Thought Leadership
On June 29, the U.S. Supreme Court ruled in Trump v. Slaughter that the independence of the Federal Trade Commission (FTC) is unconstitutional.
Since then, the president has been able to remove the agency’s commissioners at any time and without cause. At first glance, this may look like a matter of U.S. domestic politics. In reality, it has direct implications for European businesses. The FTC’s presumed independence was a legal foundation underpinning data transfers between the EU and the United States.
The EU U.S. Data Privacy Framework, which has been in effect since 2023, requires independent oversight of data processors, a role performed in the United States by the FTC. Just how central the agency is to the framework can be seen in a single figure: The European Commission’s adequacy decision refers to the FTC’s oversight role 259 times. If the agency’s independence disappears, the agreement loses one of its core assumptions.
Max Schrems, whose legal challenges helped bring down Safe Harbor in 2015 and the Privacy Shield in 2020 before the Court of Justice of the European Union, has already called on the European Commission to withdraw from the framework in an orderly manner and announced a new lawsuit. Observers are already referring to a potential “Schrems III.”
Nothing changes immediately. The agreement formally remains in force until the European Commission withdraws it or the European Court of Justice strikes it down, and no company needs to expect a warning letter tomorrow. But the risk landscape has shifted. Hundreds of thousands of European businesses run their day to day operations on major U.S. services, and that entire software stack is now subject to a legal uncertainty that few had previously considered.
Anthropic’s temporary shutdown of its Fable 5 and Mythos 5 AI models for foreign users a few weeks ago offered an early glimpse of what this can look like. Following an order from the U.S. government, access to the models was blocked for users outside the United States. Access has since been restored. Unlike a temporary restriction that eventually disappears, however, the FTC ruling challenges the legal foundation itself.
In my view, the real lesson from both developments is not a technical one. It is a business decision.
From an IT Issue to a Leadership Decision
Many companies have long treated cloud and software services like electricity from a wall socket: always available and always there. The current case shows how misleading that assumption can be. This is not about a technical outage or a vendor pricing decision. It is about a shift in the legal framework caused by a foreign court ruling.
That puts the issue in an entirely different risk category. Cybersecurity and data privacy professionals have warned about precisely this kind of scenario for years. From a management perspective, there is another important takeaway. Whether a company makes itself dependent on a single provider or a single legal jurisdiction is a business risk decision. As such, it belongs in the executive suite.
Unpopular Regulation Is Already a Ready Made Contingency Plan
Ironically, I see the greatest opportunity in an area many mid sized companies have so far viewed primarily as a burden: regulation.
The GDPR, NIS2 and the EU AI Act are often dismissed as bureaucracy that slows businesses down. The current situation turns that assumption on its head. Companies that have taken the GDPR seriously already maintain records of their processing activities and know which personal data is transferred to the United States through which service providers.
Since the NIS2 requirements took effect on December 6, lawmakers have also required systematic risk management, robust business continuity structures and a clear view of the company’s service providers. The AI Act adds transparency and documentation requirements covering the lifecycle of AI systems in use. Companies that meet these requirements already have much of the information needed to respond to an incident like this. A regulatory obligation thus becomes a tangible competitive advantage: the ability to act while others are caught off guard.
What Companies Should Do Now
I recommend using this case as an opportunity to take a few pragmatic steps that are feasible even without a large legal or IT department. The first is an honest inventory of your data flows. Which services process personal data in the United States, and what legal basis currently supports those transfers?
Next, review your existing data privacy documentation. Contracts, Standard Contractual Clauses and transfer impact assessments often rely on oversight by U.S. authorities whose independence is now being called into question. These documents should therefore be reviewed and updated as necessary.
For every new implementation, companies should seriously consider whether a European alternative is available. For critical components, it is also advisable to establish a second source. Stronger AI governance is equally important. Companies need a centralized overview of which AI services are actually being used. That includes unofficially deployed shadow AI. Ultimately, the key question is what data is being processed by these systems.
Digital Sovereignty Means Control and Freedom to Act
I do not see digital sovereignty as a political slogan or a call for isolation. It means remaining capable of acting in an uncertain environment and avoiding one sided dependencies. The FTC ruling is simply the latest and most visible example of a structural imbalance. According to Bitkom, 85 percent of companies believe Germany is too dependent on U.S. cloud providers, up from 78 percent a year ago.
The infrastructure that runs our business processes and stores our data is, in most cases, outside our control. Companies that consider European alternatives with every investment and keep their data under their own control can build trust. “Made in Europe” is becoming a quality mark that customers are increasingly asking for.
That does not mean companies need to replace their entire software stack overnight. Doing so would be just as unwise as blindly trusting a single provider. But companies that understand where they are vulnerable today and have the ability to choose between providers secure the most valuable asset in uncertain times: the freedom to continue deciding for themselves what their digital future looks like.
