Rented Ground

Half of Europe’s firms rent their computing, and most of it comes from three American companies. What that means when one of them fails, when a court asks for the data, and when a government wants it switched off.

At about seven in the morning, London time, on Tuesday 20 October 2026, one of the three zones, separate groups of buildings, that make up Google’s cloud region in London lost power. Google’s status page put it in a single line: “A power event caused an outage within europe-west2-b zone.” Thirty-eight of its products were listed as affected, and the incident was closed nearly eight hours later.[1] In those eight hours customers of Revolut could not pay by card, withdraw cash or move money; customers of Lloyds, Halifax and HSBC could not log in to their banks; the video platform that the courts of England and Wales use for remote hearings failed through the morning. Britain’s financial regulator said it was “engaging with Google and affected firms”, and the chair of Parliament’s Treasury Committee wrote to the Bank of England asking for an explanation by 4 November.[2]

None of those banks had chosen to share a power supply. Each had rented computing from the same company, in the same city, and the same power failure reached all of them at once. Twelve days earlier the Bank of England had rehearsed exactly this, an exercise with the country’s 38 largest banks and market operators built on a “global disruption to cloud-based services”; three months earlier the government had named Google’s European cloud arm, with Amazon’s, Microsoft’s and Oracle’s, one of the four “critical third parties” that the financial system now depends on.[3] The outage was not a surprise. It was a reminder.

Outages are the visible part of the problem, and they end. This essay is about the rest of it. A large part of the computing that Europe’s firms, hospitals, banks and governments use no longer belongs to them; it is rented from very few companies, and the largest of them answer to the laws of one country, the United States. That concentration has consequences that go well beyond a bad morning: for who can read the data, for who can switch the service off, for what the rent costs, and for how much room a government has when it disagrees with Washington. The argument here is that those consequences are real and mostly unpriced. The case for the landlords is strong too, and it gets its own section.

63%of the world’s cloud infrastructure spending goes to Amazon, Microsoft and Google

15%share of Europe’s cloud market held by European providers, down from 29% in 2017

53%of EU firms with ten or more staff pay for cloud services; 39% in Portugal

30%of 7,000 monitored online services disrupted when one Amazon region failed in October 2025

The landlords

Half the firms, three landlords

“Cloud” is a soft word for a hard thing: warehouses full of computers, owned by someone else, rented by the hour. A firm that once kept its email, accounts and customer records on its own servers now pays a provider to run them, or pays for software that runs on a provider’s machines. The bottom layer of that market, the computing, storage and networking that everything else is built on, is sold by very few companies. In the second quarter of 2026 the world spent $143 billion on it in three months; Amazon took 28 per cent, Microsoft 20 per cent and Google 15 per cent, nearly two-thirds between them.[4] In Europe the three hold 70 per cent. European providers, led by SAP and Deutsche Telekom with about 2 per cent each, held 29 per cent of their own market in 2017 and have held about 15 per cent since 2022: they grew, but the market grew much faster around them (Figure 1).

Fig. 1 — Shares of spending on cloud infrastructure (computing, storage, platforms and hosted private cloud; not finished software). World: second quarter of 2026. Europe: 2025; the European market was €61 billion in 2024. Source: Synergy Research Group.

How many firms rent? Eurostat asks every two years. In 2025, 52.7 per cent of firms in the EU with ten or more employees paid for cloud services, up from 41 per cent in 2021. In Portugal the share was 38.7 per cent, 24th of the 27 countries. The average hides a steep gradient by size: 49 per cent of small firms in the EU (10 to 49 employees), 67 per cent of medium-sized ones and 85 per cent of large ones; in Portugal, 35 per cent of small firms and 80 per cent of large ones. Most start with email, file storage and office software, but four in ten EU firms (three in ten in Portugal) also buy what Eurostat calls “sophisticated” services, security, database hosting or platforms to run their own applications, and are classed as “highly dependent” on the cloud (Figure 2).[5] The survey leaves out the financial sector, which is among the heaviest users, and firms with fewer than ten people, which are most of Portugal’s firms; it also does not ask which provider.

