Digital Sovereignty and the Emerging European Defense Sector

Technology is now portrayed as a central instrument of statecraft, turning former efficiency-driven interdependencies into strategic liabilities as the international order frays. The Arctic is used as a metaphor for a renewed “Great Game,” with cyberspace framed as its borderless but deeply political analogue where states compete for influence, intelligence, coercive advantage, and economic gain. In this context, the EU is urged to stop behaving like a bystander and instead revise its relationships—including with its largest partners, the US and China—in pursuit of autonomy, security, intellectual property protection, and competitiveness. The text grounds this urgency in concrete exposures: deep reliance on Chinese components and supply chains that may conceal vulnerabilities; heavy dependence on US hyperscalers and the jurisdictional risks created by extraterritorial legal reach (notably the US CLOUD Act), which can undermine contractual safeguards and expose sensitive data. Digital sovereignty is presented as a necessity rather than ideology, but only if defined carefully: not isolation or autarky, but the capacity to decide and act under stress. Practically, this means identifying “fault lines” where dependency constrains options, creates blind spots, or magnifies failure—especially across identity, cybersecurity, cloud governance, data exchange, and software supply chains—while maintaining cooperation with trusted partners from a position of agency rather than necessity.

Europe’s sovereignty challenge is described as structural because non-EU firms control many critical layers of the digital stack (operating systems, cloud, chip architectures, AI frameworks, and key security tools). The dominance of hyperscalers is linked to systemic vulnerability, long-term lock-in, and geopolitical pressure, even when data is hosted in Europe but still exposed to foreign law. The text highlights a gradual European rebalancing through public-sector migrations away from US tools (e.g., France’s planned shift for civil servants, municipal open-source moves, Schleswig-Holstein’s large-scale migration, and reported German federal preference for on-premises). Sovereign cloud efforts are framed as accelerating via European providers and national initiatives, while US cloud providers respond with sovereignty-oriented offerings that add technical and governance controls yet cannot erase US jurisdictional exposure. Data sovereignty is tied to Schrems II and the requirement for essentially equivalent protection on cross-border transfers; the document emphasizes that meaningful mitigation depends on lifecycle controls, cryptographic control, privacy-enhancing technologies (including confidential computing), and retrievability. Supply chain security is elevated into a core pillar of sovereignty because compromised vendors and manipulated updates can propagate silently through trust relationships; resilience depends on due diligence, contractual safeguards, encryption, segmentation, preparedness, diversification, exit strategies, and provenance/integrity controls against backdoors and kill switches. Finally, the piece connects digital sovereignty to European defense modernization: rising budgets, growing industrial order books, and a fast-growing defense tech start-up ecosystem reinforce that software-defined systems, AI, cloud resilience, post-quantum cryptography, space-cyber integration, and secure remote access for OT/ICS are becoming foundational. The overall argument culminates in practical steps for EU organizations: engage incumbent vendors, design for resilience, diversify to avoid lock-in, implement encryption and Zero Trust, strengthen supply chain transparency, tighten contractual/jurisdictional controls, build crypto agility and post-quantum readiness, and selectively shift workloads to EU-jurisdiction providers with careful planning.

• Bilateral trade between the EU and China reached €732 billion in 2024.
• Hyperscalers (AWS, Microsoft Azure, Google Cloud) capture around 70% of the European cloud market.
• Roughly 80% of corporate cloud and software spending in Europe flows to US vendors.
• France announced that 2.5 million civil servants will transition from US video conferencing tools to a domestic platform by 2027.
• Germany’s Schleswig-Holstein migrated tens of thousands of employee inboxes from Microsoft to open-source email and replaced SharePoint with Nextcloud.
• EU defense spending in 2025 is cited as approximately €381 billion (per both NATO dataset and EDA reporting).
• Since February 2022, more than 230 defense tech start-ups have been founded across Europe.
• Venture investment in European defense tech reached €2.5 billion in 2025, described as more than 10-fold since 2020.
• More than 80% of the EU’s digital infrastructure and technologies are imported.
• Since 2022, 78% of defense-related procurement has come from outside the EU.

• “Technology has become a primary instrument of statecraft.”
• “The post-Cold War belief that economic interdependence would pacify rivalry now reads as an artefact of a brief historical interlude.”
• “Cyberspace is the non-terrestrial analogue of that contest.”
• “The real question is not whether digital sovereignty supports the EU’s cybersecurity interests, but rather, how can digital sovereignty be structured to support these interests without undermining the EU's security or economic competitiveness?”
• “Cybersecurity is not enhanced by duplication for its own sake, nor by excluding trusted partners.”
• “Digital sovereignty, properly understood, is neither isolation nor autarky. It is the capacity to decide and to act when circumstances demand it.”
• “Alliances are most durable when they are chosen.”
• “Acting as a unity in this field is no longer a matter of idealism, but a matter of survival.”
• “Foreign legal instruments such as the US CLOUD Act can compel access to data even when it is stored within Europe, creating tension between regulatory compliance and operational reliance on global providers.”
• “Cyber incidents rarely announce themselves in advance.”