Blog · August 14, 2026 · By Rickard Eriksson

Thanks, but no thanks, USA

The question of who controls your data has moved from the IT department to the boardroom. Wanting to answer it isn’t anti-American. It’s risk management.

This image is AI-generated and approved by a person. The machine-readable AI marking sits inside the image file.

For many years, an organisation’s digital tools were chosen based on two questions: which is the best, and what does it cost. Fair questions. But in recent years, a third one has pushed its way into the room, and it’s no longer asked by the IT department but by the board: who actually controls our data and our systems?

The answer is uncomfortable for most European organisations. Control largely rests with providers governed by another country’s laws.

From best features to best control

What’s changed the equation isn’t the technology but the law. US legislation can require American companies to hand over data they handle, even when the servers are in Europe, while the EU’s data protection rules demand that the same data be protected. A European organisation with sensitive material stored with a US cloud giant is left straddling two sets of regulations, pulled in opposite directions.

Add the political swings of the past year, where digital services have become bargaining chips in trade negotiations, and the conclusion writes itself: jurisdiction, control, and strategic dependence now belong in the same column as price and functionality when choosing tools.

This isn’t anti-American, any more than fire insurance is a vote of no confidence in your house. Digital sovereignty is just another word for resilience: being able to deliver even when the world around you changes. Keep the partnerships, but make sure the most important things stand on your own feet.

The AI question is the same question, just bigger

Right now, many organisations are repeating the mistakes of the cloud journey, but with AI and at a faster pace. Employees are pasting customer data, HR matters, and contract drafts into AI services governed by foreign laws, because the tools are good, free, and no one has offered an alternative. Every paste is a small decision about jurisdiction that no one in leadership has approved.

That’s the question we built EuroWork to answer. All processing happens within the EU: both the database and the application run in Frankfurt, in the same data centre region, and it’s openly declared in the service, not buried in an appendix. Every AI response is labelled as such, as required by the EU’s AI regulations. The cost appears next to the answer while the work is happening. And what you create is yours: documents and logs can be downloaded in open formats, so an exit plan exists before you need it, not written in frustration afterwards.

What you can do as a leader right now

Three things, none of which require a consultant’s report.

Map out where your most sensitive data actually ends up today, including the AI tools employees have chosen themselves. That’s the most uncomfortable, and most useful, part of the exercise.

Ask the jurisdiction question with every new tech choice, alongside price and functionality: under which country’s laws does this fall, and can we walk away if we need to?

And give employees a better alternative instead of a ban. Bans on good tools always lose to everyday reality. An equally good tool that’s also accountable wins.

Your employees are already using AI. The question is under which country’s laws, and it shouldn’t be a guess.

Rickard Eriksson

In 1996 Rickard Eriksson created what became LunarStorm, the world's first social medium, and has since trained people from more than 7,000 companies and public-sector organisations in AI. Today he runs EuroWork.