Digital sovereignty is a shared European stack that is reliable enough for governments to run on

The "stack" as it stands, and the many roads to sovereignty
A Quiet Project.



Last year, the chief prosecutor of the International Criminal Court lost access to his Microsoft email after the United States sanctioned him. He had to move to a Swiss provider. The court, seated in The Hague, has since announced that it will replace Microsoft software on its workstations with openDesk, an open source productivity suite of German provenance. For Europe's governments, this cut-off was the moment a possible, distant risk became decidedly less abstract. For years the worry about American technology had been about access: the US CLOUD Act lets American authorities compel American firms to hand over data wherever it is stored, and Microsoft has conceded it cannot guarantee otherwise. The ICC episode was about something else. It showed that a foreign government, acting through a vendor, could switch off a public institution's tools.


One might expect alarm. Instead, there have been quiet moves, driven by a mix of cost, strategy and geopolitical unease. Denmark's Ministry of Digital Affairs began replacing Microsoft Office with LibreOffice; Copenhagen announced a review of its Microsoft use, and Aarhus began replacing Microsoft services. Schleswig-Holstein has moved most of its 30,000 public-sector workstations to LibreOffice, and Dutch municipalities are piloting a government-built workplace. These moves are announced as cost decisions, pilots and prudence. No minister declares an emergency.


Quiet is right, for two reasons.


The first is diplomatic. Loudly declaring distrust of the firms of one's security guarantor is costly while Russia's war against Ukraine continues, and any transition will take years during which existing vendor relationships must keep working. Denmark has just shown what quiet could look like. After more than a year of American threats over Greenland, Danish, Greenlandic and American officials negotiated quietly for months, and the agreement signed in September 2026 keeps Greenland within the Kingdom. It created no Danish heroes, and it was not meant to. Its price is debatable, since Washington describes the military access it gained as permanent. But the method is instructive: firmness without theatre, patience over spectacle. Achieving digital sovereignty calls for the same temperament.


The second reason is more basic. Panic is only useful when there is somewhere to run. A government that declares its office software a security risk, without people able to build, run and support an alternative, has created a crisis it cannot resolve. 


This essay starts from three premises. (1) Decentering American big tech in government stacks, in Europe and beyond, is good: for security, for continuity, for democratic accountability and for economic development. (2) Now is the moment to do it. (3) The right way to do it is quietly, by building the capability that would make alarm unnecessary.

What follows is an account of what the technology is today and what capability might look like, layer by layer, and why the open and local route is also the more emancipatory one.


 

The moment


The Greeks had two words for time: chronos, the time that passes, and kairos, the opportune moment. Digital sovereignty has been discussed for a decade of chronos. Several things have now converged to make it kairos.


First, the risk has become harder to downplay. Before the ICC episode, the risk story was muddy: the certain disruption and cost of leaving set against a dependence whose dangers seemed hypothetical, overblown even. Afterwards it was a story anyone could follow: an official at a court in The Hague, cut off from his own email by an American corporation in response to an American foreign policy decision.


Second, policy has caught up, and at the right time. In June 2026 the European Commission proposed its Technological Sovereignty Package. Its centrepiece, the Cloud and AI Development Act, sets four sovereignty assurance levels for cloud services and would require sensitive public-sector data to be hosted on services controlled by EU entities. The package also includes an Open Source Strategy, which positions open source as a lever for sovereignty and favours it in public procurement of cloud and AI software. The legal scaffolding for a European stack now exists, at least in draft, and it arrives as contracts come due. Every licence renewal, hardware refresh, and end-of-support deadline is a decision point; a government that misses one is locked in until the next.


Third, the components have matured. Open alternatives for office work and collaboration are no longer hobby projects: Germany's openDesk, France's La Suite, Nextcloud, LibreOffice and Matrix-based messaging are in production use in public administrations. The Dutch government is assembling such components into DAWO, a government-built digital workplace on a Linux base. When four municipalities, Amsterdam among them, began piloting it this year, the early verdict was that the technical foundation is in place. That said, integration and organizational change are ongoing challenges.


Finally, the phrase digital sovereignty itself is up for grabs. American vendors now sell "sovereign cloud" and certify partners in "digital sovereignty." If Europe does not embody the word with capability, the vendors will fill it with compliance products. Microsoft has just launched a formal "digital sovereignty" specialization for its partners. This is the moment when the practical meaning of the term is socially constructed, when we move from digital sovereignty the concept to digital sovereignty-in-practice.


There is an obvious objection: cost. The objection is fair, the cost is real. Open alternatives are not "free." License savings can be eaten up by spending on skills, implementation and governance, and sovereignty sometimes means paying more or accepting less functionality. But the objection compares the wrong options. The choice is not between paying for a transition and paying nothing. Dependence carries its own costs, in license terms set by the vendor and in strategic exposure (hard to price until it materializes). The real choice is between paying for a transition now, gradually and on our own schedule, and paying for one later with our backs against the wall: an emergency migration with no trained staff, no tested alternatives and no time to negotiate. The first is a strategic investment. The second is a crisis response. Every renewal that passes without building capability makes the second more likely, and more expensive.