Fig. 2 — Firms paying for cloud services, by service, 2025, per cent of all firms with ten or more employees (financial sector excluded). “Highly dependent”: buying security software, database hosting or an application platform from the cloud. Source: Eurostat, isoc_cicce_use.

The reach

How many firms would stop?

The obvious question, if one of the three failed for a day or a week, is what share of businesses would stop. Nobody has measured it, for Portugal, for the EU or for any country. Regulators know which banks use which provider, because the rules oblige banks to tell them; nobody keeps the same register for bakeries, clinics or town halls. What exists are pieces, and they point the same way (Figure 3).

Fig. 3 — Shares exposed to, or hit by, a single provider in measured cases. Websites: Kashaf et al. (2020), top 100,000 sites; W3Techs, October 2026. Fortune 500 and monitored services: Parametrix (2023, 2024, 2025). Windows computers: Microsoft (2024). Each bar refers to a different group.

When Amazon’s oldest and largest region, in northern Virginia, failed for about fifteen hours on 20 October 2025, the insurer Parametrix, which monitors more than 7,000 cloud and software services, saw “roughly 30%” of them disrupted; the risk modeller CyberCube counted “nearly 70,000 organisations” affected.[6] Two years earlier Parametrix had found that more than a third of America’s 500 largest companies relied on that one region alone.[7] A study of the 100,000 most visited websites found that 89 per cent depended critically on some outside provider of name lookup, content delivery or security certificates, and that the three largest providers of any of those services could take down between half and 70 per cent of them.[8] One of those providers, Cloudflare, sits in front of 27.7 per cent of all websites.[9] In Britain’s financial sector, the Treasury reported in 2022 that “over 65%” of firms used the same four cloud providers.[10]

For ordinary firms one can only do arithmetic, and it should be read as arithmetic. The insurers who modelled a cloud outage for Lloyd’s in 2018 assumed that each firm uses a provider with a probability equal to that provider’s market share.[11] Applied to Eurostat’s figures, a complete failure of Amazon would reach directly about 15 per cent of EU firms with ten or more staff, about 11 per cent in Portugal; Microsoft, 10 and 8 per cent; Google, 8 and 6. Those are floors, for three reasons. Market shares are measured in money, and small firms buy little of it. The estimate counts only firms that rent directly, while most firms buy finished software — accounting, payroll, booking, the card terminal at the till — whose maker rents from one of the three: that is why a third of monitored services fell with one Amazon region. And Microsoft’s share of the bottom layer understates its weight in the layer firms actually use, email and office software, the two most common cloud services in Figure 2.

The honest answer to the question is therefore a range rather than a number. A long failure of the largest provider would stop, directly, something like one in seven EU firms with ten or more staff, one in nine in Portugal, and many more indirectly, through software they did not know was rented; among firms that live online, the measured cases suggest something closer to a third. The distribution matters as much as the average. Large firms are the most exposed, 85 per cent of them rent, but also the most likely to have a second provider and an exit plan. In the Lloyd’s model, 63 per cent of the losses fell on firms outside America’s largest thousand, the ones least able to absorb them.[11]

The dependence also runs deeper than any one customer can see. Amazon’s own engineering guidance explains that the control systems of several of its global services, including the one that checks who is allowed to do what, its public name lookup and its content delivery network, live in a single region, northern Virginia, and warns customers: “Do not rely on the control planes of partitional services in your recovery path.”[12] A European firm can choose a Frankfurt data centre and still depend, in a crisis, on a building in Virginia.

The failure

Rarer, but all at once

The record of the last eighteen months reads like a list of single points of failure. In October 2025 a “latent race condition” in the system that manages Amazon’s database addresses emptied a name record and took down its Virginia region for about fifteen hours.[13] Nine days later a faulty configuration change spread across Microsoft’s global front door, the service that receives traffic for its own sites and many customers’, for more than eight hours; airline check-in and parts of Microsoft’s own sign-in service went with it.[14] In November a file used by Cloudflare’s bot protection doubled in size, exceeded a limit and stopped most of the company’s core traffic for three hours, its “worst outage since 2019”; a second, shorter one followed in December.[15] In June 2025 a blank field in a Google policy update crashed its quota system worldwide, and took with it a Cloudflare storage service that, Cloudflare admitted, was partly “backed by a third-party cloud provider”.[16] None of these was an attack. Each was an ordinary mistake or an ordinary accident inside one company, and each reached thousands of others.

