Controlling interest & FISA 702 risk (jurisdiction ≠ residency)

Why important?

For US-controlled providers, data residency may be solved technically, but legal and governmental reach via the parent company remains a risk (e.g. FISA 702 / CLOUD Act). Relevance depends strongly on the use case. Since September 2025, Chapter VII of the EU Data Act has sharpened this conflict: for US-controlled providers, safeguards against unlawful third-country access and CLOUD Act obligations cannot both be met in full at the same time.

How measured?

• 0 = High jurisdiction/disclosure risk (e.g. US control, FISA 702 exposure) without mitigation
• 1 = Elevated risk, mitigations unclear/weak
• 2 = Individual mitigations, but residual risk high or scope narrow
• 3 = Mitigations in place (EU entity, processes), but residual risk remains relevant
• 4 = Strong mitigations (legal/operational separation), risk reduced and documented
• 5 = Low risk (EU control/ownership, no relevant extraterritorial exposure), evidenced
• N/A = no reliable evidence

Sources / Evidence

• https://www.law.cornell.edu/uscode/text/50/1881a
• https://www.law.cornell.edu/uscode/text/18/2713
• https://news.microsoft.com/de-de/erste-souveraene-cloud-plattform-fuer-die-deutsche-verwaltung-auf-der-zielgeraden/

Validation questions (RFP)

• Who is the ultimate parent / controlling interest? Which disclosure and notification obligations apply? Is there independent EU governance that assesses government requests?

Scores comparison