I think the same goes the other way around. Establishing an US entity is scary in terms of privacy cause then you automatically need to comply to the CLOUD Act

I think the same goes the other way around. Establishing an US entity is scary in terms of privacy cause then you automatically need to comply to the CLOUD Act (which creates an entirely different legal kerfuffle in regards to GDPR compliance). And even if not established within the US, a global company is still subject to US's export laws (which applies to goods, and services, including software). The US has a tighter track record on political/economical pressure, even in EU. All the copyright acts and regulation that almost succeed all the time in EU, and happily thus far got rejected, didn't come from within EU, but from the EU-US trade partnership. My opinion is that it's better to just check of compliance marks on a list, and move on with ones life. Politics are **, either way.