European digital sovereignty has become one of those concepts that make the transition from the language of public policy to technology providers’ sales pitches with remarkable ease. It sounds serious, addresses genuine concerns and fits well with a time when data, the cloud, artificial intelligence and cybersecurity have ceased to be merely business support systems and have become critical infrastructure. The problem, however, is that the more frequently the concept of sovereignty appears in marketing communications, the greater the risk that it will come to mean everything and nothing at the same time.
For European companies, this should not be a buzzword designed to reassure the board or look good in tender documentation. It should be a question of genuine control: over data, suppliers, jurisdiction, costs, architecture and the ability to change decisions. In other words, it is not a question of whether a service has been described as ‘sovereign’, but whether the organisation truly understands what it is dependent on and how far-reaching the consequences of that dependence are.
In this sense, Europe’s full digital sovereignty is currently more of an ambition than a reality. This assessment may be considered uncomfortable, but it is difficult to ignore if the debate is to move beyond mere declarations. Europe does not currently possess a comprehensive, globally competitive technology stack that would enable it to become independent of external suppliers in the short term. It relies on non-European semiconductors, global cloud platforms, American enterprise software, developer tools and artificial intelligence models developed by the world’s largest technology players.
This does not mean that European companies should abandon their ambitions for greater independence. Rather, it means that one must not confuse the strategic goal with operational reality. An immediate severing of ties with global suppliers would be not only difficult for many organisations, but also commercially irrational. Hyperscalers and the largest software platforms offer the scale, pace of innovation, security, ecosystem of services and access to AI tools that cannot be replicated solely through a political decision or a publicly funded programme.
Therefore, the most sensible understanding of digital sovereignty should not lead Europe towards technological autarky. A far more mature goal is the ability to choose. A sovereign organisation is not one that, as a matter of principle, rejects every global provider, but one that is able to consciously assess where utilising a provider’s scale is an advantage, and where it begins to create a dependency that is difficult to accept. This is the fundamental difference between strategic control and a symbolic gesture.
This is precisely why data localisation, whilst important, cannot be treated as synonymous with sovereignty. A server located in Europe does not automatically resolve issues of jurisdiction, administrative access, key management, subcontractors, metadata, system portability or migration costs. A company may have its data stored locally, yet remain deeply dependent on an architecture it cannot migrate from, a contract it cannot easily renegotiate, or an ecosystem of services which leaving would entail a costly overhaul of processes.
This is precisely where the debate on sovereignty becomes relevant to business. Not at the level of political declarations, but in the day-to-day decisions of CIOs, CFOs and boards of directors. If a company does not know which systems are critical to it, where the greatest lock-in occurs, who actually controls access to data, and how much it would cost to move away from the current model, then talk of sovereignty remains nothing more than rhetoric. A genuine strategy begins with a dependency map, not with the selection of a supplier bearing the right label.
At the same time, it must be said in all honesty that Europe will not build greater digital autonomy through regulation alone. Regulations can create a framework, clarify responsibilities, enforce transparency and curb the riskiest practices. However, they cannot replace innovation, capital, expertise, the courage of entrepreneurs and customers’ willingness to buy local technologies. Digital sovereignty is not achieved the moment a programme is announced. It is achieved when solutions appear on the market that are good enough for companies to adopt them not out of obligation, but out of conviction.
This distinction is particularly important because public funds are necessary, but they are not in themselves a guarantee of innovation. They can finance research, infrastructure, initial roll-outs, expertise and strategic projects that the market could not sustain on its own. However, it cannot replace competitive pressure, product discipline, real customers and the ability to commercialise. Technology developed primarily to meet local criteria, but lacking any qualitative, price or functional advantage, quickly becomes a costly symbol rather than a viable alternative.
This is where the concept of digital patriotism comes in, which should be distinguished from protectionism. Protectionism seeks to shield local players from competition, often at the expense of quality and efficiency. Digital patriotism, understood sensibly, should mean something else: a willingness to take European suppliers seriously, to allow them to compete, to test their solutions and to entrust them with projects when they are able to meet business requirements. It is not a question of buying locally at any cost, but of ensuring that local companies are not left behind before the discussion has even begun.
This is the responsibility not only of public institutions, but also of big business. There will be no strong European technology ecosystem if European companies always choose the largest global suppliers out of habit, caution or the belief that a well-known brand automatically means less risk. Of course, local suppliers cannot expect preferential treatment. European technology will not win simply because it is European. It can only win if it is both European and competitive. But for that to happen, it must be given the opportunity to enter the market through projects that allow it to grow.
For businesses, this represents a very practical way of thinking about sovereignty. It is not about a radical overhaul of the entire architecture, nor about abandoning global platforms where they are the best choice. Rather, it is about consciously limiting the riskiest dependencies, segregating systems according to their level of criticality, negotiating realistic exit strategies, controlling data portability, and exploring local alternatives where these can provide greater flexibility, transparency or control.
There is nothing romantic about sovereignty understood in this way. Instead, there is a great deal of pragmatism. A company that knows where it can benefit from global scale and where it should build greater independence is better prepared for regulatory, geopolitical, cost and technological changes. It is not entirely independent, because in today’s digital economy, complete independence is an illusion. However, it is less vulnerable to suppliers’ decisions, price changes, contractual restrictions and technological paths from which it is difficult to turn back.
Europe will not achieve digital sovereignty simply by repeating that it wants to be sovereign. Nor will it achieve it through solutions that are sovereign in name only but cannot compete with the best technologies on the market. If sovereignty is to be more than just an elegant phrase in strategies and commercial proposals, it must be treated as a long-term project to build capacity: in companies, products, expertise, capital and customers.
Europe’s full digital independence is currently either unrealistic or extremely uneconomical. Greater technological autonomy, however, is possible. The difference between the two is fundamental. The former is a slogan that is easily abused. The latter is a strategy that requires consistency, patience and market discipline. Digital sovereignty does not begin where Europe turns its back on the world, but where it ceases to be merely a customer of other people’s technology and begins to create solutions that the world has reason to take seriously.
