In the case of office365, they enforce it via Microsoft. In other cases, the hosting provider. Avoiding US based companies hosting anything at scale is surprisingly difficult.

I have had good expierience with Hetzner (germany-based), but all you get is cloud vps boxes and storage.

Likewise, I think it's somewhat silly to think that the EU will actually manage to do anything, or even successfully fine a US company with no presence abroad that just so happens to have customers in the EU, for GDPR violations.

What are they even legally able to do if you, as a US company, simply refuse whatever the EU asks.

Absolutely nothing is my (IANAL) bet. If you're not physically in the EU, I have a very hard time believing any US court would allow you be... extradited? Or even enforce fines from a foreign government.

Then again, maybe I'm totally wrong and am just confused about how EU law can regulate those not under their jurisdiction.