months after it was announced, and it is still rolling out.[1][2]
Under pressure. In February 2025, Washington sanctioned the ICC’s chief prosecutor. In May, AP reported, citing ICC staffers, that Microsoft canceled Karim Khan’s email address and he moved to Proton Mail.[16] Microsoft’s position is that it disconnected the sanctioned official while “at no point” ceasing or suspending its services to the court.[17] Carniaux said the same under oath.[11] Both things can be true. Brad Smith’s pledge covers an order to suspend Microsoft’s European operations.[4] Khan wasn’t the operations. He was one account. On October 31, 2025, the ICC confirmed it is replacing Microsoft Office with openDesk, open-source software from Germany’s ZenDiS.[18]
Verdict. Partial. You get a receipt for every visit. You don’t get a veto.
03 Technological
The question. Can you audit it, fork it, self-host it?
The story. Self-host, increasingly yes: Azure Local, SQL Server, Foundry Local, GitHub Enterprise Local, disconnected operations in preview.[1] Audit, partially, through the ledger. Fork, no. It is Microsoft’s stack under Microsoft’s license, in your building.
Under pressure. Microsoft changes its licensing terms for Azure Local. You own the racks. You don’t own the next version.
Verdict. Partial. Hosting it yourself is not the same as owning it.
04 Legal
The question. Which court can compel the entity that holds your data, and who gets to argue back?
The story. On the public cloud: a US court, under § 2713, and only Microsoft can move to quash, under conditions most of Europe doesn’t meet.[5][6][7] Brad Smith’s pledge to litigate is real and in writing.[4] But a pledge is a contract term. I’ve written before that contracts lose to statutes. Nothing in this post changes that.
The real answer is in the post itself: national partner clouds, including Bleu Cloud in France and Delos Cloud in Germany, run by European companies on licensed Microsoft technology.[1] That model can change who has custody. Bleu, a Capgemini and Orange venture, is still awaiting its SecNumCloud qualification and now targets the end of 2026.[19] I found no public confirmation that Delos, the SAP subsidiary, is generally available in production yet.[20]
Under pressure. A US warrant for a European bank’s data arrives on a Friday. The 14-day clock starts. Whether you even hear about it depends on the order, and on Microsoft.
Verdict. Fail on the public cloud. Pending on the partner clouds, and pending is not a grade.
05 Financial
The question. Can you leave, on your timeline, at a survivable cost?
The story. The Dutch just did the arithmetic in public. The exit is on-premises plus open source, staged over 2027 and 2028. Records management features that came with Microsoft 365 won’t make the move, and the administration is still assessing how to replace them.[12][21]
Under pressure. Your board asks what leaving costs. Your exit plan is a slide that says “phase 2.”
Verdict. Breaks, unless you price it before you need it. The Dutch priced it after.
One pass. Two partials. And the two pillars that always break first, broken. Legal and Financial, as usual, are where the custody fight gets decided.
The executive TCO
Three line items, none of which show up on the invoice:
- The oversight premium. Sovereign controls and partner oversight are a new layer of cost. Ask what Data Guardian costs per tenant, and whether the partner’s fee sits in your contract or Microsoft’s.
- The archive you can’t carry. Some features only exist in the cloud version. The Dutch are losing planned records management features on the way out.[12][21] Put a number on rebuilding it.
- The migration you postponed. Every year on a platform you can’t leave adds to the bill for leaving. The Dutch moved 5,000 people in before anyone priced the way out.[14][21]
Same baseline-and-burst strategy as always, applied to custody instead of compute. Put the crown jewels (identity, audit logs, agent memory and context, evals and the control plane) where you or a European operator holds custody. Burst to the public cloud for everything you’d survive seeing in a US court filing. Own the crown jewels. Rent the edges.
What to do Monday
- Ask your account team one question in writing. Which legal entity has possession, custody or control of my tenant’s data, and which court can compel it? If the answer takes a paragraph, it’s the wrong answer.
- Take the keys, then pull them. External key management is generally available.[1] Move your root key into your own HSM, then run a drill where you revoke it. For once, the kill switch is yours. Test it.
- Ask what the partner can refuse. Data Guardian’s partner oversees access.[1] Ask whether it can block access, and what happens when the request is a US legal order instead of a support ticket.
- Run the 72-hour drill. Microsoft is not down. Microsoft is prohibited. Can you keep operating? If the answer is “we’d find out,” your exit strategy is a surprise invoice.
- Price the Dutch exit. On-premises plus open source, staged over two years, minus the features you lose.[12] Do the math now, while it’s a planning exercise and not a press release.
- Track the partner clouds. If Bleu qualifies by year-end, French buyers get a real custody option.[19] Write the date into your risk register.
So who has custody?
Microsoft did something genuinely useful this week. It made every engineer’s visit to your data visible, logged, and supervised by a European company. AWS will spend Saturday running its European sovereign cloud cut off from its global network, and will grade its own exam.[22] The hyperscalers are competing on supervision now. That is progress, and I’ll say so.
But supervision is a visiting arrangement. Custody is a legal fact. The statute asks who holds your data, not who watches the session. Only the holder can argue back, and the holder is in Redmond.
Until the custody papers change, Europe holds the keys and the visitor log. Redmond still has the kid.
Amit
Amit Eyal Govrin is lead analyst for sovereign AI at theCUBE Research and CEO of Agentcy Labs, which designs and builds sovereign AI platforms for enterprises and governments. His research for theCUBE Research is conducted under theCUBE Research’s editorial standards and is not sponsored or directed by Agentcy Labs. Agentcy Labs may hold commercial relationships with vendors covered in this research.
References
[1] Microsoft, Douglas Phillips, “Advancing digital sovereignty with greater control and choice,” Oct 20, 2026. Link
[2] Microsoft, Judson Althoff, “Announcing comprehensive sovereign solutions empowering European organizations,” Jun 16, 2025. Link
[3] Microsoft, Microsoft Ignite 2026 event page (Nov 17–20, 2026, Moscone Center, San Francisco). Link
[4] Microsoft On the Issues, Brad Smith, “Microsoft announces new European digital commitments,” Apr 30, 2025. Link
[5] 18 U.S.C. § 2713, Required preservation and disclosure of communications and records. Link
[6] 18 U.S.C. § 2703(h), Comity analysis and disclosure of information regarding legal process seeking contents of wire or electronic communication. Link
[7] Cross-Border Data Forum, Peter Swire, “CLOUD Act Agreements, EU-US e-Evidence Negotiations and Beyond,” Apr 8, 2024. Link
[8] Lawfare, Jennifer Daskal, “Unpacking and Updating the CLOUD Act,” Mar 6, 2026. Link
[9] ProPublica, Renee Dudley, with research by Doris Burke, “A Little-Known Microsoft Program Could Expose the Defense Department to Chinese Hackers,” Jul 15, 2025. Link
[10] ProPublica, Renee Dudley, “Microsoft Says It Has Stopped Using China-Based Engineers to Support Defense Department Computer Systems,” Jul 18, 2025. Link
[11] Sénat, commission d’enquête sur la commande publique, compte rendu, hearing of Anton Carniaux and Pierre Lagarde (Microsoft France), Jun 10, 2025. Link
[12] Tweede Kamer, letter from the State Secretary for Finance, “Toekomstbestendigheid Belastingdienst,” Oct 5, 2026. Link
[13] Tweede Kamer, State Secretary for Finance, “Bestuurlijke reactie op AcICT-advies over het programma Modernisering kantoorautomatisering uitrol M365 binnen de Belastingdienst,” Kamerstuk 31 066, nr. 1550, Jul 9, 2026. Link
[14] Dutch IT Channel (Redactie), “AcICT: geen Microsoft 365 in publieke cloud voor Belastingdienst,” Jul 10, 2026. Link
[15] Rijksoverheid, “Belastingdienst moderniseert digitale werkplek,” Oct 2, 2025. Link
[16] AP via PBS NewsHour, Molly Quell, “Trump’s sanctions on ICC’s chief prosecutor have halted tribunal’s work, officials and lawyers say,” May 15, 2025. Link
[17] Microsoft Danmark, “Kommentar fra Microsoft vedr. ICC” (Statement from Microsoft regarding the ICC), May 28, 2025. Link
[18] EJIL:Talk!, Jennifer Tridgell, “Justice Recoded? Why It Matters that the International Criminal Court Embraced Open-Source Software and Ditched Microsoft,” Nov 20, 2025. Link
[19] Next, Sébastien Gavois, “SecNumCloud : Bleu vise désormais une qualification pour la fin d’année,” Oct 9, 2026. Link
[20] Delos Cloud, news. Link
[21] The Register, Richard Speed, “Dutch tax office ditches Microsoft 365 cloud for on-premises alternative,” Oct 7, 2026. Link
[22] AWS Security Blog, Stéphane Israël, “AWS European Sovereign Cloud: Demonstrating an independent operation,” Sep 28, 2026. Link
