Last week European aircraft manufacturer Airbus began moving about 70 of its most critical systems – the ones it uses to design, build and sell planes – off Amazon’s cloud and on to Scaleway, a French provider.
The company’s digital chief explained the decision in a single phrase: keeping its critical data “shielded from foreign extraterritorial laws”.
This is a story about digital sovereignty that Europe should be paying close attention to. But for Ireland, there is a further uncomfortable layer beneath: our State has built two decades of prosperity on being the US cloud’s European home. Amazon, for example, has a huge presence here.
With Airbus answering the question who can legally reach our data? in a very public way, it has now become a question that Irish boardrooms and the State can no longer put off asking.
Little evidence that Andy Burnham’s plan to devolve power to the regions will work
Food market plan scaled back and Irish deal-making hits €33.2bn
‘I do have a retirement plan, and that plan is to retire in the future. As yet, there is no money involved’
Our fixed-term mortgage is coming to an end: what are our options?
The law at the centre of it is the US Cloud Act of 2018. It allows US authorities to compel American companies to hand over data they hold, regardless of where the servers sit. Stored in Dublin is a statement about geography, not about jurisdiction.
Any lingering doubt was removed in June last year, when a senior Microsoft France executive was asked under oath, at a French Senate inquiry, whether he could guarantee that the country’s citizens’ data would never be passed to US authorities without French agreement.
His answer: “No, I cannot guarantee that.”
Nor is the risk only legal. Dependency has a commercial edge. When Broadcom bought the software firm VMware in 2023, customers across Europe reported licence costs multiplying several times over, with little practical alternative but to pay.
Whoever controls infrastructure that a business cannot leave controls its prices, too. The legal question and the commercial question are the same question wearing different clothes: what happens to us if the owner’s interests stop aligning with ours?
[ The Irish Times view on EU tech sovereignty: a tricky balanceOpens in new window ]
Airbus is not acting alone. The European Union now formally grades cloud providers on sovereignty: who owns them, whose laws bind them, who can touch the data.
European banking regulators have designated the big US cloud providers as concentration risks and require financial institutions to hold credible exit plans. The EU has begun buying sovereign cloud capacity directly.
Sharpened transatlantic politics have turned what was a technical debate into a board-level one. Airbus is simply the largest company so far to act, and it noted pointedly that the European option matched the American giants on price.
Nowhere is this question more awkward than in Ireland. The hyperscalers’ European headquarters are here, along with tens of thousands of jobs and a sizeable share of corporation tax receipts.
Data centres now consume more than a fifth of the country’s electricity. At the same time, a striking proportion of Irish health, banking and State data sits on American-owned infrastructure.
Two things are true at once: the hyperscalers have been very good for Ireland, and that concentration is itself an exposure. The instinctive Irish response to any threat to the tech sector has been to look away, because the sector has been so good to us. That instinct is now the risk. Pretending the question does not exist will not stop European customers, regulators and governments from asking it.
There is also an opportunity in the discomfort. If European procurement shifts towards sovereign infrastructure, and the €50 million Airbus contract suggests it is shifting, Ireland can either watch that market go to France and Germany or compete for it. This country has one of the deepest pools of cloud engineering talent in Europe, built, ironically, inside the hyperscalers themselves.
[ Can Europe break free of American tech supremacy?Opens in new window ]
A State that can host the US cloud’s European headquarters can also host the companies building Europe’s alternative. Those two ambitions are not in conflict: portfolio is the point.
The obvious rejoinder is that the American providers now sell sovereign cloud products of their own, with European data centres and European staff. These are serious offerings. But they do not change the ownership of the company, and it is ownership, not geography, that the Cloud Act attaches to. The Senate testimony demonstrated that limit precisely. A second rejoinder is that Airbus itself has not left American technology behind; it still uses Amazon, Microsoft, Google and Salesforce for plenty. That is true, and it is the real lesson.
The answer to this problem is not abandonment but triage: know which systems the organisation cannot live without, and decide deliberately whose laws those systems should sit under.
Irish boards should ask three questions. Where does our data live, legally as well as physically? Which systems could we genuinely not operate without? And if price, politics or law changed tomorrow, what is our exit plan?
The State should ask the same of its own systems, and should say openly whether sovereignty will weigh in public procurement, as it now does in Brussels and Paris. None of this requires an Airbus budget. It requires the questions to be assigned to someone before events assign them for us.
Airbus did not move because the technology failed. It moved because it read the weather. The cloud has always been someone else’s computer. The question that matters now is someone else’s law.
Kay Murphy is the founder of Kamu, an AI and technology advisory firm
