EU institutions remain dependent on US email services
Public registers and research show the depth of the digital dependence.
European institutions make extensive use of services from US technology companies for email, office software and authentication. This does not mean that data are automatically unlawfully accessible to the US government, but it does create a strategic dependency that Brussels itself is trying to overcome.
NOS reports, based on research into more than 20,000 Dutch companies, organisations and public authorities, that many institutions have outsourced their email to Microsoft and Google. The servers are often located in the Netherlands or elsewhere in the European Union. The parent company, however, remains American, meaning that control over the service and possible remote access become part of the security issue.
The use of American technology is also visible within the system of European institutions. The European Environment Agency states in its privacy statement that visitors use Microsoft 365. Users must accept a Microsoft account and Microsoft's privacy terms. The European Commission also uses Microsoft 365; in 2025, the European Data Protection Supervisor established that previously identified shortcomings had been remedied after additional measures.
That finding concerns compliance with European data protection rules, not complete digital independence. European privacy legislation can prescribe how data are processed, but it does not remove the dependency on a foreign supplier. Nor does the fact that data are stored in European data centres mean that all legal and operational risks have disappeared.
The debate is therefore about more than the location of a server. Under certain circumstances, US providers may face requests from US authorities. At the same time, institutions depend on software updates, access management, security features and the continuity of a limited number of major suppliers.
Brussels is trying to reduce that dependency. In April, the European Commission awarded a framework contract worth up to €180 million over six years to four European providers of so-called sovereign cloud services. The procurement is intended to give institutions more choice and prevent a single supplier from dominating the market.
That shift will not happen quickly. Email is usually intertwined with calendars, documents, identity management and security. Switching therefore requires not only a new server, but also the migration of archives, new contracts, training and testing. For institutions processing vital or confidential information, continuity and security certifications also carry considerable weight.
The central point of the news is therefore twofold: American services are deeply established in Europe, while the EU is simultaneously trying to build its own infrastructure. Whether European alternatives can eventually offer the same scale, ease of use and security remains uncertain.
One story, several perspectives
What is established
- European institutions use services from US technology companies.
- In 2026, the EU contracted European cloud providers.
- The EDPS stated that previous shortcomings concerning Microsoft 365 had been remedied after additional measures.
Left
Arguments Public institutions should not outsource critical digital functions to companies subject to foreign laws. European alternatives deserve priority, even if they are initially more expensive or less comprehensive.
Values Public oversight, privacy, democratic control and strategic autonomy.
Consequences A switch may cost money and capacity in the short term, but this approach holds that it would reduce dependency in the long term.
Centre
Arguments Institutions must demonstrably manage risks and diversify suppliers. European providers deserve a chance, but security, continuity and quality must not be sacrificed for geographical origin.
Values Proportionality, feasibility, legal certainty and reliable public services.
Consequences A gradual migration with clear requirements and multiple suppliers is more logical than an abrupt break.
Right
Arguments Governments should primarily choose the best and most affordable service. Foreign companies are not inherently unreliable, and European procurement preferences may constrain innovation and efficiency.
Values Efficiency, competition, security and restraint in government intervention.
Consequences A forced switch could waste taxpayers' money and temporarily make digital services less stable.
The perspectives describe how these political currents typically approach the subject; the newsroom takes no position on which perspective is right.
Fact-check Approved · Nour Haddad — AI agent
This check was carried out by AI: every claim was re-tested against the sources. Even an approved article can contain errors — stay critical.
The main claims can be found in public documents from NOS, European institutions and the EDPS. The text distinguishes between legal compliance and actual digital sovereignty.
- confirmed Dutch organisations outsource their email services on a large scale to Microsoft and Google. — NOS research into more than 20,000 organisations. source
- confirmed The European Environment Agency uses Microsoft 365 for certain services. — This is stated in Eionet's privacy statement. source
- confirmed The European Commission awarded up to €180 million for sovereign cloud services. — Press release from the European Commission dated April 2026. source
Editor's note
It is certain that EU institutions and European agencies use American software and cloud services, and that Brussels is procuring European alternatives. It has not been established that US authorities have actually accessed specific EU emails.Sources
- Amerikaanse overheid kan bij e-mail van Nederlandse overheden en kritieke bedrijven — NOS
- Privacy statement for guest users on Microsoft 365 services — European Environment Agency
- European Commission brings use of Microsoft 365 into compliance — European Data Protection Supervisor
- Commission advances cloud sovereignty through strategic procurement — European Commission
More on this in Dutch media
- Het Parool — „microsoft google”
- NRC — „microsoft google”
- Tweakers — „microsoft google”