Five things you should know about digital sovereignty in Europe

From the apps we use to the data our governments hold about us, our everyday lives are increasingly dependent on critical hardware and software produced in other parts of the world. Meanwhile, the land-bound data centres that cater to Europe’s growing thirst for computing power are often owned and operated by foreign companies. These dependencies create serious vulnerabilities––with consequences that touch all of us. 

Here are five things you should know.

1.  We should reduce risky tech dependencies on other jurisdictions.

Digital sovereignty, sometimes called technological sovereignty, refers to a country’s ability to securely control the digital infrastructure critical to the everyday operations of citizens and the state. It’s not just about data storage, but also about being able to manufacture or obtain software and hardware (like semiconductors and GPUs) that allow for competitive technological development and digital security for individuals and societies.

‘Tech sovereignty means that we shouldn't have risky dependencies,’ explains Henna Virkkunen. ‘We shouldn't have the case that someone can switch off our services with their decisions.’ For European countries, the discussion centres on how to secure EU data and digital services, like cloud computing and AI systems, as well as tech supply-chains, in the face of geopolitical and financial instability.

Notably, only 20 percent of Europe’s digital infrastructure and technology currently comes from within the EU. Only around 10 percent of the global supply of semiconductors that are essential to computing are manufactured in Europe and, at present, European providers hold just 15% of our cloud-computing market. So you could say there’s quite a hill to climb.

2. There have already been critical disruptions globally—but even bigger risks loom.

Dependencies have already led to critical global incidents and the consequences touched everyday life. In 2024 a buggy software update from US security firm CrowdStrike affected 8.5 million Windows devices around the world, grounding flights, disrupting healthcare networks, deadlocking banking and finance and halting government services. A little over a year later, an outage affecting US-owned Amazon Web Services (AWS) crippled the UK customs services and major banks, even driving Snapchat, Roblox and Duolingo offline.

It’s also a concern that these dependencies can be weaponised for geopolitical gain, says Vili Lehdonvirta. ‘Anthropic’s most advanced AI model [Fable] was made available to European users, then suddenly withdrawn on the orders of the White House,’ he points out. Other cases he explains include the US, angered at actions against Israel, imposing sanctions against International Criminal Court prosecutors and judges based in the Netherlands. The prosecutors and judges lost access to Microsoft Outlook, Amazon and other digital services.

Lehdonvirta emphasizes that these cases are reminders that even if a data centre or digital service is housed on home turf, the company that operates it may be subject to the laws (and political whims) of the country of corporate ownership. For the companies most present in Europe – the so-called hyperscalers AWS, Google and Microsoft – that means the US.  

3. Europe hopes to limit the power of tech giants with new laws. 

Since the start of Virkkunen’s term at the European Commission (EC), several laws have been enacted to try to limit the power of the handful of massive global tech companies. 

The Digital Markets Act is about these gatekeepers, explains Virkkunen. It aims to level the playing field, allow better market access for smaller providers and prevent tech monopolies. The Digital Services Act is about protecting those who use digital services, especially minors, and the recently enacted Artificial Intelligence Act gives enforcement power around the safety and security of AI models and their training.

‘Now AI is more and more integrated into these services, of course it means new kinds of risks,’ says Virkkunen. ‘The problems are not solved because we know that these technologies are developing very, very fast. Nobody is really doing enough in this field, so the work is ongoing.’

Virkkunen thinks the legislative approach is having an impact. Compliance is being won––for example, Google copped a whopping 890 million euro fine for breaching the Digital Markets Act in July, 2026––but it’s in the face of tactical delays and deliberate stone-walling on the part of big tech. 

‘They know that if they want to do business in Europe, they have to respect our legislation––they fully understand it, but at the same time, they are always defending their own business very strongly,’ says Virkkunen. 

4. But legislation alone isn’t enough—Europe needs its own tech

As well as making rules to try to keep the tech giants in line, the European Commission is taking actions to support European-owned tech providers and manufacturers, while barring gatekeeper companies from offering services to high risk, critical public sector services in Europe. Think defense, law enforcement and internal and external security services.

It’s a step towards Europe having better control and security over its own data. However, according to Lehdonvirta, it’s also an admission that, even with restrictive legislation in place, depending on the tech giants for critical services is still problematic. And despite the EC’s best intentions, even Finland is still doing it. 

Just last year Finland’s social security institution Kela decided to start moving its data and services to Salesforce, running on US-owned AWS. The Finnish tax authority runs on US-owned Azure, Lehdonvirta points out. 

Practicing what the EU preaches is evidently easier said than done––and while member states are given freedom to debate whether and how to apply EC measures, vulnerabilities remain for individuals and states alike.

5. European competitiveness and tech sovereignty are linked––boosting one helps ensure the other.

Central to the Commission’s goal of minimising Europe’s risky dependencies is a plan to ensure that European companies can deliver the same quality services affordably and at scale. To give an example of one such battle yet to be won, US-owned Amazon, Microsoft and Google presently account for some 70 percent of the current EU cloud-computing market.

However, