Microsoft's legal director for France said the cloud provider cannot guarantee that French user data won't be transmitted to the United States under government orders.

Speaking before a French Senate inquiry into public procurement and digital sovereignty, Anton Carniaux told lawmakers under oath that Microsoft “cannot guarantee” French citizens' data held through public contracts would remain protected from U.S. authorities without local consent. However, he noted that such a demand has never occurred.

Carniaux’s comments come as European governments and lawmakers are looking to double down on data sovereignty to reduce reliance on U.S. businesses and keep data within the bloc.

Microsoft, along with its hyperscaler competitors, is subject to the Cloud Act, which provides U.S. authorities with sweeping powers to force American businesses to hand over requested data regardless of its storage location.

The testimony came amid questions about Microsoft's handling of recent sanctions.

Earlier this year, the Associated Press reported that Karim Khan, the International Criminal Court’s (ICC) chief prosecutor, lost access to his Microsoft email account after the Trump administration hit the official with sanctions as it disputed investigations of human rights abuses in Gaza by Israel. Microsoft president Brad Smith said in May that the company “did not in any way involve the cessation of services to the ICC.”

Despite Smith’s denial, French lawmakers pressed Carniaux on the subject, but he denied the claims, calling press reports “false” and insisting the company “never suspended or cut off access.”

The company is contractually bound to resist unfounded requests, Carniaux explained, employing what he described as a “very rigorous system” that forces U.S. agencies to precisely define their demands.

Carniaux pointed to the company's reporting system, pointing to transparency reports published twice yearly that show no European company has been targeted by such requests. Committee president and Socialist Party senator Simon Uzenat pushed back, however, calling the reports “purely declarative” with no external oversight.

Pierre Lagarde, Microsoft France’s technical director for the public sector, told the committee that the company has been working to “minimize data transfers and keep them on European soil.”

“Since January 2025, under a contractual guarantee, our European customers' data will not leave the EU, whether at rest, in transit, or being processed, or whether it is data generated by application logs, including for the support part,” Lagarde told lawmakers. “This work is important to secure and minimize these technical transfers.”

Sacré bleu

The testimony centered partly on Microsoft's role in Bleu, a sovereign cloud venture created by Capgemini and Orange.

As technology partner for Bleu, Microsoft will provide access to its 365 solutions and Azure services, which would be delivered to French customers via an “independent environment.”

Carniaux confirmed that Microsoft had not taken a stake in Bleu, though Lagarde said that the company had made investments into the project, which would “guarantee the complete autonomy” for a company that’s “100% French.”

Carniaux rallied against recent claims that U.S. government intervention would impact Bleu’s ability to operate, saying, "Microsoft provides the technology, but the data center operated by Bleu will be its property.”

“Regarding updates, we know that some people who appeared before your committee have suggested that if there were a shutdown following a decision by the U.S. government, the cloud would no longer be operational," Carniaux added. "This is not true, and it certainly wouldn't happen in a matter of days.”

Lagarde supported that notion, stating, “indeed, the cloud would remain operational for a very long time.”

Senator Uzenat said the inquiry was previously told a potential shutdown could hypothetically occur within “a few weeks or a few months.”

“Not at all,” Lagarde countered, “there is no reason for such an interruption to occur. The system will run, like any solution currently based in a data center hosted by a company, as long as it is supplied with electricity.”