Its own clouds, its own chip manufacturing, its own AI models. Despite billions invested in digital sovereignty, digital solutions from foreign providers dominate in Europe. Around 264 billion euros flow to non-European cloud and software providers every year. Therein lies a dilemma: Europe is financing its own dependence.
The key bottleneck may lie less in investment than in demand. As long as public bodies and companies use non-European providers because they are cheaper and more convenient, European alternatives can hardly gain ground. Digital sovereignty does not mean autarky, but the capacity to act in an emergency.
We pay twice: with money and with our capacity to act
Mistral shows how difficult it is even for European pioneers: In July, the French AI company concluded a billion euro agreement with Microsoft. Mistral thereby benefits Microsoft's sales network and infrastructure. At the same time, however, the question arises of how Europe can achieve digital sovereignty if even its leading AI companies depend on US corporations for growth and market access.
The case of Huawei and ZTE shows how expensive it can be to correct strategic dependencies only after the fact. For years, European network operators installed components from the two Chinese companies. At the time, this was rational: the technology was cheap and competitive, and explicit requirements were lacking. Since then, however, the understanding of security has changed. With the Cybersecurity Act 2, the European Commission is planning a change of course. According to the mobile industry association (GSMA), the removal is likely to cost 30–40 billion euros in direct replacement costs; the European Commission estimates 10–13 billion. Whether 10 or 40 billion euros: the price arises because Europe only considers the strategic consequences of its procurement once the dependence already exists.
Anyone who leaves central administrative and communication systems to foreign providers makes their operation dependent on decisions made outside Europe. The International Criminal Court (ICC) in The Hague shows how services can be switched off from outside: In 2025, following US sanctions against the ICC, its chief prosecutor's Microsoft email account was blocked. US corporations thus implement political decisions from Washington even with regard to institutions in Europe. Export controls can also hit Europe, for example when manufacturers are no longer allowed to deliver security updates, and devices become vulnerable as a result. Digital sovereignty is therefore measured by those who decide on data, operations, and access in the event of a conflict.
European alternatives need demand
At present, complete independence from US providers is unrealistic. What is needed, therefore, are resilient alternatives, the ability to switch providers and control over one's own systems. Solutions from other non-European countries would merely shift dependence. However, this is not about isolation, which would be impossible in a globalized world anyway, but about having a usable choice in an emergency. Then there is the human factor: as long as we do not teach alternatives already during education and training, the majority will keep falling back on familiar US solutions out of habit.
Legal provisions requiring a fixed share of public contracts for European providers would also make sense. The Public Procurement Act, whose proposal the European Commission presented on 9 September, points in this direction. The proposal does not provide for binding quotas, however, but does allow European offers to be given preference. The legislative process for the proposal is expected to be completed by the end of 2027 followed by a two-year transition period before the rule starts to apply.
In addition to laws, there is a need for awareness of the risks of digital dependencies in politics, public administration, and civil society. Europe must prevent critical dependencies from becoming irreversible. Digital sovereignty begins where Europe has a real choice and can also use it in an emergency.
About the author:
Lena-Sophie Drews is a researcher in the research focus International Cybersecurity at IFSH.
