The “All-Cloud” is dead: 5 risks that put strategic on-premise back on the table in 2026

More than 85% of the European cloud market is captured by American players (EU Perspectives, February 2026). In May 2026, five risks are converging simultaneously: the geopolitical fragmentation of the global network, a haemorrhage of intellectual property through AI coding tools, the first offensive AI capable of creating zero-days (GTIG report, 11 May 2026), SaaS inflation disconnected from the value delivered, and the ANSSI post-quantum deadline as early as 2027. The economic calculation has tipped. Here are the facts, and the quantified ROI of the alternative.

1. Geopolitical risks and digital “blackouts”: the Splinternet is coming

The concept of the “Splinternet”, an internet fragmented into incompatible geopolitical blocs, is no longer a researcher’s hypothesis. It is the terrain on which French SMEs operate in 2026.

The dependency is structural. More than 85% of the European cloud market is captured by the American hyperscalers, led by AWS, Azure and Google Cloud (EU Perspectives, February 2026). All are subject to the 2018 CLOUD Act. On a US judicial order (18 U.S.C. §2713), the authorities can demand access to data hosted by an American company, even if the servers are physically in France. The great majority of French companies are in this situation.

The cut-offs are documented, not theoretical. In early 2025, the Trump administration brandished the threat of cutting Ukraine’s access to Starlink; Microsoft blocked the International Criminal Court prosecutor’s account on the basis of US sanctions (May 2025); Maxar Technologies suspended Ukraine’s access to its satellite imagery (March 2025). The “kill switch” mechanism is no longer an abstraction. The Ifri puts it bluntly: Europe is “at Washington’s mercy” in the digital domain.

The instability is getting worse. The repeated Outlook and Microsoft 365 outages in 2025-2026 (some lasting several hours and simultaneously affecting thousands of European companies) illustrate what “outsourcing your critical infrastructure” concretely means: when Microsoft goes down, you go down with it. With no leverage, no alternative, no SLA to compensate for the hour of lost productivity. And the Asahi affair (a return to pen and paper after a ransomware attack, October 2025) is a reminder, more broadly, of what an unavailable critical infrastructure costs.

BGP routing anomalies, incidents on transatlantic submarine cables, and climate events (the 2025 CME solar storm) expose an “illusion of sovereignty”: your data at rest is in France, but your data in transit passes through nodes beyond your control. The WEF Outlook 2026 ranks dependence on critical digital infrastructure among the world’s top ten systemic risks.

The transatlantic trade tensions of 2026 and Microsoft’s unilateral price rise (+5.2 to +16.6% depending on the plan from 1 July 2026, see section 4) materialise the economic risk. Geopolitical dependency is also pricing dependency.

2. Hidden dependencies: the silent leak of your intellectual property

In late April 2026, GitHub updated the terms of service for Copilot’s non-Enterprise versions: exchanges with the AI may be used to improve Microsoft/OpenAI models. For an SME without an Enterprise licence (several hundred euros per developer per year), your source code, your software architecture and your internal comments may feed the training data of the Big Tech giants.

Comparison table: what each tool sends (May 2026)

Tool	Data sent	Privacy mode	Jurisdiction	CLOUD Act
GitHub Copilot (non-Enterprise)	Code + model training since April 2026	Opt-out not enabled by default	USA	Yes
GitHub Copilot (Enterprise)	Context code only	Contractually guaranteed	USA	Yes
Cursor	Context code + full session	Privacy Mode OFF by default	USA	Yes
Claude Code (Anthropic)	Prompts stored for 30 days by default	Configurable	USA	Yes
Local LLM (Ollama)	No outbound data	Total by definition	Your servers	Full sovereignty

This table is not an anecdote. This is intellectual property (pricing algorithms, business logic, the architecture of your systems) crossing the Atlantic with every keystroke.

Emerging risks: slopsquatting and prompt injection

Slopsquatting: LLMs hallucinate non-existent package names in 5% to 22% of code suggestions, according to studies published in 2025. Attackers register these names with malicious code. Your developer installs a package “recommended by the AI”: a Trojan horse.

