Data Sovereignty Investigation

Ireland's data and AI sovereignty

An investigation into the Irish Government's wholesale adoption of Microsoft 365 Copilot across the Public Service, the absence of sovereign AI infrastructure, and the legal mechanisms through which a foreign government can compel access to Irish state data.

James Spalding14 June 2026Published

Download Green Paper (PDF)

Countries with in-country Copilot processing

Ireland is not among them

Flex Routing default for new EU tenants

Since March 2026

Multiple

EDPS infringements against Commission

International transfers, purpose limitation

Irish sovereign AI models

No national capability

Complexity30 years

Section 1 of 9Level 30

The Memorandum of Understanding

In November 2022, Minister Michael McGrath signed a three-year Memorandum of Understanding with Microsoft Ireland, designating the entire Government of Ireland as a single Microsoft customer. The agreement provides preferential pricing on Microsoft 365 cloud solutions across all Public Service organisations.

Microsoft was simultaneously granted pro bono access to run a Product Innovation Programme inside government, shaping how departments adopt Microsoft technology. The MoU came into effect on 1 November 2022.

In November 2025, the Taoiseach personally attended Microsoft's 40th anniversary celebration in Ireland. No competitive procurement, no parliamentary scrutiny, no published impact assessment accompanied the most significant digital infrastructure decision in the history of the Irish state.

A note on the author and this submission

This Green Paper is submitted by James Spalding, founder of the 8GI Foundation, an early-stage civil-society organisation working on accessible technology, policy research, AI governance, sovereignty, and equitable access.

In April 2026, written evidence submitted by James to the House of Lords Science and Technology Committee inquiry into Innovation in the NHS: personalised medicine and AI was accepted and published in the parliamentary record (PMA0107). That submission argued that technology is never the bottleneck. Governance capture, data asymmetry, and procurement culture are. The same argument applies here.

Prior submissions include the Oireachtas Regulation of AI Bill consultation. A joint submission to the South African Department of Communications and Digital Technologies on their National AI Policy Framework is in progress.

To date, these submissions have entered the record. They have not yet generated the direct, frank engagement with those responsible for Irish digital and AI strategy that the situation warrants. This Green Paper is an attempt to change that. It is addressed to the ministers, officials, and advisors who hold the decisions described in the pages that follow, and it is published openly so that the public can see both the argument and the response.

The core exposure

“Microsoft cannot guarantee data sovereignty against US authorities, even for data stored in France under a French-marketed sovereign offering.”

Microsoft France, under oath, French Senate hearing, June 2025

Sovereignty erosion timeline

A chronological record of how Irish government data sovereignty was progressively ceded, and how the international context shifted around Ireland while Ireland did nothing.

Jul 2016

EU-US Privacy Shield adopted, replacing Safe Harbour after CJEU invalidation

Jul 2020

Schrems II: CJEU invalidates Privacy Shield. Standard Contractual Clauses survive but with conditions

May 2021

EDPS opens formal investigation into European Commission's use of Microsoft 365

Jun 2021

Ireland's National AI Strategy 'AI - Here for Good' published. No sovereign infrastructure provision

Nov 2022

Minister McGrath signs Microsoft MoU. Entire Government of Ireland becomes single Microsoft customer

Nov 2022

Microsoft granted pro bono access to run Product Innovation Programme inside government

Mar 2023

Microsoft 365 Copilot announced. AI inference embedded across Word, Outlook, Teams, SharePoint, Excel

Nov 2023

Microsoft 365 Copilot generally available. Enterprise rollout begins

Mar 2024

EDPS publishes findings: European Commission's M365 use infringes data protection law on multiple counts

Jun 2025

Microsoft France confirms under oath at French Senate: cannot guarantee sovereignty against US authorities

Jul 2025

EDPS confirms Commission brings M365 into compliance. Ireland's government has taken no equivalent action

Nov 2025

Microsoft announces in-country Copilot processing for 15 countries. Ireland excluded

Nov 2025

Taoiseach attends Microsoft's 40th anniversary celebration in Ireland

Nov 2025

MoU three-year term expires. Renewal terms unknown. No parliamentary scrutiny conducted

Mar 2026

Flex Routing enabled by default for new EU tenants. Irish government data can be routed to US data centres

Apr 2026

Flex Routing rolled out to existing EU tenants. No Irish government response

Apr 2026

UK launches Sovereign AI Unit with GBP 500m fund. Ireland has no equivalent programme

May 2026

EU Tech Sovereignty Package announced. Member states begin assessing AI dependency

Jun 2026

US executive order mandates 30-day data retention for all AI providers in US jurisdiction

Jun 2026

Fable 5 controversy: silent behavioural profiling capabilities disclosed post-deployment

Jun 2026

This Green Paper published. MoU renewal deadline: November 2025 (three years from signing)

Cross-references