US sanctions and your business software

On 9 October 2026, the US government announced sanctions against the International Criminal Court (ICC) in The Hague as an institution. Earlier measures, based on Executive Order 14203 of February 2025, targeted individual judges and prosecutors. According to reports, the new sanctions will not take effect immediately, which leaves room for negotiation.

There is a precedent for what this can mean in practice. In 2025, after the US sanctioned chief prosecutor Karim Khan, AP reported that his Microsoft email account was shut off and that he moved to a Swiss email provider. Microsoft says it never stopped or suspended its services to the court. The ICC has since reportedly decided to replace Microsoft Office with openDesk, an open-source suite backed by the German government.

US companies must follow US sanctions law. If a customer is designated, the vendor generally has to stop serving them, wherever the data is stored. A data centre in Frankfurt or Zurich does not change which law the vendor answers to.

The same applies further down the chain: the cloud host, the email delivery service, the payment processor. A tool can look European on the surface and still depend on US companies underneath.

For most Swiss practices, agencies and SMEs, the direct risk is low. Sanctions target specific people and organisations, not every customer of a vendor.

The risk is higher if you work for or with international organisations, NGOs, public bodies, or clients in politically exposed situations, for example law firms acting in international proceedings. For these teams, losing a booking, email or document tool overnight is a scenario worth planning for.

The broader lesson applies to everyone: know which vendors you depend on, and know how you would leave them.

Who is the vendor? Check where the company is incorporated. A Swiss or EU company is not bound by US sanctions law the way a US company is.

Who hosts it? Ask which cloud provider runs the service and where that provider is headquartered, not only in which region the servers stand.

Can you leave? Check whether you can export your data in a usable format, and whether an open-source version of the software exists that you or another provider could run.

Who are the sub-processors? Email delivery, video, payments and analytics each add another company and possibly another jurisdiction.

What does the contract say about suspension? Look for notice periods and what happens to your data if the service ends.

We would rather be precise than reassuring. Zitli is operated by Otternative Marketing GmbH, a company registered in Basel, Switzerland. Booking and client data is hosted in the EU and is not replicated to US regions.

Part of our infrastructure runs in the EU region of a US cloud provider. Zitli is therefore not fully independent of US companies today, and we do not claim otherwise.

What reduces the dependency: Zitli is built on the open-source cal.diy scheduling engine, which is not tied to one hosting provider, and you can export your bookings and account data at any time. Your data is not locked in with us.

The Netherlands, Belgium and Spain, among others, have asked the European Commission to prepare the EU Blocking Statute, a 1996 regulation that forbids EU companies from complying with certain foreign sanctions. As of 11 October 2026 it has not been activated for the ICC sanctions, and it has had limited effect in past cases. It does not cover Swiss companies.

Public bodies are also reducing their dependency directly. The ICC's move to openDesk, Germany's openDesk programme and Amsterdam's plan to move sensitive data to European cloud platforms all point in the same direction.

This guide is general information, not legal advice. If you work in a sanctions-exposed field, talk to a lawyer.

Al Jazeera, US sanctions on the International Criminal Court, 9 October 2026.

UN News, UN Secretary-General condemns new US sanctions on the ICC, October 2026.

Human Rights Watch, US Sanctions International Criminal Court, 9 October 2026.

Heise Online and The Register on Microsoft and the ICC (2025). TechRadar on the ICC's move to openDesk.

Social Europe and Lawfare on the EU Blocking Statute (2026).