 


The stack


The "stack" is shorthand for the layers of technology a government runs on, from chips and cables to the applications civil servants touch every day. Sovereignty looks very different at each layer, and so does the realistic goal. That goal is not necessarily autarky. It is, in a more practical sense, about replaceability: the ability to understand, host, change, and when necessary, leave each layer.


The physical layer is chips, data centers, and power and connectivity infrastructure. Here Europe is dependent but not powerless. Advanced AI chips come from Nvidia and leading-edge fabrication from Taiwan, but the lithography machines that make modern chips possible come from ASML in the Netherlands, and much of the world's telecom equipment comes from Ericsson and Nokia. The target is managed interdependence, using these chokepoints as bargaining power rather than trying to rebuild every factory at home.


Cloud infrastructure is where the economics are hardest. The three American hyperscalers, Amazon Web Services, Microsoft Azure and Google Cloud, hold about 70 percent of the European market. With American firms investing roughly €10 billion a quarter in European data centers, building a European rival at the same scale is not realistic. The target is a tiered market in which sensitive public workloads run on European-controlled providers, and in which the software layer above is open enough that workloads can move.


Endpoints are the computers and phones people work on. Desktops are tractable: Schleswig-Holstein's state chancellery has moved most of its staff to Linux, and Dutch municipalities are piloting a Linux-based government workplace. Phones are another matter. National identity apps run on Apple's and Google's mobile platforms, and there is no serious alternative. Here the realistic tool is regulation through the Digital Markets Act, rather than meaningful replacement.


Productivity and collaboration is the most mature alternative layer, and the one where most current migrations happen. In practice it is what a civil servant touches all day: email and calendar, documents and spreadsheets, shared files, chat and video meetings. Each piece now has an open counterpart in public use. Schleswig-Holstein has replaced Word and Excel with LibreOffice and Outlook with Open-Xchange, France is moving government video meetings from Teams and Zoom to its own platform, Visio, and Nextcloud and Matrix-based messaging run in administrations across Europe. The hard part is rarely the software itself. It is the ten-year-old templates and macros, documents exchanged with outside parties who still use Microsoft formats, links into case-handling systems, and thousands of people relearning habits. The Dutch government's DAWO shows what the target looks like: a state acting as integrator, assembling existing European open components into a workplace civil servants can actually use, and taking responsibility for the support and training that make it stick.


Domain systems are the long, invisible tail: health records, case management, tax, policing. In eastern Denmark, the health records of nearly three million people sit in Sundhedsplatformen, built by the American firm Epic. Police in four German states use Palantir's analysis software. Systems like these often run for a decade or more, so the realistic near-term move is to write exit and data-portability clauses into every renewal and to insist on open standards that make vendors replaceable.


Data and AI is the newest layer and the most concentrated. Frontier models are American, with Mistral as Europe's main exception, and "open weights" do not guarantee European provenance. As with cloud, the answer is to sort the work rather than to match the frontier. Much of what governments want from AI, such as summarizing case files, drafting routine letters, translating, transcribing meetings and searching internal documents, runs well on smaller open models hosted on European servers. A narrower band of tasks, like complex analysis, advanced coding or open-ended research, may genuinely need frontier models, and those can be reserved for work that involves no sensitive data. Health records, tax files and police data should never leave infrastructure the state controls.


Defense and strategic uses break this neat division. Intelligence analysis, cyber defense, crisis planning and protecting critical infrastructure need both the most capable models and full sovereign control, and here relying on a foreign provider is a strategic exposure. This is the strongest case for Europe investing in frontier capability of its own, and for pooling that effort across member states rather than duplicating it. The target for most of government is the capability to decide which tasks need what, and to evaluate, adapt and host capable open models on European compute. For defense and strategic needs, the target is higher: frontier-grade capability that Europe controls.


 

The ecosystem


Everything in the previous section is, in a sense, a shadow. The stack is the technical projection of something harder to see: capability. Behind every layer that a country can truly run are people who can build, operate, fix, teach and, when needed, fork it.


Those people do not appear on their own. They are produced and kept in work by an ecosystem: allied firms that build and integrate applications, developers who can fork open code and maintain it locally, help desks that can support thousands of civil servants on an unfamiliar system, and vocational programs, university courses and teachers who train the next generation in these tools. A license that grants the right to fork is worth little without that ecosystem behind it.


This is why the quiet makes sense and why the moment matters. American vendors already have such an ecosystem, built over decades: certified partners, consultants, training curricula and a workforce that learned its trade on their products. 


