US CLOUD Act: what it means for AI in Europe

What does the US CLOUD Act govern?

The Clarifying Lawful Overseas Use of Data Act (CLOUD Act) has been in force since March 2018. Its core is in 18 U.S.C. § 2713: providers of communication and computing services must hand over data that they possess, hold in custody or control when ordered to do so, regardless of whether the data is located in the USA or abroad. It concerns investigations by law enforcement authorities with a court order or comparable procedures.

The CLOUD Act also allows agreements with other states that govern mutual access to electronic evidence. The US government has signed such agreements with the United Kingdom (2019) and Australia (2021). Negotiations with the EU have been under way since 2019 and were resumed in 2023; according to our research, no agreement existed at the time of writing.

Who is affected by the CLOUD Act?

Provider	CLOUD Act applies?
US company with a data centre in the USA	yes
US company with a data centre in the EU	yes, if it controls the data
European subsidiary of a US group	as a rule yes, if the group has access to the data
European company without a US connection	no
European company that uses a model or data centre of a US provider	yes, for the data held by the US provider

For AI, the last row matters. Many AI offerings from European companies send requests to models running at US groups, including in their European data centres. In that case, the provider you have the contract with is European, but the processing in the model is not.

How does the CLOUD Act relate to the GDPR?

Art. 48 GDPR states that judgments and decisions of authorities of a third country requiring the transfer of personal data are only recognised if they are based on an international agreement, such as a mutual legal assistance treaty. An order under the CLOUD Act is not such an agreement. A provider can therefore be caught between two legal systems: US law demands disclosure, while the GDPR does not readily permit it.

The EU-US Data Privacy Framework does not change this fundamentally. The European Commission’s adequacy decision of 10 July 2023 allows transfers to certified US companies and relies on new US safeguards, above all with regard to intelligence services. The General Court of the EU dismissed an action against it on 3 September 2025 (Case T-553/23); the appeal to the Court of Justice (C-703/25 P) was pending at the time of writing.

How do you check an AI provider for the CLOUD Act?

• Owner: Who owns the provider? Does it have a parent company or a majority shareholder in the USA?
• AI model: Where and with whom does the model that processes your requests run? This is stated in the list of sub-processors.
• Other services: Hosting, backup, web search, translation: these service providers belong in the check as well.
• Contract: How does the provider handle requests for disclosure? Does it inform you, as far as permitted? Does it challenge unjustified orders?
• Data: For health data, social data and data under professional secrecy, the risk of access must be assessed differently than for public texts. For professional secrecy, see § 203 StGB (the German criminal law provision on professional secrecy) and AI.

How does this work with basebox?

basebox is a German company and is not subject to the US CLOUD Act. With the server, the AI model runs on hardware dedicated to you, at your site, without an internet connection if you wish. In the cloud, the AI model runs on our servers in the Munich-East data centre. Models from US providers are a different matter: the CLOUD Act applies to them even in European data centres.

• App with an external model: It is optional and runs on Google Vertex in the EU. Because Google is a US company, the CLOUD Act applies to this app. Your administrator shares it only with selected groups; whether you use it, and for which data, you decide together with your data protection officer (comparison).
• Requests from authorities: basebox only hands over data if an order from an authority or court requires it, and informs you beforehand where this is permissible and possible in the individual case. With the server without an operations contract, basebox has no access to your data.

Not legal advice: This article gives an overview of the US CLOUD Act and its relationship to European data protection law. The legal situation is evolving: the appeal against the Data Privacy Framework and the negotiations on an EU-US agreement on electronic evidence are ongoing. What counts is the view of your data protection officer and the contracts agreed. Research as of 11 October 2026.