Most German Companies Say They Depend Too Much on US Cloud. Legal AI Buyers Are Listening.

In June 2026, Bitkom, the German digital industry association, published its Cloud Report 2026. Bitkom surveyed 603 companies in Germany with 20 or more employees by telephone between calendar weeks 14 and 20 of 2026, and describes the survey as representative. Of those companies, 85% said Germany is too dependent on US cloud providers, up from 78% a year earlier. In the same survey, 37% said they would use a cloud service that processes data only in Germany and protects it from foreign access, even at the cost of disadvantages such as fewer features or a higher price. A year earlier that share was 27%.

The survey covers companies across the German economy rather than law firms or legal departments, so it says nothing directly about legal technology. It does describe the climate in which a German client, its in-house counsel and its outside lawyers now weigh any service that will read their documents, and document review handles some of the most sensitive material a company holds.

This story sets out the survey's findings, the professional rules that give them extra weight for German lawyers, and the questions a review team can put to any AI provider, including us.

What the Bitkom survey found

The headline figure is the 85%, but the more useful numbers for a buyer concern trade-offs. According to Bitkom's release, 25% of companies would accept longer waits for new functions in exchange for that kind of service, 17% would accept worse usability or service, 14% would do without individual features and 12% would accept a price 10 to 20% higher. Each is a separate answer in the survey, and the shares cannot be added together.

The report also shows a gap between what companies use and what they say they would choose. Bitkom found that 71% of companies currently obtain cloud services from the United States, while 53% use providers from Germany and 91% would prefer German providers. For artificial intelligence, which Bitkom calls the largest growth driver, 42% of companies use AI services from the cloud today and 69% intend to within five years. Demand for AI services is rising alongside concern about where those services run, and document review sits where the two meet.

Why the question carries more weight for lawyers

A German company deciding where its own data goes answers mainly to itself and to data protection law. A German lawyer deciding where a client's documents go also answers to the professional rules. Under § 43e of the Federal Lawyers' Act (BRAO), a lawyer may give a service provider access to facts covered by professional confidentiality only so far as the service requires it, must choose the provider carefully and must set out the provider's confidentiality obligations in a contract in text form. Where the service is provided abroad, paragraph 4 allows access to client secrets only if the protection there is comparable to the protection in Germany, unless the protection of the secrets does not call for it.

The survey's phrase about protection from foreign access points to a second issue, which turns on who the provider is. The US CLOUD Act was enacted in March 2018, according to the Department of Justice. One of its provisions, 18 U.S.C. § 2713, requires a provider of electronic communication or remote computing services to preserve, back up or disclose data in its possession, custody or control, regardless of whether the data is located within or outside the United States.

How these rules apply to a given matter is a question for the lawyer responsible for it, and this story offers general information only. For a buyer, the practical point is that residency and access are two separate questions, and an answer to the first does not settle the second.

Questions to put to any review provider

A litigation support team assessing an AI review tool can turn those two issues into a short set of questions for each provider. The first concerns location. Ask for the country of processing for the documents and, separately, for the language model, since an application hosted in one region can call a model hosted in another.

The second concerns retention. A provider should be able to say plainly whether it keeps document text or the answers its tool produces. It should also be able to show the terms that bind the model provider behind it on logging content and on training.

The third concerns control and exceptions. Ask about the holder of the encryption keys for stored data, the infrastructure the service runs on and any data that leaves the region, such as notification emails. It is also worth asking whether there is an option in which documents stay in your own environment for inference. The answers belong in the file you keep on the provider and in the conversation with your client.

How Claira answers them

Claira is AI document review built into Nuix Discover. A reviewer writes a prompt, tests it on single documents and then runs it across a set as a bulk scan, with each answer written to a field in Nuix Discover. Our help centre's Privacy and Security article sets out how data is handled, and this section follows it.

Claira runs separate regional deployments, with no replication between them and no transfer of customer content from one to another. The help centre states that each customer's data stays in the country of the deployment it uses, and Claira can keep a case's data in the EU. Model requests are processed only within the deployment's country, and Claira refuses to send a request to a model that is not approved for the deployment. Model providers must not use documents, prompts or results to train or improve their models, and must not log, cache or store content once they have returned a response.

Claira does not store the content of documents or the answers its scans produce: answers are written to the customer's fields in Nuix Discover. Content is kept only where a customer chooses to create it, such as feedback, Agent Mode chats, Insights, Case Contexts and early case assessments. Each deployment runs on Google Cloud within an Assured Workloads workload that enforces location restrictions at the platform layer, and databases and media staging buckets are encrypted with keys that Claira controls in place of the cloud provider's default keys.

Email is the one exception the help centre names. Email service providers in the United States receive recipient names, email addresses, language, region and the content of Claira's emails. They do not receive document content or AI answers.

For teams that want the model itself under their own control, Claira Private lets a customer connect its own model endpoint. The help centre says plainly that Claira's residency guarantees stop at that endpoint, and that with a local model the document content stays on the reviewer's machine for inference.

Where to start

The Bitkom figures suggest that many companies in Germany now weigh control of their data against features, speed and price. For a review team, a sensible first step is to put the questions above to every provider on the shortlist, in writing, and to keep the answers with the rest of the provider file. We described Claira's launch for customers in Germany and the rest of Europe in our story on Claira's availability in Germany and Europe.

If you would like to go through our answers with the team, or see Claira working on your own documents in Nuix Discover, you can book a session with us.