Europe’s flirtation with digital sovereignty has moved from abstract policy paper to a series of concrete, politically charged decisions — but whether the bloc can realistically declaw the hyperscalers that underpin modern government and commerce remains an open question. In the past 18 months European capitals have announced large-scale migrations away from U.S. proprietary platforms, national ministries have adopted open-source stacks, and smaller states such as Malta have made a pragmatic counter‑bet: buying AI productivity from Microsoft while the rest of the continent debates the price of independence. The result is a messy, high‑stakes experiment in digital sovereignty, one that exposes trade‑offs between agility, security, cost, and geopolitical risk.
For decades the EU relied on regulatory muscle to balance the dominance of Big Tech. That approach masked a deeper reality: Europe imports the majority of the digital stack it uses. The European Commission itself noted that the EU depends on non‑EU countries for over 80% of its digital products, services, infrastructure and intellectual property — a statistic that has become a rallying cry for policymakers worried that supply‑chain or legal pressure from foreign jurisdictions can be weaponised.
That dependence shows up in everyday metrics. The public‑cloud market — the backbone of modern government IT — is concentrated among a few hyperscalers. Estimates from industry analysts put Amazon Web Services, Microsoft Azure and Google Cloud together at roughly two‑thirds of cloud infrastructure market share; in Western Europe those three dominate the growth in public cloud spend. In short: European governments and enterprises run much of their business on platforms headquartered outside the EU. This is the core problem that “digital sovereignty” rhetoric seeks to fix.
Why now? The argument is geopolitical as much as technical. Episodes like the suspension of access to certain accounts at the International Criminal Court (ICC) after U.S. sanctions raised alarm bells in Brussels and national capitals: if foreign policy can be enforced by cutting software and email access, governments that depend on foreign systems are vulnerable to coercion or collateral damage. The ICC episode became shorthand for a broader risk — even if specifics about responsibility and intent are contested, the incident crystallised fears about third‑party control of critical services.
Key limitations and costs to watch:
Why hyperscalers are pushing sovereign clouds:
Malta’s decision highlights a broader tension in the sovereignty debate: capability versus control. Smaller states and those with tight budgets may opt to trade some sovereignty in exchange for immediate productivity and competitive advantage. This is especially true where time‑to‑value matters — citizen services, tax processing and license renewals can benefit immediately from AI features baked into existing Office workflows.
First, jurisdiction matters. The U.S. CLOUD Act allows U.S. authorities to compel U.S. companies to disclose data under certain conditions, regardless of where the data is physically stored. That legal reach is a structural reason for the anxiety voiced by EU policymakers: data sitting in European datacenters can nonetheless be accessed through U.S. legal processes if the provider is a U.S. firm. European sovereign clouds and partner arrangements often try to address this with in‑region personnel controls and customer‑controlled encryption keys, but these are policy mitigations rather than legal panaceas.
Second, technical separation can be achieved in multiple ways: air‑gapping, customer‑managed keys (so the vendor cannot decrypt data), and in‑country operations. Each approach has trade‑offs for manageability and access to the latest AI features. For example, running a fully air‑gapped productivity stack limits the use of large foundation models and third‑party integrations that often power value in modern services.
When policymakers talk about digital sovereignty they must be precise: are they seeking data residency, legal remoteness from foreign orders, the ability to audit code and remove hidden features, or economic re‑industrialisation of the tech sector? The absence of a shared, granular definition invites confusion and weakens procurement outcomes.
Practical policy levers that matter:
Small states such as Malta remind us that there is more than one route to resilience: pragmatic adoption of advanced tools, backed by governance, training and localisation, can deliver public value now. Larger ambitions — regional sovereign clouds, European AI training infrastructure, and a competitive supplier market — will take time and money. The wiser course for European policymakers is to treat digital sovereignty as a multi‑vector program: shore up legal and technical controls where immediate risk is highest, accelerate pilots that can scale, and align procurement and R&D to grow the European supplier base. That approach avoids the false binary of “ditch or submit” and gives Europe a credible strategy to win back control — one practical project at a time.
