This is certainly true if the user is an American company. You could look at the European initiatives to run this stuff on hardware they own in facilities they own and control within the borders of Europe for a counter-example.
Such as: https://www.google.com/search?client=firefox-b-d&q=schwarz+s...
https://www.dutchnews.nl/2026/04/government-turns-to-german-...
Hopefully that changes!