The template for this kind of failure was not even a cloud. In July 2024 a faulty update from one security company, CrowdStrike, crashed “8.5 million Windows devices, or less than one percent of all Windows machines”; that one per cent included airlines, hospitals and banks, a quarter of America’s 500 largest companies, which lost an estimated $5.4 billion.[17] The Load-Bearing Volunteer told that story as one about the hidden foundations of software; the cloud is the same story with fewer, larger foundations.

What would a long failure cost? The modelled answers are large and the observed ones much smaller, because the real outages have been short (Figure 4). The Lloyd’s model put the loss from one of the three largest providers going down for three to six days at $6.9 to $14.7 billion for American firms, counting only lost online sales and orders; Parametrix estimated that losing several Amazon regions for two days would cost the 500 largest American companies $20.2 billion.[7][11] The October 2025 Amazon outage, by contrast, cost American firms an estimated $500 to $650 million.[6] Very little of any of it is insured, and almost none is paid by the provider: Amazon’s service agreement, for example, offers a credit of 10, 30 or 100 per cent of the month’s bill for the service that failed, and calls that the customer’s “sole and exclusive remedy”.[18] A fifteen-hour outage earns a 30 per cent discount on one invoice; the lost day of trade is the customer’s.

Fig. 4 — Losses from cloud failures, modelled and estimated, billions of US dollars. Scopes differ: the Fortune 500 are America’s 500 largest companies; the Lloyd’s figures cover 12.4 million American firms but only lost online sales and orders. Sources: Lloyd’s and AIR (2018); Parametrix (2023, 2024, 2025).

Physical attack is no longer hypothetical either. In March 2026 two Amazon facilities in the United Arab Emirates and Bahrain were reported “directly struck” by drones, and services in the region failed.[19] A country whose ministries, hospitals and banks run in a few buildings has given an adversary a short list of targets, and those buildings do not need to be on its own territory.

The law

Where the data sits does not decide who can ask for it

For years the providers answered worries about American law by building data centres in Europe. The answer stopped working in 2018. After Microsoft refused to hand over emails stored in Dublin to an American warrant, Congress passed the CLOUD Act, which obliges American providers to disclose data within their “possession, custody, or control, regardless of whether such communication, record, or other information is located within or outside of the United States”.[20] Amazon’s chief regulatory officer argues that the Act “did not give the U.S. government any new authority to compel data from providers”, that it still requires a valid warrant, and that the company challenges requests it considers overbroad; he adds that no request since 2020 has led to disclosure of a business or government customer’s content stored outside the United States.[21] Both halves are true. The Act needs a court order, and the order can be contested. But it settled that the location of the data is no defence.

Criminal warrants are the narrower channel. The wider one is intelligence. Section 702 of the Foreign Intelligence Surveillance Act allows American agencies to compel providers to help collect the communications of foreigners abroad, without a warrant for each target; it was one of the two programmes the European Court of Justice found disproportionate when it struck down the transatlantic data agreement in 2020.[22] In June 2026 the statute lapsed after Congress failed to renew it, but the collection did not stop: the certifications approved by the surveillance court in March allow it to continue until 17 March 2027.[23] The current agreement that lets European data flow to American firms, adopted in 2023, rests on safeguards created by an American executive order and an oversight board whose Democratic members were dismissed in January 2025; the EU’s General Court upheld the agreement in September 2025, and the appeal is pending.[22]

The clearest statement of where this leaves European customers came from a provider. In June 2025 Microsoft France’s director of public and legal affairs, Anton Carniaux, was asked under oath by a French Senate inquiry whether he could guarantee that French citizens’ data would never be passed to American authorities without France’s agreement. “No,” he said, “I cannot guarantee that, but, again, it has never happened before.”[24] Microsoft’s own transparency report for the second half of 2025 is slightly less reassuring than the second half of that sentence: it gave American law enforcement the content of three non-American business customers whose data was stored outside the United States, one of them in the EU or EFTA, though none from its Azure cloud.[25] The numbers are tiny. The point is that the decision is not Europe’s to make.

The switch

Who holds the switch

A provider that must obey a government can also be made to stop serving someone. In February 2025 the United States sanctioned the chief prosecutor of the International Criminal Court in The Hague, Karim Khan; in May the Associated Press reported that he had lost access to his Microsoft email and moved to a Swiss service.[26] The episode is often told as “Microsoft cut off the ICC”, and that is wrong. Microsoft says it never stopped serving the court; the sanctioned official was disconnected, and who pressed the button has been disputed since. In February 2026 Microsoft apologised to a British parliamentary committee for an executive’s “inaccuracy” in saying it had been the court’s own decision, and repeated that it had been “in touch with the ICC throughout the process that resulted in the disconnection of its sanctioned official”.[26] Eleven ICC officials have been sanctioned since; one of the judges, the Frenchman Nicolas Guillou, told Le Monde that his accounts with American companies had been closed, as reported in the German and British press.[27] In October 2025 the court said it would replace Microsoft’s office software with openDesk, a suite developed for the German state.[28]

The lever is not only American. In March 2024, under the EU’s own sanctions on Russia, Microsoft and Amazon cut Russian business customers off their cloud products; in July 2025, after a new EU package, Microsoft suspended email and Teams at Nayara Energy, an Indian refiner partly owned by Rosneft, and restored them a few weeks later, after the company went to court in Delhi.[29] In September 2025 Microsoft disabled services used by a unit of Israel’s defence ministry after press reports on how they were used.[29] Earlier, in 2019, GitHub restricted users in Iran, Syria and Crimea and Adobe deactivated accounts in Venezuela, both citing American sanctions.[30] Some of these uses may be right and some wrong; the common element is that the switch is held by the provider, and the provider obeys whichever government has power over it. For Europe’s users that is mostly one government, and the one most able to bind the largest providers is not theirs.

Microsoft’s answer came in April 2025, two weeks before the Khan story broke: if any government ordered it to suspend its European cloud operations, it would “promptly and vigorously contest such a measure using all legal avenues available”, and it would write that promise into its contracts with European governments.[31] It is a serious commitment, and it is a promise to litigate, not a promise to win.

The leverage

Chips, prices and bargaining power

The same concentration shows up in quieter ways. In January 2025 the outgoing American administration published rules on exports of advanced AI chips that sorted the world into tiers. Eighteen countries, including France, Germany, Spain, Italy, Ireland and the Netherlands, were in the first, unrestricted tier; Portugal, like Poland, Austria, Greece and most of the rest of the EU, was not, and its imports of the chips would have been capped.[32] The rule was withdrawn in May 2025, before it took effect. It showed, though, that who gets to build the computing of the AI era can be decided by one government’s classification, and that EU membership did not count.

The other leverage is commercial. Moving out of a cloud is expensive: data is cheap to bring in and dear to take out, software is written for one provider’s tools, and licences can be priced to keep customers where they are. Britain’s competition authority concluded in July 2025 that Amazon and Microsoft each held up to 40 per cent of British cloud spending, and that Microsoft charged rival clouds “much higher” prices for its business software than it charged customers on its own; in March 2026 it chose voluntary commitments over formal action on the cloud and opened an investigation of Microsoft’s business software instead, to be reassessed in spring 2027.[33] The EU’s Data Act bans charges for switching provider from 12 January 2027 and caps at cost the fees for running two clouds side by side; it does not abolish the fees for taking data out in normal use.[34] When a market is this concentrated and this hard to leave, part of what customers pay is a toll for staying, the kind of income The Tollkeepers set out to tell apart from a reward.[a]

And the money flows one way. Europe spent about €61 billion on cloud infrastructure in 2024; if the three American providers took 70 per cent, that is something like €43 billion a year, by this essay’s arithmetic, before counting the software that runs on top.[4] With it go the engineers, the profits that fund the next generation of data centres and chips, and the habit of building on someone else’s tools, which is why each year of dependence makes the next one more likely. A country that rents all of this also loses bargaining power in matters that have nothing to do with computing: a government that is negotiating with Washington over trade, defence or digital taxes knows that its ministries, its health service and its banks run on American companies, and so does Washington.

