In brief: A US court ruling has weakened a pillar of the EU-US data protection agreement, prompting a Golem.de guide to analyze which Microsoft functions can be migrated to European alternatives by 2026 and where dependencies remain.
A US court ruling has removed a load-bearing pillar of the EU-US data protection agreement, making the question of switching away from Microsoft services more urgent for IT departments in Europe. A Golem.de guide shows what can be migrated in 2026 and where European alternatives hit their limits.
According to the report, a ruling by a US court has damaged a load-bearing pillar of the EU-US Data Privacy Framework, on the basis of which many European companies have so far justified the transfer of personal data to the US. This brings the question of how strongly organizations depend on US cloud providers such as Microsoft back into sharper focus for IT decision-makers. The article by Golem.de, written by Steffen Zahn, assesses what European alternatives to Microsoft products can deliver today and where they still fall short.
For CTOs at DACH companies, this development is relevant for several reasons. First, renewed legal uncertainty around data transfers to the US risks a scenario similar to the collapse of the Privacy Shield in 2020 – with the consequence that contractual bases for M365, Azure or other Microsoft services would need to be reassessed. Second, political and regulatory pressure is increasing to anchor digital sovereignty not merely as lip service but as a concrete migration strategy – for instance in the public sector, in regulated industries, or at companies holding sensitive data.
According to the announcement, the guide takes a practice-oriented perspective: it identifies which functional areas – such as office applications, collaboration, identity management or cloud infrastructure – can realistically be switched to European providers already in 2026, and where dependencies on Microsoft ecosystems (for example through deep integration with Active Directory, Exchange or proprietary APIs) currently make a complete switch difficult. For IT leadership, this concretely means that migration planning should not be treated as a binary decision but designed as a gradual process, prioritized by data-protection criticality and technical feasibility.
CTOs should use the full article as a basis for initiating an internal inventory of their own Microsoft dependencies – particularly for data processing that falls under the GDPR and whose legal basis could be called into question in the event of further regulatory tightening. A robust exit or multi-vendor strategy reduces the risk of short-notice forced migrations under time pressure.
Source: www.golem.de · Published August 18, 2026
Lumi AI News — AI-assisted curation pursuant to Art. 50 EU AI Act. Paraphrasing and classification by Lumi News Pipeline v1.8.3.