Andy Morrell

Is AWS UK Good Enough? Compliance, Jurisdiction and Control in Sovereign AI

Andy Morrell·

A couple of weeks ago I put up a sovereign AI offer on the Slevinth Heaven site. Since then I’ve talked it through with a few people whose opinion I trust, and the pushback was the same each time: you’re overselling the risk. Put it in AWS London and you’re fine.

They’re mostly right, and the first version of the page didn’t say so clearly enough. But “fine” is doing a lot of work in that sentence. Fine for what? It turns out there are three different questions hiding in the word “sovereignty”, and a UK region answers only the first one.

Three questions, not one

  1. Compliance: does this meet the rules we’re bound by, mainly UK GDPR?
  2. Jurisdiction: whose laws can reach this data, and can someone outside the UK force it to be handed over?
  3. Control: who can read it, switch it off, or change the terms under us?

Most arguments about sovereignty are two people answering different questions. “AWS UK is fine” is a good answer to the first. “UK region isn’t UK control” is a good answer to the second and third. Both can be true at once.

Compliance: AWS UK really is fine

For UK GDPR, a US hyperscaler in a UK region is a normal, defensible choice. The data stays in the UK, the contracts are mature, the security is better than almost anything a small business could build itself, and transfers to the US are covered by the UK–US data bridge, in force since October 2023, if they happen at all.

The risk in practice is also low. AWS says it has made zero disclosures of enterprise or government content stored outside the US to the US government since it started reporting that figure in 2020.

So if your question is “will we pass an audit?”, then yes, for the large majority of what a typical business does, AWS London, Azure UK South or Google’s London region will do. I’m not going to tell anyone otherwise, and I won’t sell a rebuild to someone who doesn’t need one.

Jurisdiction: where the region stops helping

The region decides where the disks are. It doesn’t decide whose law the company follows.

AWS, Microsoft and Google are US companies. Under the CLOUD Act, a US court can order a US provider to hand over data in its “possession, custody, or control”, wherever in the world it’s stored (18 U.S.C. § 2713). That’s law enforcement, with a warrant. Separately, FISA Section 702 lets US intelligence agencies compel US providers to help with surveillance of non-US people abroad, without a warrant for each target. Congress keeps renewing it. For a UK business, 702 is arguably the bigger exposure, because it’s aimed squarely at people like us.

The UK also has its own deal with the US: the UK–US Data Access Agreement, in force since October 2022, which lets each country’s investigators request data directly from providers in the other for serious crime. It has safeguards, and it’s not a reason to panic. It is a reminder that “in the UK” and “only reachable under UK law” are different things.

The most honest summary of this came from Microsoft itself. On 10 June 2025, Anton Carniaux, Microsoft France’s legal director, gave evidence under oath to a French Senate inquiry into public procurement. He was asked whether he could guarantee that French citizens’ data held by Microsoft through public contracts would never be handed over on a US government order without the explicit agreement of the French authorities. His answer was: “Non, je ne peux pas le garantir, mais, encore une fois, cela ne s’est encore jamais produit.” That is: “No, I cannot guarantee it, but, once again, it has never happened yet.” He also said Microsoft fights requests it thinks are unfounded. Both parts matter: the probability is low, and the guarantee doesn’t exist.

For most data, a low probability is the right answer and you move on. For some data, such as client legal work, M&A, health records, defence supply chains, or anything a regulator or client has put in writing, “low” isn’t the standard you’re being held to.

Control: the risk nobody prices in

The third question isn’t about governments reading your data. It’s about someone else deciding what you can do.

In 2025, after the US sanctioned the International Criminal Court’s chief prosecutor, his Microsoft email account was disconnected and he moved to Proton Mail. Microsoft says it never cut off the court itself. The ICC has since started moving to openDesk, an open-source alternative, anyway. That’s an extreme case, but it shows the shape of the risk: a decision made in another country, for reasons that have nothing to do with you, can switch off a service you depend on.

The everyday version is less dramatic. Prices change. Terms change. Hosted AI models are retired on the vendor’s schedule, and a prompt that worked last quarter gives different answers on the replacement. None of that is a legal threat, but all of it is a control problem.

Why AI makes the gap bigger

This is the part that changed my mind about where the line sits.

The standard advice for sensitive data in a US cloud is to bring your own keys: encrypt everything, keep the keys in your own hardware security module, and if a warrant ever arrives the provider only has ciphertext to hand over. For data that’s stored, that’s a strong answer.

It doesn’t work for AI inference. To run a model over your contract, the contract has to be decrypted and sitting in the provider’s memory, alongside the prompt that asked about it. Enclaves and confidential computing narrow that window, but for GPU workloads they’re still niche, and for most hosted model APIs you’re relying on the provider’s policies and configuration, not on maths.

And look at what people actually put into prompts. Not the tidy, classified records in the database, but the draft redundancy plan, the client’s dispute, the board paper, the code. AI tends to pull your most sensitive unstructured data into the one place where encryption can’t follow it.

What about “sovereign clouds”?

The hyperscalers know all this, which is why they’re building separate offerings. The AWS European Sovereign Cloud went live in January 2026 in Brandenburg, Germany, physically and logically separate from the rest of AWS and run by EU-resident staff. Microsoft and Google offer their own versions and partner models.

These are a real improvement, especially for control. Two caveats for UK buyers: the AWS one is EU-only, so it doesn’t help a UK residency requirement, and the parent company is still American. Whether the “control” test in the CLOUD Act reaches a separately run European subsidiary is something lawyers argue about. It hasn’t been tested in court.

So who needs what?

Here’s how I’d split it for a typical professional services firm:

Workload Question that matters Usually enough
Email, CRM, website, everyday docs Compliance US cloud, UK region
AI help with general writing and code Compliance Business-tier AI service with no training on your data
AI over client files, HR, legal or financial data Jurisdiction UK/EU-owned hosting or private open-weight models
Anything a client contract or regulator rules out Control Your own hardware, or a provider you can audit end to end

Most businesses I talk to have a lot in the first two rows and a small but important amount in the last two. The answer isn’t to move everything out of AWS. It’s to know which row each workload is in, and to make the last two rows easy enough that people don’t paste client data into a public chatbot because the private option was too much hassle.

What I’ve changed

I’ve rewritten the offer page to say this directly. The Discovery stage now starts by sorting your workloads into these rows, and it’s perfectly possible that the answer for you is “your current cloud is fine for nearly all of it”. Where it isn’t, that’s where open-weight models on UK-owned infrastructure or your own kit earn their keep.

So thanks to the people who pushed back. You were right that AWS UK is fine. It’s just fine for a narrower set of things than the word suggests, and AI is quietly moving more work out of that set.

Sources