The case for

The case for the landlords

The strongest counter-argument is about reliability. The cloud was not concentrated by accident; firms moved because the large providers run computers better than almost anyone else. Each region is built from separate zones, “meaningfully distant from each other, up to 60 miles”, with separate power, designed not to fail together.[12] On 20 October 2026 one London zone failed, not the region; firms that had spread their systems across zones as the providers recommend mostly kept running, and part of the blame for the morning belongs to the banks’ own designs. The Uptime Institute, which tracks data centre failures, reports that outages are becoming “less frequent and less severe relative to the rapid growth of digital infrastructure”, and that failures at the cloud giants declined while those at smaller digital providers rose.[35] A small bank’s own server room would fail more often, and nobody would read about it.

The same is true of security. The large providers employ more security engineers than most European states, patch faster and see attacks across millions of customers. A public hospital that leaves Microsoft for a local provider may well be less safe, not more. Gareth Truran, an executive director at the Bank of England, put both sides in one speech: a failure at a common provider “could create a single-point-of-failure that could simultaneously impact multiple firms”, but such providers “may also be able to help deliver a higher level of resilience than a firm might be able to achieve by itself.”[36]

On the law, the providers can point out that disclosures are rare, that they challenge requests and that they have built European subsidiaries, staffed by Europeans, to make them rarer still. On the switch, the cases so far concerned sanctioned individuals and companies, not the citizens or governments of allies. And Europe’s alternatives are small: they hold 15 per cent of their own market, and some of the sharpest critics of American dependence admit that there is, today, no European provider that could carry the load.

All of this is true, and none of it removes the problem; it changes its shape. Concentration makes failures rarer but bigger: fewer bad mornings, but when one comes, it comes to everyone at once. Even the providers’ home state worries about that. The United States Treasury found in 2023 that the market “is concentrated around a small number of CSPs”, that a failure “could affect many financial sector clients concurrently”, and that their small number “may give CSPs outsized bargaining power”.[37] The legal and political risks do not depend on how well the computers run. They depend on whose law binds the company that runs them, and the reliability argument does not answer that.

The responses

Exit plans, sovereign labels and a few departures

The financial regulators moved first. The EU’s Digital Operational Resilience Act, which has applied since January 2025, obliges banks and insurers to have tested exit strategies for providers of critical services, and in November 2025 Europe’s supervisors named 19 “critical” technology providers they will oversee directly: Amazon, Google, Microsoft, Oracle and IBM, but also SAP, Deutsche Telekom, Orange, Capgemini and others.[38] Britain designated its four in July 2026, all American.[3] Supervision can demand better engineering and better exit plans. It cannot change who owns the provider.

The providers responded with “sovereign” offers. Amazon opened its European Sovereign Cloud in Brandenburg in January 2026, run by German companies with EU-resident staff, with smaller sites planned in Belgium, the Netherlands and Portugal; asked whether American authorities could reach it, it said only that no such disclosure had happened since 2020.[39] In France, joint ventures in which French firms license American technology, S3NS (Thales and Google) and Bleu (Orange, Capgemini and Microsoft), seek a national label that requires immunity from non-European law. The EU’s own certification scheme dropped its sovereignty requirements in 2024, after opposition from several member states and American industry.[40] In June 2026 the Commission proposed a Cloud and AI Development Act with four levels of assurance, the highest requiring “no interference from a third country”, for public bodies to choose from according to risk; it is still a proposal.[41]

A few public bodies have left. The German state of Schleswig-Holstein finished moving more than 40,000 civil service mailboxes from Microsoft to open-source software in October 2025; Denmark’s digital ministry, Copenhagen, Aarhus and Lyon have begun to replace Microsoft’s office software; the Dutch parliament voted in March 2025 against unnecessary moves of government systems to American clouds.[28] These are small numbers set against tens of thousands of public bodies, but they show that the exit is possible, and what it costs: years of work, retraining, and some loss of convenience.

Portugal

A sovereign plan, and an American data centre in Sines

Portugal rents less cloud than most of Europe, 39 per cent of firms with ten or more staff against 53 per cent, mainly because its firms are smaller and later to digitise; that is a lag, not a strategy. The State has a plan. In May 2026 the government approved a National Sovereign Cloud Plan that defines sovereignty as “o controlo do acesso aos dados e a garantia permanente de funcionamento” of critical systems, sorts the State’s processes into four levels from “neutral” to “strategic”, and gives the public company IP Telecom the job of building the infrastructure for the upper ones, with completion promised by 2030. The risks it names are extreme weather, cybercrime and electronic warfare; it does not mention foreign law or the United States.[42] Six months earlier Microsoft had announced a $10 billion investment in AI computing at the Start Campus data centre in Sines, on American chips, and Amazon plans one of its “sovereign” local sites in Portugal.[43][39] The country’s largest computing projects are American, under the jurisdiction its own plan quietly hedges against.

Portugal has also had a rehearsal of what happens when a single system fails. During the Iberian blackout of 28 April 2025, which Europe’s grid operators later traced to failures in voltage control, card purchases fell by 36 per cent and cash withdrawals by 34 per cent against the previous weeks; some cash machines kept working on batteries and generators.[44] The payment system itself held; what failed was power and telecommunications at the edges. The Banco de Portugal is preparing a national plan for the resilience of payments. A cloud failure would be the opposite case: power at the edges, and the centre missing.

Coda

What would decide it

The concentration of the cloud is usually discussed one consequence at a time: the outage by engineers, the CLOUD Act by lawyers, the prices by competition authorities, the chips by trade negotiators. Put together, they describe a single fact. A large and growing share of what Europe’s economy and its states need in order to function on any given morning is rented from three companies, and those companies can be compelled by one foreign government to hand over data, to cut off a customer, or to stop selling. That government has been an ally for eighty years. The arrangement works as long as it stays one, and as long as the three companies keep their buildings powered.

None of this argues for leaving the cloud, which would make most firms less safe and poorer. It argues for treating dependence as a risk to be measured and priced, as the banking rules have begun to do: knowing which functions run where, keeping a working exit for the ones that must not stop, putting the State’s most sensitive systems on infrastructure that answers only to European law, and building enough European capacity that the exit is a real option rather than a threat on paper. What would show that the risk is overstated is simple to state: several years in which no European customer is disconnected for political reasons, no allied government faces pressure through its providers, and outages stay short. What would show that it is understated is a single bad week.

On method and tools

This piece was written collaboratively with Claude Opus 5.5 (Anthropic): human specification and editorial direction; machine research, analysis and drafting. Research agents gathered and checked the sources; quotations were read in the original or in a full-text copy, except where noted: Carniaux’s words are quoted in The Register’s English translation; the accounts of the London outage’s effects on banks and courts, of Judge Guillou’s accounts, of the Nayara, Russian and Israeli cut-offs, of the drone strikes in the Gulf, of Microsoft’s Sines investment and of the European departures from Microsoft are from press reports; the Portuguese payment figures for the blackout are the Banco de Portugal’s as reported by RTP. Google had not yet published its analysis of the London outage when this was written. The figures and the illustrative shares of firms reached come from a script, scripts/cloud.py; the shares apply market shares to Eurostat’s figures, as in the Lloyd’s model, and are not a measurement. Anthropic, the maker of the tool used, rents computing from Amazon and Google; neither is treated differently from any other source.

