The CLOUD Act reaches data by custody, not by location. European sovereignty claims are mostly about location.
Article 48 of the GDPR says a foreign court's order is not, on its own, enforceable here. It does not say the company may not comply, and most of this market sits in that gap.