Source: The Malta Independent Europe’s digital rebellion: ditching American tech - The Malta Independent
Background: why Europe is counting the costs of dependence
For decades the EU relied on regulatory muscle to balance the dominance of Big Tech. That approach masked a deeper reality: Europe imports the majority of the digital stack it uses. The European Commission itself noted that the EU depends on non‑EU countries for over 80% of its digital products, services, infrastructure and intellectual property — a statistic that has become a rallying cry for policymakers worried that supply‑chain or legal pressure from foreign jurisdictions can be weaponised.That dependence shows up in everyday metrics. The public‑cloud market — the backbone of modern government IT — is concentrated among a few hyperscalers. Estimates from industry analysts put Amazon Web Services, Microsoft Azure and Google Cloud together at roughly two‑thirds of cloud infrastructure market share; in Western Europe those three dominate the growth in public cloud spend. In short: European governments and enterprises run much of their business on platforms headquartered outside the EU. This is the core problem that “digital sovereignty” rhetoric seeks to fix.
Why now? The argument is geopolitical as much as technical. Episodes like the suspension of access to certain accounts at the International Criminal Court (ICC) after U.S. sanctions raised alarm bells in Brussels and national capitals: if foreign policy can be enforced by cutting software and email access, governments that depend on foreign systems are vulnerable to coercion or collateral damage. The ICC episode became shorthand for a broader risk — even if specifics about responsibility and intent are contested, the incident crystallised fears about third‑party control of critical services.
The new frontline: national rollouts, military migrations, and municipal experiments
Across Europe the reaction has taken two primary forms: replace proprietary tools with local or open‑source alternatives, and demand “sovereign” offerings from major vendors that promise to keep control inside Europe.France: Visio and the big public‑sector changeover
In early 2026 the French government announced a plan to remove U.S. videoconferencing tools — including Zoom and Microsoft Teams — from the workstations of roughly 2.5 million civil servants and migrate them to a domestic platform called Visio by 2027. The move was framed as necessary to “guarantee the security and confidentiality of public electronic communications” and to end reliance on non‑European solutions for official exchanges. The announcement is one of the most visible examples of a top‑down, national pivot toward sovereign alternatives.Germany: Schleswig‑Holstein’s open‑source leap
At the sub‑national level, Schleswig‑Holstein has become the most prominent case study. The northern German state completed a wide‑ranging migration away from Microsoft’s proprietary email and collaboration stack, moving tens of thousands of mailboxes to Open‑Xchange and Mozilla Thunderbird, and adopting LibreOffice for desktop productivity. Officials report the migration covered around 40,000 mailboxes and over 100 million messages and calendar entries — an operationally complex cutover that the state describes as a major milestone toward digital sovereignty. The Schleswig‑Holstein program has become a playbook for others contemplating a similar transition.Austria: military precautions and Office alternatives
Even defence establishments are rethinking vendor risk. The Austrian military migrated large parts of its desktop fleet away from Microsoft Office to LibreOffice, citing concerns about cloud‑first roadmaps and the desire to keep sensitive documents under national control. The shift included special arrangements for narrow exceptions where legacy Microsoft functionality was unavoidable, and a commitment to invest in migration tooling, training, and targeted development work. The defence sector’s move signals that digital sovereignty is being treated as a strategic posture — not just a cost or procurement issue.A mosaic of municipal and sectoral pilots
Beyond headline national actions, dozens of cities, ministries and agencies across Europe have launched pilots with open‑source stacks (Nextcloud, Nextcloud Talk, Matrix/Element, OpenMeetings) or negotiated sovereign cloud contracts. These pilots vary in scope: some replace only collaboration tools, others aim to supplant whole productivity and identity systems. Momentum is not uniform — differences in skills, budgets and legacy systems create a patchwork of progress rather than a single continental program.The open‑source gambit: why it’s attractive — and why it isn’t a silver bullet
Proponents of the open‑source approach point to three clear strengths:- Transparency and auditability. Open‑source code can be inspected for backdoors and supply‑chain risks in a way proprietary binaries cannot.