Cover: data centres near Ashburn, Loudoun County, Virginia, home of Amazon’s largest cloud region; photograph by Theodore Christopher, 26 November 2025, via Wikimedia Commons, CC0, cropped.

Authored by: Luis Matos Ferreira — Physicist, Developer, Writer

Go deeper

Ideas this essay uses without stopping to explain them, and where this blog does. The letters in the text point here; the links go straight to the section.

[a] Reward or toll

Three traces that tell an income earned in competition from one collected at a gate. The Tollkeepers, “How to tell a reward from a toll”.

Related essays on this blog

1. The Load-Bearing Volunteer — the few unpaid people under modern software, and the CrowdStrike crash.
2. The Tollkeepers — when an income is a reward and when it is a toll.
3. How Trust Becomes Access — how access spreads through the systems organisations trust.
4. The Race to Become the Default — how AI developers compete for the computing and customers that make them hard to replace.

Sources

1. Google Cloud Service Health, “Multiple services are experiencing issues in the europe-west2 region”, 20 October 2026 (incident 23:08–07:00 US/Pacific, 06:08–14:00 UTC).
2. The Guardian, 20 October 2026 (via AOL), on Revolut, Lloyds, Halifax, HSBC, the FCA and Dame Meg Hillier’s letter; ABC News (Australia), 20 October 2026, on the HMCTS Cloud Video Platform; Reuters, as reported, on the FCA; The Register, 20 October 2026.
3. Bank of England, “CMORG holds sector-wide cloud outage simulation exercise”, 9 October 2026; “UK financial regulators to begin overseeing critical third parties announced by HMT”, 10 July 2026.
4. Synergy Research Group, “Q2 cloud market passes $143 billion”, 30 July 2026; “European cloud providers’ local market share now holds steady at 15%”, 24 July 2025; own arithmetic for the flow to the three American providers.
5. Eurostat, isoc_cicce_use (cloud computing services by size class of enterprise), 2021, 2023 and 2025, retrieved 21 October 2026; “Cloud computing – statistics on the use by enterprises”, Statistics Explained, data extracted January 2026.
6. Parametrix, “AWS us-east-1 outage: what Parametrix monitored in real time”, October 2025; CyberCube, “Insurance loss estimate for AWS outage”, 23 October 2025.
7. Parametrix, “Cloud outage and the Fortune 500”, 17 November 2023.
8. A. Kashaf, V. Sekar and Y. Agarwal, “Analyzing Third Party Service Dependencies in Modern Web Services: Have We Learned from the Mirai-Dyn Incident?”, ACM Internet Measurement Conference, 2020.
9. W3Techs, “Usage statistics and market share of Cloudflare”, October 2026.
10. HM Treasury, Critical third parties to the finance sector: policy statement, June 2022.
11. Lloyd’s and AIR Worldwide, Cloud Down: Impacts on the US Economy, January 2018, key findings and Table 9.
12. Amazon Web Services, AWS Fault Isolation Boundaries, “Availability Zones” and “Global services”.
13. Amazon Web Services, “Summary of the Amazon DynamoDB service disruption in the Northern Virginia (US-EAST-1) Region”, October 2025.
14. Microsoft Azure, post-incident review, Azure Front Door, tracking ID YKYN-BWZ, 29–30 October 2025; AP on airline check-in, as reported.
15. Cloudflare, “Cloudflare outage on November 18, 2025” and “Cloudflare outage on December 5, 2025”.
16. Google Cloud Service Health, incident of 12 June 2025; Cloudflare, “Cloudflare service outage June 12, 2025”.
17. D. Weston, “Helping our customers through the CrowdStrike outage”, Microsoft, 20 July 2024; Parametrix, “CrowdStrike to cost Fortune 500 $5.4 billion”, 24 July 2024.
18. Amazon Web Services, Amazon Compute Service Level Agreement.
19. The Register, “Amazon outages in the Middle East”, 2 March 2026, as reported.
20. 18 U.S.C. § 2713, “Required preservation and disclosure of communications and records”, added by the CLOUD Act, Pub. L. 115-141, 23 March 2018.
