Since Donald Trump became president of the United States, there has been increasing talk about the need for sovereignty. Because what once seemed unrealistic, is now becoming probable. But what exactly is digital sovereignty ? and why is it important for businesses ? This is what we will be diving into in this article.

1. What is digital sovereignty ?

Sovereignty refers to the inherent quality of a state, an organization, or an individual, to have exclusive jurisdiction, and therefore to have absolute, unlimited and unrestricted power over a right, an ability, or a law in its application.

Applied to the IT world, we can thus say that digital sovereignty involves being able to choose technologies that guarantee the authenticity, confidentiality, availability and integrity of data, while complying with local regulations. All without external dependencies, to ensure autonomy in decision-making.

In France and in the rest of Europe, this concept is part of a broader commitment towards data protection, economic resilience and national security, especially since the adoption of the GDPR and the rise in cyberthreats.

This concerns data, infrastructure and software, but also the service providers and the people involved in deploying and maintaining these solutions.

2. Digital sovereignty = european solutions ?

The idea that digital sovereignty is about choosing solutions developed in Europe is both appealing and reductive. Prioritizing local actors helps :

• Support the national economy and local employment

• Benefit from better compliance with the GDPR and european standards (e.g. DMA )

• Reduce legal risks associated with the extraterritoriality of laws (e.g. Section 702 of the US FISA, that allows US intelligence agencies to collect data on foreign citizens or companies without warrants)

⚠️ But beware, a solution “made in Europe” is not automatically sovereign. It may depend on foreign components, non-European subcontractors, or proprietary technologies controlled by external actors.

Examples :
• A French SaaS provider whose solution is hosted by a US company like AWS

• A French hosting provider managing physical servers located in France, but using an operating system or management softwares from a US company

3. Digital sovereignty = open source ?

Open source is often presented as the miracle solution for digital sovereignty. Even though it is developed internationally, the availability of its source code makes it possible for anyone to make it their own, as if they had created it themselves, making it a key aspect of their technological independence.

👍 The advantages of open source :

• Transparency : the code is auditable, limiting backdoors and hidden dependencies

• Flexibility : possibility to tailor the tools to one’s specific needs without having to depend on a software publisher

• Independence : no proprietary lock-in, possibility to fork the project if necessary

• Collaboration : sharing costs and innovations between public and private actors

⚠️ But open source does not guarantee sovereignty on its own :

• Maintenance and expertise : it is necessary to have the appropriate skills to audit and maintain these systems, either internally or through a trusted service provider

• Deployment : an open source solution doesn’t necessarily involve a deployment on sovereign hosting

• Scope : open source hardware (called open compute) has been developing for years but few offers are available today

• Business model : some open source licenses limit commercial use

• A company using an open source CMS, such as Wordpress, is still dependent on third-party plugins that are not always open source

• Outsourcing the management of a Nextcloud file-sharing server (Google drive equivalent) to a US hosting provider

4. Digital sovereignty : what to aim for ?

It is thus clear that digital sovereignty is a balance that needs to be defined. It can’t be reduced to only choosing European solutions, or solely relying on open source. It is a comprehensive approach, starting with analysing our dependencies and then combining informed technological choices, regulatory compliance and risk management.

As a company or an institution, your challenge is to create a customized strategy, assessing your situation, your risks, and the available options.

💡 Tip !

Don’t forget that you do not have to be on your own, managing everything yourself. Communities come together, companies offer their support, initiatives such as the European Digital Resilience Index are emerging.

Mapping your resources and your dependencies is the key starting point to create your strategy. This is why Koevoo offers a free digital resilience assessment for micro entreprises !

© Cover photo Wirestock, Freepik.