Thankfully, the metaphor needs one correction. A shadow is passive; it depends on the object and does nothing back to it. Technology does act back. Denmark's public IT workforce is skilled in Microsoft largely because the stack has been Microsoft. Each generation trains on the systems it encounters, and those systems shape which skills form. Capability reproduces itself through people. If today's stack trains tomorrow's workforce, then every open system a government adopts now is also a training ground. A ministry running Linux and openDesk is not only reducing a risk. It is growing the people who will make the next migration easier.


The shadow can also mislead. A stack wearing European branding can cast the shadow of American capability: one of the consortia that won a 2026 European Commission sovereign cloud contract includes a joint venture between Thales and Google Cloud. Conversely, a deployment hosted on American infrastructure can conceal real local competence. Measuring sovereignty therefore means measuring the ecosystem: who maintains the code, which local firms can support it, how many people are trained to run it, and whether a government could leave the system it uses tomorrow and still keep working.



The roadmap


There are two roads to decenter American big tech. One replaces American vendors with European ones: national champions in cloud, software and AI, protected by procurement rules. The other builds on open code, local capability and shared infrastructure, with European firms in the mix as builders, integrators and operators rather than new gatekeepers. I argue for the second because it is the more emancipatory move. It changes the logic, not just the owner: public money for public code, maintenance as a shared obligation, and value that stays with the institutions that create it. It also gives European values somewhere to live, since privacy and accountability are hard to enforce on systems no one can inspect. But this holds only under conditions. An open license does not produce non-profit logics by itself; governance does, and state ownership of openDesk or DAWO is not the same as shared governance with maintainers and users. And European values are contested within Europe, from proposals to scan private messages to fears that EU's digital identity wallet becomes a tracking tool, so safeguards must be built into the infrastructure itself, not only into policy.


If the stack is a shadow, the roadmap is mostly about how one goes about bulding what casts it. A few principles follow from the layers above.


Aim for replaceability, not replacement. No government will run on a fully European stack soon, and trying would break services citizens depend on. The realistic goal is that every layer can be left within a known time and cost. That means exit clauses, open standards and data portability in every contract, starting with the next renewal.


Share, don't fork 27 times. Open code tempts every country to build its own variant. The better path is the one DAWO points to: common European components, assembled and supported by national integrators. Shared maintenance is cheaper, and a larger user base attracts more contributors.


Fund people, not just code. The EU Open Source Strategy foresees €2 billion over seven years, a modest sum against the roughly €10 billion American hyperscalers invest in Europe every quarter. Money alone will not close that gap. The levers are institutional: public open source offices, paid maintainers, vocational certifications on open tools, and university curricula that teach on the stacks governments want to run.


Respect the different clocks. Office software can move in three to five years, domain systems in ten to fifteen, and mobile perhaps never. Sovereignty will arrive as an uneven patchwork, and that is fine. The goal is not uniformity but a steady shift in where capability sits.


Think beyond the electoral term. This is the real leverage. Contracts are formally negotiated with vendors, but in practice with account managers who answer to quarterly targets, inside companies run on annual growth plans, within a geopolitics set by politicians who face voters every two, four or six years. People are bound by time in a way that states are not. A government can plan across decades; the people across the table from it, and the people who lead it, mostly cannot. That cuts both ways. Munich moved its administration to Linux and later moved back to Windows: migrations that depend on one political term invite reversal. Procurement commitments, budgets and governance therefore need to outlast the people who start them. None of this needs to be hidden. A state that thinks in decades loses nothing by saying so openly, which is why this can be a quiet project rather than a secret one.



The quiet project


Digital sovereignty is a shared European stack that is reliable enough for governments to run on.


Some of my words mean something, sometimes. "Shared" because 27 national forks would be weaker than one common base. "Reliable enough" because the bar is parity with what civil servants use today. "Run on" because sovereignty is tested on an ordinary working day, and not in a press release about a big transformation initiative.


But the stack is only the shadow. What casts it is a European ecosystem of firms, maintainers, teachers and trained public servants, able to build, run and leave the technology they depend on. That ecosystem cannot be bought in a single procurement or announced in a single speech. It has to be grown, layer by layer and renewal by renewal. That is why the quiet is the right move. Panic would ask governments to flee to an alternative that does not yet fully exist. A quiet, steady project of building capability is how that alternative becomes real.

 


Sources


This post began as a memo, the sort of demystify-the-tech memo I typically write at the outset of a project, in order to have clarity about my object of inquiry; In this case, the typical EU government "stack." It then morphed into the basis of a short 'kronik' style piece in Danish, intended for a local newspaper, as part of DIGI's efforts to create impact beyond academia. The kronik, however, had very little to say about technology, per se, and was more about the politics of a transition. I'll link to the kronik here if it ever sees light of day. I felt, however, that the preparatoy English frankenessay that had elements of both technology and politics was odd and "me" enough that it deserved its own humble space here on my blog. -AB



Comments

Post a Comment