21. B. Kimball, “Five facts about how the CLOUD Act actually works”, AWS Security Blog, 22 July 2025.
22. Court of Justice of the EU, Data Protection Commissioner v Facebook Ireland and Schrems, C-311/18, 16 July 2020; Commission Implementing Decision on the EU-US Data Privacy Framework, 10 July 2023; General Court, Latombe v Commission, T-553/23, 3 September 2025, appeal C-703/25 P pending; on the oversight board, Just Security and court filings, as reported.
23. Brennan Center for Justice, “Section 702 of the Foreign Intelligence Surveillance Act”, updated 16 October 2026; on the votes of June 2026, Roll Call and NPR, as reported.
24. The Register, “Microsoft admits it cannot guarantee”, 25 July 2025, reporting the French Senate commission of inquiry on public procurement and digital sovereignty, June 2025.
25. Microsoft, Enterprise law enforcement requests, July–December 2025.
26. AP, 15 May 2025, as reported; heise online, “Microsoft and the ICC”, 5 June 2025; The Register, “Microsoft throws spox under the bus in ICC email flap”, 18 February 2026.
27. N. Guillou, interview with Le Monde, as reported by heise online and the Church Times; JusticeInfo.net, 19 March 2026, on the number of sanctioned officials.
28. Handelsblatt, via dpa and Euronews, 30–31 October 2025 (ICC and openDesk); Schleswig-Holstein state government, 6 October 2025, via heise online and The Register; The Local Denmark and Euronews (Denmark, Copenhagen, Aarhus); The Register, 26 June 2025 (Lyon); Tweede Kamer, motions of 18 March 2025, via Computable; all as reported.
29. Kyiv Post and The Moscow Times, March 2024 (Russian customers); PTI and WorldECR, July 2025 (Nayara Energy); The Guardian, September 2025 (Israel’s defence ministry); all as reported.
30. TechCrunch and GeekWire, July 2019 (GitHub); Vice and Silicon UK, October 2019 (Adobe); as reported.
31. B. Smith, “Microsoft announces new European digital commitments”, Microsoft, 30 April 2025.
32. Bureau of Industry and Security, “Framework for Artificial Intelligence Diffusion”, Federal Register 90 FR 4544, 15 January 2025; BIS press release, 13 May 2025 (rescission).
33. Competition and Markets Authority, cloud services market investigation, final decision, 31 July 2025; decision on next steps, 31 March 2026; progress update, 16 October 2026.
34. Regulation (EU) 2023/2854 (Data Act), Articles 29 and 34.
35. Uptime Institute, “Annual outage analysis 2025”, press release.
36. G. Truran, “Keynote speech at the techUK summit”, Bank of England, March 2024.
37. US Department of the Treasury, “Treasury releases report on the financial services sector’s adoption of cloud services”, 8 February 2023.
38. Regulation (EU) 2022/2554 (DORA), Articles 28(8) and 64; European Supervisory Authorities, list of designated critical ICT third-party providers, 18 November 2025.
39. Amazon Web Services, “Opening the AWS European Sovereign Cloud”, 14 January 2026; Trending Topics, “Amazon’s new European sovereign cloud can’t rule out US data access”, 16 January 2026.
40. Thales and S3NS, press release, 17 December 2025; Next.ink on Bleu; Hogan Lovells and ITI on the EUCS draft, 2024; as reported.
41. European Commission, Proposal for a Cloud and AI Development Act, COM(2026) 502, 3 June 2026.
42. Resolução do Conselho de Ministros n.º 102/2026, Plano Nacional de Nuvem Soberana, Diário da República, 27 May 2026; ECO and RTP on deadlines, as reported.
43. Microsoft, Nscale and Start Campus, announcement at Web Summit, 11 November 2025, via Data Center Dynamics and Jornal de Negócios, as reported.
44. ENTSO-E, final report on the Iberian blackout of 28 April 2025, March 2026, via pv magazine; Banco de Portugal, Relatório dos Sistemas de Pagamentos 2025, via RTP.