IDE Prompt Injection: malicious code in your dependencies can inject instructions into your AI coding assistant, which then executes unauthorised actions (credential exfiltration, silent code modification). This is an attack vector documented in 2026 that specifically exploits this channel.

3. Offensive AI bots: the automated zero-day has arrived

11 May 2026: the Google Threat Intelligence Group (GTIG) publishes a landmark report. For the first documented time, an AI designed a functional zero-day exploit from start to finish, capable of bypassing a two-factor authentication (2FA) system, without human intervention. The exploit leveraged a semantic logic flaw: not a memory bug, but a behavioural inconsistency in the protocol’s logic. The Python markers in the code confirm the AI origin.

The Google Threat Intelligence Group and Mandiant document, in their February 2026 reports, the active use of LLMs by state offensive groups:

• UNC2814 (China): AI-driven vulnerability analysis and exploit generation

• APT45 (North Korea): LLM-driven automation of spear-phishing campaigns

• CANFAIL/LONGSTREAM (Russia): AI for identifying attack vectors in source code

The XBOW system (June 2025) had already demonstrated that an AI bot can submit hundreds of zero-day vulnerability reports to bug bounty programmes, without human intervention.

The operational conclusion: your code exposed on the public cloud is scrutinised around the clock by automated systems capable of creating their own exploits. Obscuring your architecture behind private servers mechanically reduces this attack surface.

4. The unbeatable ROI of on-premise: three layers to bring back in-house

4.1 Microsoft 365 / Exchange: time to take stock

Microsoft is applying a price increase from July 2026:

Plan	Current price	July 2026 price	Increase
Microsoft 365 Business Basic	€6.00/month/user	€7.00/month/user	+16.6%
Microsoft 365 Business Standard	€12.50/month/user	€13.80/month/user	+10.4%
Microsoft 365 Business Premium	€22.00/month/user	€24.00/month/user	+9.1%
Microsoft 365 E3	€36.00/month/user	€38.00/month/user	+5.6%
Microsoft 365 E5	€57.50/month/user	€60.50/month/user	+5.2%

These increases include AI features (Copilot for Microsoft 365) that are often unsolicited. For a 50-person SME on Business Standard, that is +€780/year for features nobody asked for.

Microsoft Exchange 2016 and 2019 reached their End-of-Life on 14 October 2025. No more security patches. SMEs that migrate to Microsoft 365 face these increases. There is a third way.

4.2 Local LLM: up to ~90% lower inference costs

Compact open-source models, from 7 to 30 billion parameters (Gemma 4 12B, Mistral Small, Qwen, distilled DeepSeek variants), cover a large share of common business sub-tasks (summarisation, classification, extraction). Available on Ollama (169,000 ⭐ on GitHub), with no token cost.

The maths: frontier APIs = $3 to $15 per million tokens at list price (May 2026), while the average real spend measured by Ramp in June 2026 falls to $0.72 per million. A sign the market is already shifting to lighter models. Local LLM = €0 per token, cost amortised on the hardware. On a hybrid deployment (local LLM for volume, cloud API for complex cases), routing to compact models can cut inference costs by up to ~90% (InfoWorld, May 2026). Break-even: a few months on our typical deployments (MATIA estimate).

The result: zero data exposure, zero contractual dependency, and easier GDPR compliance. Local hosting does not remove the other obligations, but it does remove the transfer question.

4.3 On-premise AI agents and a sovereign email server

Cloud iPaaS costs reach $48,000 to $180,000/year for mid-sized companies (ranges observed on vendors’ public pricing grids; orders of magnitude). n8n, LangChain and Ollama enable entirely local agent architectures, auditable, with no external API dependency.

This is the Junyr Agents™ model (junyr.app): delegation of AI agents within business processes (HR, CRM, accounting, projects, invoicing), operated on-premise, triggerable by email via Junyr Mail™. Auditable, reversible, with no cloud dependency.

