Ireland's Data and AI Sovereignty

In November 2022, Minister Michael McGrath signed a three-year Memorandum of Understanding with Microsoft Ireland, designating the entire Government of Ireland as a single Microsoft customer. The agreement provides preferential pricing on Microsoft 365 cloud solutions across all Public Service organisations. Microsoft was simultaneously granted pro bono access to run a Product Innovation Programme inside government, shaping how departments adopt Microsoft technology. The MoU came into effect on 1 November 2022. In November 2025, the Taoiseach personally attended Microsoft's 40th anniversary celebration in Ireland.

Microsoft 365 Copilot is an AI assistant embedded across Word, Outlook, Teams, SharePoint, and Excel. When a civil servant uses Copilot to draft a memo, summarise a briefing document, prepare a parliamentary question response, or process correspondence, Copilot assembles the relevant content, including email threads, SharePoint documents, Teams conversations, and calendar data, into a package that is transmitted to Microsoft's large language model for inference. Any data an employee has access to in Microsoft 365 is potentially accessible to Copilot. In government, this means policy drafts, ministerial communications, cabinet submissions, citizen records, procurement data, and security briefings.

In November 2025, Microsoft announced in-country data processing for Microsoft 365 Copilot in 15 countries: Australia, India, Japan, the United Kingdom, Canada, Germany, Italy, Malaysia, Poland, South Africa, Spain, Sweden, Switzerland, the UAE, and the United States. Ireland is not on this list. Irish government data falls under the broader EU Data Boundary, which Microsoft itself has been found to violate. The European Data Protection Supervisor investigated the European Commission's use of Microsoft 365 and found it infringed EU data protection law on international transfers, purpose limitation, and unauthorised disclosures of personal data.

In April 2026, Microsoft introduced Flex Routing for Microsoft 365 Copilot in the EU and EFTA. Flex Routing allows Microsoft to reroute AI inference requests to data centres in the United States, Canada, or Australia when European data centre capacity runs short. For new Microsoft 365 tenants created after 25 March 2026, Flex Routing is enabled by default. For existing tenants, it was rolled out on 17 April 2026. This means Irish government emails, policy documents, and citizen data can be inferenced on American soil, at Microsoft's discretion, based on capacity constraints the Irish government has no visibility into or control over.

The United States CLOUD Act (Clarifying Lawful Overseas Use of Data Act, 2018) grants US authorities the legal power to compel any US-headquartered technology provider to hand over data in its possession, custody, or control, regardless of where that data is physically stored. Microsoft is a US-headquartered corporation. In June 2025, Microsoft's own French subsidiary confirmed under oath at a French Senate hearing that it cannot guarantee data sovereignty against US authorities, even for data stored on French soil under a French-marketed sovereign cloud offering. The EU Data Boundary is a marketing construct, not a legal shield.

The European Data Protection Supervisor's investigation into the European Commission's use of Microsoft 365, opened in May 2021 following the Schrems II judgment, found multiple infringements of Regulation (EU) 2018/1725. The Commission failed to provide appropriate safeguards for international data transfers, did not sufficiently specify what personal data was being collected or for what purposes, and permitted unauthorised disclosures. The Commission was ordered to bring its usage into compliance. If the European Commission itself could not use Microsoft 365 lawfully, on what legal basis does the Irish Government believe it can?

In June 2026, the United States issued an executive order imposing mandatory 30-day data retention on all AI providers operating in US jurisdiction, overriding existing zero-retention commercial agreements. Anthropic's Fable 5 model release included silent behavioral profiling and response degradation capabilities that were disclosed only after deployment. Microsoft suspended its Azure AI partnership within days. This is not hypothetical risk. A government that routes its intelligence through US-headquartered AI infrastructure has already ceded the ability to prevent its own data from being retained, profiled, and potentially disclosed under US law.

Ireland's National AI Strategy 'AI - Here for Good' (2021) and the subsequent Digital and AI Strategy contain no provision for sovereign AI inference infrastructure. There is no Irish language model, no government-controlled inference pipeline, no national data centre for sensitive state computation. Meanwhile, France has invested in Mistral AI, the UAE has built the Falcon series, Saudi Arabia operates ALLaM, India has BharatGPT, the United Kingdom has committed to sovereign AI compute, and even the municipal government of Rio de Janeiro, Brazil, has released a frontier-competitive 397-billion parameter open model (Rio 3.5 Open) under MIT licence. Ireland, a country that hosts the European headquarters of most major technology companies, has built nothing.

The Government of Ireland must commission an immediate Data Protection Impact Assessment on the use of Microsoft 365 Copilot across all Public Service organisations. The terms of the 2022 Microsoft MoU must be published in full and subjected to parliamentary scrutiny. Flex Routing must be disabled across all government tenants with immediate effect. A sovereign AI inference capability must be established, beginning with Irish-language and public-service-specific models running on infrastructure under Irish legal jurisdiction. No sensitive government data should be processed by AI systems subject to the CLOUD Act or any equivalent foreign legislation. The 2028 renewal of the Microsoft MoU must not proceed without these safeguards.