Why Switzerland Wants Less Dependence on Microsoft: The CLOUD Act and Digital Sovereignty

Why Switzerland Wants Less Dependence on Microsoft: The CLOUD Act and Digital Sovereignty

By Binary-Tech Institute | 21 October 2026

Who controls a government’s information when its everyday work depends on a foreign technology company?

Switzerland is taking that question seriously. Its federal administration is developing an open-source workplace platform intended to give it more control over essential services and reduce its dependence on Microsoft.

A complete replacement of Microsoft 365 has not been approved. The current programme will provide an alternative alongside it, with around 3,000 employees expected to have access from late 2027. The estimated cost of the first phase is CHF 9 million.

The reasons reach beyond software preferences. They include the ability to keep working during disruptions, protect sensitive information and manage exposure to foreign laws—including the US CLOUD Act.

What Switzerland is actually planning

The Swiss Federal Chancellery announced the programme on 2 September 2026, following its BOSS feasibility study into open-source office software. The initial deployment targets employees involved in particularly critical government processes.

The platform is intended to cover email, calendars, documents, presentations, telephone calls and video meetings. Whether it eventually replaces the wider Microsoft workplace environment will be decided later.

On 6 October, the government announced that the programme had been designated a federal IT key project. This signals that it has moved beyond an informal experiment.

Yet Microsoft remains deeply embedded. The federal administration completed its Microsoft 365 rollout across approximately 54,000 workplaces in December 2025. Switzerland is therefore maintaining its existing services while developing another option.

The CLOUD Act: can US authorities reach data stored in Switzerland?

Yes, in certain circumstances. A Swiss storage location alone does not prevent a US disclosure order from reaching the data.

The CLOUD Act, enacted in 2018, clarified the obligations of covered communications and remote-computing providers subject to US jurisdiction. Under 18 USC §2713, their disclosure obligations extend to information within their possession, custody or control, even when that information is stored outside the United States.

For example, storing documents in a Swiss data centre operated by a provider subject to US jurisdiction does not automatically place those documents beyond the reach of valid US legal process. The relevant questions include which entity controls the information and whether the legal demand applies to it.

There are important limits. The CLOUD Act does not give American officials unrestricted access to every customer’s files. Authorities still need the applicable legal authority and process. The US Department of Justice describes the law as clarifying access to data held abroad by providers already subject to US jurisdiction. The legislation also establishes a framework for bilateral agreements concerning electronic evidence.

The concern for Switzerland is therefore about legal exposure and control. It is not evidence that US authorities are routinely reading Swiss government documents.

Why a Swiss data centre is only part of the answer

Data residency describes where information is stored. Data sovereignty asks a broader question: who can control that information, under which laws, and through which technical capabilities?

A useful assessment considers several separate issues:

QuestionWhy it mattersWhere is the information stored?Determines its physical location and some applicable obligations.Which organisations control it?Ownership, corporate structure and jurisdiction can affect legal exposure.Who can read or decrypt it?Storage location does not establish who has technical access.Who operates the service?Administrators, contractors and support teams may introduce dependencies.Can the customer move elsewhere?Exporting files is only one part of replacing a working system.

Swiss regulators have raised these concerns directly. In its 2024/25 annual report, the federal data protection commissioner called for assessment of foreign-authority access risks and dependence on dominant cloud providers.

Zurich’s data protection authority has also issued guidance addressing Microsoft 365 and the CLOUD Act. For particularly sensitive information and certain protected records, its guidance requires encryption that prevents the provider from accessing the data without the municipality’s involvement.

This makes the design of access controls and encryption central to the discussion. Saying that data is encrypted does not, on its own, answer whether the provider can access it.

What does Microsoft say?

Microsoft states that government demands must comply with applicable laws. It says it evaluates requests, rejects or challenges inappropriate demands, and notifies customers when legally permitted.

The company also says the CLOUD Act preserved existing legal and privacy protections and that providers can challenge orders where conflicts of law arise. These safeguards matter when assessing the risk.

Our assessment is that Switzerland’s concern remains understandable even with these protections. A government may value a supplier’s commitment to challenge a demand while still wanting fewer critical services exposed to that legal conflict in the first place.