For email: a sovereign solution hosted in France, eIDAS-compliant, costs less than €10/month per domain, outside the CLOUD Act, outside Microsoft outages, outside unilateral price increases. Junyr Mail™ (junyr-mail.com): €9.90/month, OVH France, European legal standing.

5. Post-quantum cryptography: the urgency of crypto-agility

The SNDL attack: “Store Now, Decrypt Later”

The reasoning is simple: an attacker intercepts your encrypted data today and stores it. When Q-Day arrives (2035 horizon according to the coordinated European roadmap of June 2025), a quantum computer will break RSA-2048 and ECC-256 in a matter of hours. Your strategic data from 2026 will be readable in 2035.

This is the SNDL (Store Now, Decrypt Later) attack. It is considered already under way by Western cybersecurity agencies, which is precisely what justifies the migration timetables below.

The recommended post-quantum algorithms (NIST standards)

Algorithm	Use	NIST standard
CRYSTALS-Kyber (ML-KEM)	Key exchange (KEM)	FIPS 203
CRYSTALS-Dilithium (ML-DSA)	Digital signature	FIPS 204
Falcon (FN-DSA)	Compact digital signature	FIPS 206 (draft in progress)
SPHINCS+ (SLH-DSA)	Stateless signature (hash-based)	FIPS 205

The timetables (not to be confused):

• 2027: no more ANSSI-qualified products without hybrid post-quantum cryptography (ANSSI)

• 2030: procurement of security products incorporating PQC (ANSSI); migration of high-risk use cases (EU roadmap)

• 2035: intermediate use cases (coordinated European roadmap, June 2025)

In late 2025, Thales and Samsung received the first ANSSI approvals incorporating PQC algorithms. The compliance window is open, but it is closing.

On shared cloud infrastructure, you depend on your provider’s migration timeline. On on-premise infrastructure, you control the quality of your random number generators (HSM), you manage the IKEv2 fragmentation induced by the new post-quantum keys (CRYSTALS-Kyber), and you migrate on your own schedule. That is the definition of crypto-agility.

Conclusion: five risks, one calculation

Risk	Status	Deadline
Geopolitical shutdown / cloud outages (CLOUD Act, kill switch)	Already triggered	Immediate
IP leak via AI coding tools (non-Enterprise Copilot)	Effective since April 2026	Immediate
Offensive AI bots / automated zero-day (GTIG)	Documented 11 May 2026	Immediate
Uncontrolled SaaS inflation (Microsoft 365 +5.2 to +16.6%)	Announced	July 2026
ANSSI post-quantum obligation	Timeline set	2027 (qualification)

The question is no longer “can my SME afford a sovereign infrastructure?” It is “can it afford not to have made the call?”

The ROI is calculable and favourable: hybrid on-premise LLM (up to ~90% lower inference costs by routing to compact models, according to InfoWorld, May 2026; break-even in a few months, MATIA estimate), sovereign email (less than €10/month), local AI agents (elimination of iPaaS costs of $48,000-180,000/year), post-quantum compliance (a competitive advantage as early as 2027).

The MATIA Method™ integrates the sovereignty axis from maturity level 3, not as an on-premise dogma, but as a considered trade-off: classified data, SecNumCloud-type sovereign cloud where it suffices, the local option where it is justified. An AI deployed without legal and technical control of its infrastructure remains a risk disguised as a tool.

---

Paul-Antoine TUAL · AI Transformation Leader Founder of Croissance & Transitions and the MATIA Method™ croissance-transitions.fr | junyr.fr | junyr.app (Junyr Agents™) | junyr-mail.com (Junyr Mail™)

Sources

• GTIG/Google report, 11 May 2026
• ANSSI cyber.gouv.fr
• CERT-FR-2026-CTI-001
• GTIG / Mandiant, AI threat reports (February 2026)
• Ifri
• EU Perspectives, European cloud market (February 2026)
• WEF Outlook 2026
• NIST FIPS 203/204/205/206
• GitHub Copilot data policy, April 2026
• Microsoft 365 pricing, July 2026
• Microsoft Exchange EOL, 14 October 2025
• KYP.ai supply chain security 2026
• Ollama GitHub.