- Control over customisation. Governments can tailor code and protocols to legal and operational needs rather than waiting for vendor roadmaps.
- Reduced vendor lock‑in. Open standards and formats (ODF, CalDAV, IMAP, S/MIME, etc.) make exit strategies easier and limit the monopolistic leverage of a single supplier.
Key limitations and costs to watch:
- Compatibility gaps — advanced Excel macros and bespoke Office‑integrated workflows often need time‑consuming rewrites.
- Productivity dips during transition — end users face a learning curve and intermittent friction as alignment with external partners (who remain on DOCX/Exchange) breaks.
- Hidden operational costs — patching, security monitoring, and building SLAs with multiple small vendors can erode headline license savings.
- New dependency vectors — reliance on a small number of regional integrators or managed‑service providers can recreate single‑supplier risk in a different form.
Hyperscalers respond: "sovereign cloud" and product re‑engineering
The market reaction from the big cloud providers has been swift. Microsoft, in particular, has retooled offerings under a “Microsoft Sovereign Cloud” umbrella that promises in‑region processing, European‑resident access controls, external key management, and partner‑operated sovereign options for governments and regulated industries. The vendor’s pitch: you can get hyperscale AI and productivity features while keeping the legal and operational guardrails Europeans demand. In June 2025 Microsoft framed this as an expansion of its existing commitments and launched new controls designed for European customers.Why hyperscalers are pushing sovereign clouds:
- They protect recurring revenue by removing the need for customers to re‑architect away from their platforms.
- They buy time for governments: sovereign configurations are easier to certify and deploy than building native European hyperscale capacity overnight.
- They leverage partners: national partner clouds (French, German examples) allow hyperscalers to tile local control with vendor technology.
Malta’s counter‑example: pragmatic procurement meets AI productivity
Not every EU member is joining the purge. Malta’s government signed an initiative in 2025 to roll out Microsoft 365 Copilot to its public service, a €4 million investment intended to equip roughly 8,000 public officers with AI productivity tools. MITA (the Malta Information Technology Agency) led the program and emphasised that the rollout would include training, governance tooling and a Centre of Excellence to manage deployment. The Copilot service was localised for the Maltese language as part of the customization package. For Malta, the calculus appears pragmatic: deliver measurable gains in day‑to‑day efficiency rather than waiting for a sovereign stack that might never reach feature parity.Malta’s decision highlights a broader tension in the sovereignty debate: capability versus control. Smaller states and those with tight budgets may opt to trade some sovereignty in exchange for immediate productivity and competitive advantage. This is especially true where time‑to‑value matters — citizen services, tax processing and license renewals can benefit immediately from AI features baked into existing Office workflows.
The security case: myths, facts, and the Cloud Act
Two technical and legal realities complicate the “buy European” story.First, jurisdiction matters. The U.S. CLOUD Act allows U.S. authorities to compel U.S. companies to disclose data under certain conditions, regardless of where the data is physically stored. That legal reach is a structural reason for the anxiety voiced by EU policymakers: data sitting in European datacenters can nonetheless be accessed through U.S. legal processes if the provider is a U.S. firm. European sovereign clouds and partner arrangements often try to address this with in‑region personnel controls and customer‑controlled encryption keys, but these are policy mitigations rather than legal panaceas.
Second, technical separation can be achieved in multiple ways: air‑gapping, customer‑managed keys (so the vendor cannot decrypt data), and in‑country operations. Each approach has trade‑offs for manageability and access to the latest AI features. For example, running a fully air‑gapped productivity stack limits the use of large foundation models and third‑party integrations that often power value in modern services.