Sovereignty also means being able to keep working

Foreign access to information is only one part of digital sovereignty. Another is whether public services can continue operating when a major platform becomes unavailable.

Switzerland’s BOSS study explicitly examined an independent office environment for critical processes during a crisis, alongside secure handling of sensitive information. It also reviewed the feasibility of a Microsoft 365 exit strategy.

From our perspective, an alternative becomes valuable when staff can actually use it. A collection of exported documents offers limited protection if employees cannot sign in, communicate or continue essential workflows elsewhere.

That is why testing matters. An exit plan needs working software, trained people and procedures that have been practised.

There is also a commercial benefit to having a credible alternative: an organisation gains more room to negotiate prices, contract terms and future changes. That is our analysis of the strategy, rather than a claim that Switzerland has already demonstrated financial savings.

Which open-source tools has Switzerland tested?

The BOSS study used openDesk, a suite that brings together several open-source applications.

FunctionProduct evaluatedDocuments, spreadsheets and presentationsCollabora OnlineEmail, calendars, contacts and tasksOpen-XchangeFile storage and sharingNextcloudProject managementOpenProjectInternal knowledge and documentationXWikiVideo conferencingNordeck using JitsiChatElementIdentity and access managementUnivention

The study involved 172 participants. Document editing, file storage, collaboration, email and calendar functions received particularly positive assessments. These are evaluated products, not a guarantee that every component will remain unchanged in the eventual deployment.

Why open source can help—and where it falls short

Open-source software makes its source code available for inspection, modification and redistribution under its licence. The Swiss Federal Chancellery identifies this as a way to support independence and control over applications.

Our view is that its strategic value depends on the organisation’s ability to use those freedoms. Source-code access is more useful when a government has qualified staff, reliable support providers and the capacity to change how a service is operated.

Open source does not automatically make a system secure or sovereign. Its hosting arrangements, administrators, suppliers and maintenance still matter. A poorly supported deployment can create serious operational problems, regardless of the licence.

Switzerland’s own tests exposed limitations, including difficulties with large video conferences. The government also identified substantial implementation work and the challenge of applications closely connected to Microsoft’s architecture.

The fair comparison must therefore include migration, training, support, compatibility and ongoing operation. Licence costs alone cannot establish which option offers better value.

Switzerland already restricts sensitive cloud use

The federal administration has introduced controls around its existing Microsoft 365 deployment. Its published policy prohibits storing particularly sensitive or confidential documents in Microsoft’s cloud. Documents labelled sensitive remain in the federal administration’s own data centres.

That helps explain the gradual approach. Switzerland is applying safeguards to its current environment while developing additional capabilities for the future.

It also shows why the story should not be reduced to a claim that Switzerland has banned Microsoft. The government is managing a complex dependency while preserving services that people already use.

Our perspective: a credible alternative changes the relationship

At Binary-Tech Institute, we see the strongest part of this approach as the effort to make choice practical.

A government that cannot realistically change suppliers has limited control over the direction of its technology. Building an alternative gives it a way to test assumptions, understand migration costs and decide which functions require greater independence.

The CLOUD Act makes one issue particularly clear: the location of a server does not settle every question about control over its data. Legal jurisdiction, technical access and operational dependence all deserve attention.

The lesson for businesses is to ask concrete questions before committing essential work to any platform:

• Who controls our information and who can access it?

• Which jurisdictions apply to our providers?

• Which services must continue during an outage?

• Can we restore and use our data outside the current platform?

• -Have we tested that ability?

Switzerland’s programme will have to prove that its alternative can work reliably at scale. Its significance today is that the federal government is investing in the ability to make that choice.

Sources and further reading

• - Swiss government: Programme for a digitally sovereign workplace, 2 September 2026

• - Swiss Federal Chancellery: BOSS feasibility study and evaluated technologies

• - 18 USC §2713: Disclosure obligations for information stored inside or outside the United States

• - US Department of Justice: CLOUD Act resources

• - Canton of Zurich: Microsoft 365 guidance for municipalities

• - Microsoft: Public-sector cloud guidance and government data requests