US / United States / revised 28 Oct 2026
The US CLOUD Act and European AI Prompts
The CLOUD Act requires US communications and cloud providers to disclose data in their possession, custody or control when served with valid US legal process, wherever the data is stored. For European teams this means an EU region operated by a US-parented company is not, by itself, out of reach. The practical response is to minimise what is held and who holds the keys, and to document the residual risk in your transfer impact assessment.
- Citation
- Clarifying Lawful Overseas Use of Data Act, Pub. L. 115-141, Division V; 18 U.S.C. 2713, 2703(h) and 2523
- Regulator
- US Department of Justice and US federal courts
- In force
- 23 March 2018
- Maximum penalty
- No administrative fine; a provider that fails to comply with a valid warrant or order faces contempt of court sanctions
Section 2713: location does not decide
The Act added 18 U.S.C. 2713, which obliges providers of electronic communication services and remote computing services to preserve, back up or disclose the contents of communications and records within their possession, custody or control, regardless of whether the data is located inside or outside the United States. It was passed to resolve the dispute in United States v. Microsoft over emails stored in Ireland, which became moot once the Act was enacted.
Comity challenges and executive agreements
Section 2703(h) lets a provider move to quash or modify a request where disclosure would create a material risk of violating the laws of a qualifying foreign government, meaning one with an executive agreement under section 2523. The UK-US agreement entered into force on 3 October 2022. There is no EU-US agreement in force, so EU-based customers cannot assume this comity route is available.
How it meets GDPR Article 48
Article 48 GDPR provides that a third-country court judgment or administrative decision requiring disclosure is recognised or enforceable only if based on an international agreement such as a mutual legal assistance treaty. In their 2019 joint response, the EDPB and EDPS said a CLOUD Act request alone would not provide a legal basis under the GDPR, leaving providers potentially caught between two legal systems. That conflict is exactly what a transfer impact assessment has to address.
- 01
Zero prompt retention
Section 2713 reaches what the provider holds. A gateway and upstream configuration that keep prompts and completions in memory only, with no logs of content, leaves no stored content to produce. It does not stop interception of live traffic under other authorities, which is why routing still matters. - 02
Customer-held keys for anything at rest
Receipts, configuration and pseudonymisation vaults should be encrypted with keys held in the customer's HSM, so a provider order yields ciphertext only. - 03
Operator nationality as a routing attribute
Record whether each endpoint's operating entity, and its parent, is subject to US jurisdiction. Region alone is not enough to evaluate CLOUD Act exposure. - 04
Self-hosted or EU-operated capacity for restricted data
For the most sensitive classes, run open-weight models in the customer's own VPC or on EU-headquartered infrastructure, so no US-parented provider has possession of the prompt.
| # | Rule | Legal rationale |
|---|---|---|
| 01 | For requests labelled restricted, deny endpoints whose operating entity or parent is subject to US jurisdiction. | Section 2713 attaches to possession, custody or control, which follows the corporate group rather than the data centre. |
| 02 | Require the upstream zero-data-retention flag on every route used by eu-gdpr-strict tenants. | What the provider does not hold, it cannot be ordered to disclose. |
| 03 | Never write prompt or completion content to gateway logs; log hashes and policy outcomes only. | The gateway operator itself should not become a store of content that legal process could reach. |
| 04 | Encrypt receipts and vault entries with customer-managed keys, and reject configurations that fall back to provider-managed keys. | Keys outside the provider's control limit what any compelled disclosure can reveal. |
eu-restricted-operator
The rules above, written as Open Policy Agent Rego (v1 syntax). The gateway evaluates the pack in-process in every regional data plane before forwarding a request; YTT Secunet measures median evaluation under 3 ms in production.
Packs are versioned and signed. The version that decided each request is named in the residency receipt, so an auditor can match the decision to this exact text.
How the policy engine workspackage yttsecunet.policies.eu_restricted_operator
import rego.v1
us_jurisdiction(ep) if ep.operator.hq_country == "US"
us_jurisdiction(ep) if ep.operator.parent_hq_country == "US"
deny contains "restricted data on US-jurisdiction operator" if {
input.request.label == "restricted"
us_jurisdiction(input.endpoint)
}
deny contains "upstream must run with zero data retention" if {
input.policy == "eu-gdpr-strict"
not input.endpoint.zdr
}
deny contains "customer-managed keys required" if {
input.tenant.key_mode != "customer_hsm"
}
default allow := false
allow if count(deny) == 0Each item is verifiable against configuration, signed receipts or contract records. Tick through it with your DPO.
Does an EU region remove CLOUD Act exposure?
No. If a US provider controls the data, section 2713 can reach it wherever it is stored. An EU region reduces other risks and avoids a Chapter V transfer, but the CLOUD Act question depends on who controls the data.
Is YTT Secunet CLOUD Act immune?
No. YTT SECUNET PRIVATE LIMITED is incorporated in India, but a foreign company with enough US contacts can still receive US process, and Indian law has its own access powers. The architecture reduces exposure by design: prompts are never stored, keys can be held by the customer, and Sovereign Dedicated runs in the customer's own VPC or on-premises.
Can a provider refuse an order that conflicts with the GDPR?
A provider can challenge an order, and section 2703(h) offers a specific comity motion where an executive agreement exists. For EU data there is no such agreement in force, so outcomes depend on general comity arguments before a US court.
Sovereign route ready
Stop risking 4% global turnover GDPR fines on AI inference.
Deploy sovereign, cryptographically proven AI routing in 15 minutes.