The ambition of Europe to achieve digital sovereignty meets with a sobering reality: an estimated 90 per cent of the continent’s cloud and digital infrastructure remains dependent on US-based providers. Competition economist Cristina Caffarra, founder of the Eurostack Foundation, said such dependency exposes European institutions to legal, political, and operational risks impossible to fully mitigate with contracts or technical safeguards.
A Clash of Legal Frameworks
This is a structural legal conflict. The US CLOUD Act gives American authorities the right to demand that US technology companies provide access to data, wherever in the world that data happens to be. This is in direct contradiction with Europe’s General Data Protection Regulation (GDPR), which places stringent obligations on organisations to ensure personal data is protected, and risks are assessed through mandatory Data Protection Impact Assessments (DPIAs). For many public bodies, such DPIAs are increasingly identifying US hyperscaler services as presenting an unacceptable level of risk.
From Policy Debate to Practical Action
While debates among European policymakers about regulatory reforms continue, more and more public institutions are taking concrete steps to regain control of their digital infrastructure. Most recently, Austria’s Federal Ministry for Economy, Energy and Tourism transferred over 1,200 employees onto Nextcloud, a European open-source collaboration platform.
Why European Alternatives Are Gaining Ground
According to its website, Nextcloud offers secure file sharing, collaboration, and communication with self-hosting on-premise or in trusted European data centres, giving organisations full control over data and encryption keys. In the case of the Austrian ministry, sovereignty rather than cost savings tipped the balance. A rapid proof-of-concept showed European alternatives could meet user needs while offering greater transparency and influence over product development.
Institutional Shifts Across Europe
Similar dynamics are unfolding elsewhere. The International Criminal Court in The Hague announced plans to replace Microsoft Office software with a European open-source alternative amid concerns about political pressure and access to sensitive data. The move highlights how technology decisions at the highest institutional levels are increasingly shaped by legal and geopolitical considerations.
The Limits of ‘Sovereign Cloud’ Claims
In response, US hyperscalers have sought to address European concerns by promoting so-called “sovereign cloud” solutions based on EU-located data centres or partnerships with local operators. Critics such as Caffarra argue this amounts to “sovereignty washing”. As long as parent companies remain subject to US law, European customers cannot be fully protected from extraterritorial data access obligations.
Lessons From Past Initiatives
Caffarra points to initiatives such as Gaia-X as cautionary examples, arguing that the inclusion of major US cloud providers diluted the original goal of building a genuinely European alternative. In her view, Europe’s weakness lies not in technical capability but in the absence of a coherent industrial strategy.
A Blueprint for European Resilience
The Eurostack Foundation advocates a three-pillar approach: prioritising European providers in public procurement, encouraging private investment in European digital infrastructure, and creating dedicated funding mechanisms to scale local technologies. The objective is not full independence from US technology, but resilience, ensuring Europe retains a meaningful share of its own digital market.
From Regulation to Construction
For universities, policymakers, and students of technology governance, the lesson is clear: digital sovereignty will not be achieved through regulation alone. The examples emerging from Austria, Germany, France, and international institutions show that incremental migration to European solutions is possible when legal obligations, political will, and long-term investment align. As Caffarra argues, Europe now faces a choice between continued debate and decisive action to build its own digital foundations.
