Autonomous transport moves at machine speed.
Your communications must be sovereign.

Yes. The CLOUD Act applies based on the nationality of the cloud provider, not the location of the data or the operator. If a European airline uses a US-origin operations management system, or a rail operator uses Microsoft Azure for its ERTMS control data, or an eVTOL operator uses AWS for UTM services, the data is accessible to US law enforcement under a CLOUD Act order — regardless of whether it is stored in Frankfurt, Dublin, or Amsterdam. The provider has no legal basis under US law to refuse. This directly conflicts with GDPR Article 48, which prohibits handing EU personal and operational data to foreign authorities without an international agreement. As of 2026, no such agreement resolves this conflict. European transport operators using US platforms are permanently in a state of irresolvable legal uncertainty.

Yes — all major transport modes are explicitly listed in NIS2 Annex I as essential entities: air transport, rail transport, road transport, and water transport. This is the strictest classification under NIS2. As essential entities, transport operators must implement comprehensive ICT supply-chain risk management under Article 21, including for all communications platforms used in operations — not just operational technology (OT) systems. This means that the messaging platform used by an operations centre, the coordination tools used between rail operators, or the communications system used by a UTM provider are all within scope of Article 21 risk management. An operator using a US-controlled platform must document the CLOUD Act exposure this creates and demonstrate that it is adequately managed. Given that the CLOUD Act exposure cannot be resolved legally under GDPR Article 48, the only adequate mitigation is to use communications infrastructure outside US jurisdiction entirely.

V2X safety communications have hard real-time requirements that cloud infrastructure — by its architectural nature — cannot reliably satisfy. Collision avoidance broadcasts, hazard detection alerts, and emergency vehicle priority signals must be communicated in under 10 milliseconds to be actionable by an autonomous vehicle's safety systems. Cloud-routed communications, even via regional data centres, routinely experience latency spikes of 30–200ms due to routing variability, congestion, and processing delays. This is not a configuration problem — it is a structural limitation of wide-area cloud routing. When V2X management platforms run on US hyperscalers, the problem is compounded: the CLOUD Act exposure means that the data layer powering autonomous collision avoidance is simultaneously a foreign intelligence asset. Sovereign communications infrastructure — locally deployed, edge-first, and outside foreign jurisdiction — is the only architecture that satisfies both the latency and the sovereignty requirements simultaneously.

EASA's U-space regulation (EU 2021/664, 665, and 666) establishes a mandatory framework for autonomous aircraft operations in urban airspace. UTM Service Providers (U-SSPs) must obtain certification from national competent authorities and demonstrate data sovereignty, security, availability, and performance. The regulation requires that UTM communications — flight corridor assignments, real-time position broadcasts, emergency procedures — are conducted over certified, secure, and available infrastructure. As autonomous helicopter operators (including emerging air taxi services) expand into European cities, the UTM data layer they depend on must be hosted on infrastructure that cannot be compelled by a foreign government without judicial review under European law. US-hosted UTM services cannot satisfy this requirement. The practical implication is that commercially viable autonomous air mobility in Europe requires European-sovereign or self-hosted UTM communication infrastructure from the outset.

AMVLET provides sovereign communications infrastructure for the full transport stack — from air traffic coordination and UTM operations through to rail control centre communications, V2X management, and autonomous fleet operations. The platform operates entirely outside US jurisdiction, with cryptographic keys held exclusively by your organisation. Deployments are available on EU-sovereign cloud infrastructure, on-premises within your own operational environment, or fully air-gapped for the highest-security ATM, rail signalling, and defence-adjacent transport applications. For eVTOL and autonomous helicopter operators, AMVLET provides the secure, low-latency communication backbone needed for UTM data exchange and fleet coordination — compliant with EASA U-space requirements. For rail and road transport authorities, AMVLET provides the NIS2 Article 21 supply-chain documentation and risk assessment support required for essential entity compliance. We work directly with legal, compliance, and technical teams across all transport modes to design and certify sovereign communication architectures tailored to your specific operational and regulatory requirements.