Sovereignty Does Not Mean the Same Thing in Paris and New York
Over the past two years I have had a version of the same conversation on both sides of the Atlantic, and it went in two very different directions depending on the room.
In France, sovereignty is a legal question before it is a technical one. The concern is jurisdiction, which government can compel a provider to disclose data, regardless of where that data physically sits. Who owns the provider, and which law it answers to, matters as much as the controls it has implemented.
That framing has shaped European policy, and it has also paralysed it. Europe has spent several years failing to agree on a single cloud certification scheme, blocked on whether certification should assess what a provider does or who controls it. In January 2026 the Commission proposed to settle it on technical criteria alone.
In the United States I almost never hear the word. The underlying concern exists, but it travels through procurement rather than through identity. For example, federal agencies are required to obtain or reuse an authorization (FedRAMP) for any cloud service within scope (under OMB Memorandum M-24-15). Commercial buyers ask about data residency, encryption key custody, subprocessor lists, breach notification timelines and audit rights. The subject is demonstrable control, not applicable law.
Here are 3 lessons learned from the differences between North America and France. They transfer to any European company selling technology in the US.
Focus on the consequences, not the principle. We stopped opening with where we are from and started opening with what a buyer can verify (where data is stored, who holds the keys, which third parties touch it, what happens when a foreign authority makes a request). The origin story still comes up, but as evidence rather than as a claim.
Set aside a budget for administrative procedures and U.S. certifications, and start the process early. France verifies your identity (ownership structure, jurisdiction, and hosting). The United States want to know what certifications you have, who audited your processes, and over what time period. European certifications can rarely serve as substitutes for these.
Expect to be asked for guarantees, not just proof. U.S. buyers want to know what will happen if a problem arises, and they want it set out in writing before signing: a U.S. legal entity that can be sued, applicable U.S. law, liability caps, insurance certificates, support commitments with specific timeframes, and breach notification deadlines expressed in days. All of these requirements slow down the sales cycle. You need to take them into account and be able to provide them quickly.
None of this makes the European argument worthless. It makes it insufficient on its own, and badly placed at the start of a conversation. Sovereignty answers one real question. Who ultimately controls the company holding your data? In the US it arrives after the others, never instead of them.
About the Author, Jordan THEODORE:
A tech leader and defensive security specialist, I operate at the heart of critical infrastructure protection. My expertise centers on malware reverse engineering, digital forensics, and AI. Driven by a passion for knowledge-sharing and mentorship, I translate this hands-on, field-tested expertise into various podcasts and publications.
Sources :
European Parliamentary Research Service, "Cybersecurity Act review: What to expect", 5 January 2026: https://epthinktank.eu/2026/01/05/cybersecurity-act-review-what-toexpect/
Clifford Chance, "EU cyber reforms proposed, including overhauled Cybersecurity Act", 2 February 2026: https://www.cliffordchance.com/briefings/2026/02/eu-cyber-reformsproposed--including-overhauled-cybersecurity-ac.html
FedRAMP, OMB Memorandum M-24-15 authorization process:
https://fedramp.gov/2026/authority/m-24-15/process/
The opinions expressed in this article are the author's own and do not reflect those of the FACC-NY.