Compliance officers describe the latest guidance as the first that cannot be handled by a privacy addendum. It reaches architecture: where backups sit, which vendors process payroll, and whether a regional HQ can still run on a European instance of Salesforce.

The companies that treat this as a legal memo will spend 2027 undoing it. The ones that treat it as an operating constraint are already redesigning vendor lists.