Nearly three-quarters of the 70 EU institutions examined by Dutch public broadcaster NOS routed email through servers operated by US companies. That finding helps explain the apparent contradiction between Brussels’ calls for greater technological independence and its continued reliance on American providers—but it does not mean that 70% of EU emails are stored in the United States.
What the “70%” figure actually measures
NOS examined DNS records associated with sending and receiving email for 70 EU institutions. It found that nearly three-quarters routed email through servers operated by US companies. DNS records help identify how email is directed and which servers handle it; they do not count individual messages or establish where every message is physically stored. NOS’s investigation
That distinction matters. Routing through a provider’s server does not, by itself, show that the provider stores a message, that the message is stored on US soil, or that a government has accessed it. NOS said it could not establish the European Commission’s physical email-storage location.
Why the Commission’s email setup drew attention
NOS reported that the European Commission’s email routes involved US-company servers, despite the Commission’s concerns about reliance on American big tech. After NOS made inquiries, a Microsoft receiving-server record configured for the Commission was removed. NOS also identified two other configured US servers that were generally used to filter spam and threats before forwarding email to the actual mail servers. This is a snapshot of records observed during the investigation, not a permanent inventory of the Commission’s setup. NOS’s account of its findings and inquiry
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware match#1 Best Overall
The reported configuration illustrates why a DNS finding should not be mistaken for a complete map of an institution’s email storage or security arrangements. A server can play a filtering or routing role without being the final destination for a message.
Why EU institutions rely on US email providers
The investigation establishes that US providers appear in the email routes of many institutions it examined; it does not identify a single reason behind each institution’s procurement decision. The policy tension is broader: institutions may depend on mature, integrated services while also wanting more control over critical technology and the ability to keep essential services running.
Email is a critical service, and institutions may weigh filtering, identity management, support, integration, reliability, legal obligations, and the practical ability to change suppliers. Provider nationality alone does not settle those questions. A useful assessment also asks which laws may apply to a provider, where data is stored, what contracts promise about access, and whether an institution can switch providers without unacceptable disruption.
Bart Groothuis, a Member of the European Parliament, told NOS that email must always work and regularly carries sensitive information, so control should be in European hands. Kim van Sparrentak, also an MEP, warned that “The US government can pull the plug at any moment.” That is a politician’s warning about dependence, not evidence that a shutdown is imminent: NOS reported that experts considered such a cutoff scenario highly unlikely for now. The investigation does not document US government access to the mailboxes involved. NOS’s report and quoted responses NOS’s findings
US providers are not used by every institution
NOS reported that the European Parliament, Europol, and the Court of Justice of the EU did not use American email servers. It identified the European Defence Agency, several financial-market regulators, and the EU anti-money-laundering and counter-terrorism-financing authority among Microsoft users; it said the European Central Bank used another American email service. These examples show that institutional choices vary, but the available reporting does not provide a like-for-like technical or cost comparison of the services. NOS’s institutional examples
Those alternatives show that using a US provider is not universal. They do not establish that a European provider is automatically more private, secure, reliable, or resilient. Those qualities depend on the service, its configuration, contractual terms, infrastructure, and the institution’s ability to manage disruption or migration.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How Brussels’ sovereignty plans relate to email
On 3 June 2026, the European Commission announced a broader technology-sovereignty package covering proposed Chips Act 2.0 and Cloud and AI Development Act measures, an EU Open Source Strategy, and a Strategic Roadmap for Digitalisation and AI in Energy. The Commission presented the package as a way to strengthen European capacity and widen choice in core technologies for businesses, citizens, and public administrations. The announcement does not identify a specific email-server migration measure, so it should be understood as broad policy context rather than a decision to move institutional email. European Commission policy announcement
Commission President Ursula von der Leyen said Europe cannot afford to depend on others for technologies that keep hospitals, energy grids, and services running, and called for Europe to turn its strengths into technological sovereignty. That ambition frames the dependency question; it does not show that the institutions in NOS’s investigation have changed providers. Von der Leyen’s statement
Recommended Free Tools
Quick Recap
Best Value
What the investigation does—and does not—show
- It shows: NOS found US-company servers in the email routing of nearly three-quarters of the 70 EU institutions whose DNS records it examined.
- It does not show: that 70% of EU email messages are stored in the United States, that all messages pass through the same kind of server, or that a government accessed any mailbox.
- It leaves unresolved: institution-by-institution physical storage locations and a comparable technical or cost evaluation of the providers named.
- It supports as a policy concern: scrutiny of strategic dependence, operational resilience, provider choice, and the practical ability to keep essential communications working.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
