The US government is no longer that reliable partner of Europe. That puts the unparalleled quality of American cloud platforms in a different perspective. That cloud is often also the place where CRM and CCaaS solutions land – including a whole range of supporting solutions to keep the cloud services running smoothly. What happens to customer service if existing regulations around data protection or even access to that cloud disappear?

 

Migrating to the Cloud: From a Technology Perspective no-brainer: and increasingly unavoidable. Because on-prem solutions not only offer too few innovation opportunities, they are also gradually being phased out - this also applies to contact center platforms. In addition, scalability is one of the most important properties of cloud infrastructure. And that is essential when using AI solutions. In short: the cloud is the standard and the future, also for customer contact and CX.

Safe and reliable business with American software companies and/or cloud providers has so far been made possible by various (transatlantic) data exchange treaties. The dependency on the US was not considered problematic. The result: the top 3 largest public cloud service providers (Amazon Web Services, Microsoft and Google) within IaaS & PaaS currently have more than 72% of the global market.

Why US cloud providers are becoming riskier

But recently, the standard for cloud has come under discussion, based on four factors: economic autonomy, geopolitical circumstances, continuity risks and compliance risks.

Following her re-election as President of the European Commission, Ursula von der Leyen has addressed the topic European autonomy and sovereignty high on the European agenda. This was reinforced by a report from Mario Draghi, former President of the European Central Bank and former Prime Minister of Italy. Main conclusion: the EU is extremely dependent on external parties in areas such as economy, defense and technology.

Shortly after, Trump’s rise to power has shaken up the world’s military and economic landscape. Expectations of his policies have put the use of American technology – including the cloud – in a different light. This dependency on ICT becomes problematic if the US loses support for data exchange treaties. decreases or even disappearsThe US has already indicated in 2023 that it will no longer agree to imposed restrictions on gathering intelligence via the data centers of American companies in Europe. The new policy is set out in black and white in Project 2025, the transformation program that American Conservatives have drawn up in 2023.

From Project 2025: “The United States has never seriously opposed the EU; now is the time. A new president should call for an immediate investigation into the implementation of Executive Order 14086 (aimed at aligning U.S. signals intelligence practices with European privacy rules) and suspend any provisions that unduly burden intelligence collection. At the same time, the United States should make clear in negotiations with the Europeans that continued intelligence sharing with EU member states depends on a successful resolution of this issue within the first two years of a president’s term.” (Source: Project 2025)

Risks

If the US withdraws its support for the current EU-US data exchange treaties, the use of US cloud solutions will no longer be GDPR-compliant. This would mean that a large proportion of European companies would be at risk of fines. European companies would also be at risk if the Trump administration orders big tech to stop providing services to specific companies or countries, or impose additional conditions.

In short, the dependency is a risk to compliance and business continuity. These risk areas are not new, by the way. Cloud providers can go bankrupt and/or be acquired; cloud providers can also choose to discontinue or severely limit products, services or support for them. An example of this is the recent announcement by Avaya to stop providing services to contact centers with less than 200 seats.

'European' clouds: real security or false solution?

The three hyperscalers AWS, Google and Microsoft, like other American tech companies, sense the concerns and have been playing on the growing concerns of European countries for some time now. For example, they offer a 'European cloud', with additional guarantees as a promise: customers can store and process their data within Europe. Examples include Microsoft Cloud for Sovereignty, aimed at customers in the public sector and government agencies, the AWS European Cloud, or Google's sovereign cloud for the German market. OpenAI also recently came up with a GDPR-friendly (marketing) offer. But how safe are these European variants of American cloud providers really?

Who's the boss of the power button?

While US providers can technically promise to keep data within Europe, the CLOUD Act the US always has legal grounds to demand data, regardless of where it is physically stored. This is of course at odds with the European GDPR. We have a similar situation in our own country: the Dutch AVG applies in accordance with the Intelligence and Security Services Act 2017 not for the Dutch AIVD. And although a court order is required for the American government (which is only honored if the judge can assume 'reasonable suspicion'), it is questionable whether this makes a significant difference in the Trump era. In addition to legal arguments to obtain access to data, there are, as mentioned, sufficient other mechanisms of influence to enforce that access - think of political pressure or economic sanctions.

Switching: yes, no or partially?

The question is how companies and governments can and want to respond to these developments, which are also relevant for the course and choices of (local) system integrators and implementation partners.

The question naturally starts with a good analysis of the situation, which will have a different effect for every sector and organization – and also for all kinds of different parts of the IT landscape. To what extent is dependency a problem? Does the problem apply to all facets of IT or can you run your e-commerce website perfectly well in an Azure cloud? What risks are there and what is their role – from fines from supervisors to continuity problems?

Bart Veldhuis, cloud architect at Rapid Circle

How do you arrive at decision-making? – The current debate on digital sovereignty would benefit from nuance, says Bart Veldhuis (cloud architect at Rapid Circle). He points out that when using cloud, a risk-based approach is always essential. Certain risks are continuously relevant. Veldhuis mentions geopolitical tensions ('of all times') and the changes in regulations regarding data exchange with the US as examples (think of the aforementioned CLOUD Act and its predecessor Patriot Act).

Veldhuis does see that American hyperscalers are doing a lot to meet the needs of the European market as well as possible. But completely disconnecting from the US is “almost impossible”, which means that the possibility of unwanted interference is almost impossible to prevent. In addition to the risk assessment that you have to do ('chance times impact'), there are all kinds of risk-mitigating measures conceivable. Think of encryption and key management; another measure is not to transfer critical data to the cloud.

Veldhuis emphasizes: the large American providers have enormous commercial interests in the European market. They will do everything in their power to keep their services safe for EU users. When asked, Veldhuis indicates that – given the developments – it is certainly not too early for additional mitigating measures: “you have to take them now”. He is thinking mainly of measures such as local data backups, and preparing and setting up alternative application capacity, for example to be able to perform a recovery.

Are there European data centers and SaaS solutions?

For companies considering a move, both for cloud infrastructure and application landscape, there is plenty of choice. There are many European data centers that are European owned. Computable mentions OVHcloud, T-Systems, Outscale, Scaleway, Data4 Group, NorthC Datacenters and TaigaCloud, among others. They offer colocation, hosting and cloud services in many European and other countries. In addition, Sovereign Cloud Stack (SCS) and EuroStack are mentioned as examples of blueprints for a European cloud infrastructure.

Computable also lists various core applications for the workplace that can match Microsoft 365 or Google Workspace, such as Nextcloud, Proton Mail and even a European web browser (Vivaldi). The question is whether smaller cloud providers have sufficient scale to maintain competences, capacity and facilities in the field of security.

In addition to the cloud infrastructure, there are dozens of European contact center platform providers in the field of CCaaS solutions. The investment in time and money required for switching CCaaS platforms obviously depends on the complexity of the contact center and the availability of APIs with other SaaS solutions such as CRM or ERP, WFM, AI applications, Quality Monitoring, Social media, etc.

Moving to the cloud: these are the obstacles you will encounter

But choosing a European data center and a European CCaaS provider does not mean you are free from your dependency on American technology. This is also clearly present in other layers of the cloud stack or the IT landscape in which your CCaaS solution runs. Making different choices therefore has far-reaching technical, financial and business economic implications. That is precisely why it is advisable to think about possible scenarios including possible solutions. More about those challenges in part 2 of this series: Switching to 'CCaaS made in EU': not a piece of cake.

(Ziptone/Erik Bouwer)

Featured, Knowledge base, Technology