When policymakers talk about digital sovereignty they must be precise: are they seeking data residency, legal remoteness from foreign orders, the ability to audit code and remove hidden features, or economic re‑industrialisation of the tech sector? The absence of a shared, granular definition invites confusion and weakens procurement outcomes.
Economic realism: building Europe’s tech base is a long game
Rewiring Europe’s digital economy to replace hyperscalers is an industrial policy challenge that requires patient capital. The EU Chips Act, investments under Horizon Europe and targeted R&D funding are necessary parts of a long‑term strategy, but they will not produce a hyperscaler clone overnight. Europe’s historical strength — robust industrial ecosystems, large regulated markets and deep engineering talent in pockets like the Nordics and Germany — offers a foundation. Yet scale economics in cloud and AI favour a small number of global players, and closing that gap will take coordinated procurement, standards, and fiscal incentives measured in years and tens of billions of euros. The Commission’s strategy papers acknowledge this reality: sovereignty is not a flip of a switch but a spectrum of capabilities to be grown.Practical policy levers that matter:
- Invest in regional data centres and sovereign AI infrastructure tied to EU procurement commitments.
- Create certification and procurement frameworks that reward in‑region operational control, external key management, and verifiable audits.
- Back open standards and invest in transition tooling to reduce the friction of migrating away from proprietary APIs.
- Fund retraining and create public–private support programs to build a supplier base able to deliver enterprise support and SLAs at scale.
What success looks like — realistic goals for the next five years
Digital sovereignty should be treated as a strategic continuum, not a purity test. Measurable, pragmatic objectives will deliver better outcomes than maximalist symbolism. Near‑term milestones to track:- Compliance and resilience: Ensure all critical public‑sector systems have a tested continuity plan and a vendor‑agnostic fallback for core services.
- Interoperability: Mandate open document and identity standards across procurement to reduce lock‑in.
- Sovereign AI pilots: Stand up 5–10 EU‑backed sovereign AI environments that demonstrate real, audit‑ready models for health, justice and energy sectors.
- Skills and supply chain: Fund teams to provide migration tooling, code audits and managed support to public administrations undertaking transitions.
- Market shaping: Use public procurement to seed the growth of trustworthy European cloud and AI service providers capable of scaling beyond niche deployments.
Risks and unintended consequences
The political momentum behind digital sovereignty is powerful, but risks are real and often understated.- Fragmentation risk: A rush to “European only” procurement without harmonised standards can fracture the single market, creating incompatible national stacks and raising costs for vendors and taxpayers.
- Security illusion: Replacing vendor A with vendor B (where B is smaller) does not automatically improve security — it can merely shift risk to less mature incident response teams.
- Productivity drag: If public servants lose access to features that private sector partners continue to use, service delivery may slow and inter‑agency cooperation become clumsy.
- Vendor substitution trap: Overreliance on a small set of regional integrators can recreate monopoly dynamics under a different flag.
Conclusion: sovereignty as a pragmatic program, not a headline
Europe’s digital rebellion is real — but it is neither uniform nor destined to end in wholesale decoupling. The continent’s response combines principled investments in open source and sovereign clouds, high‑visibility procurement shifts, and pragmatic partnerships with large vendors that now offer sovereignty features. The critical question going forward will be whether Brussels and member states can translate political will into coordinated industrial policy, interoperable standards, and the human capacity needed for migration and maintenance.Small states such as Malta remind us that there is more than one route to resilience: pragmatic adoption of advanced tools, backed by governance, training and localisation, can deliver public value now. Larger ambitions — regional sovereign clouds, European AI training infrastructure, and a competitive supplier market — will take time and money. The wiser course for European policymakers is to treat digital sovereignty as a multi‑vector program: shore up legal and technical controls where immediate risk is highest, accelerate pilots that can scale, and align procurement and R&D to grow the European supplier base. That approach avoids the false binary of “ditch or submit” and gives Europe a credible strategy to win back control — one practical project at a time.
Source: The Malta Independent Europe’s digital rebellion: ditching American tech - The Malta Independent
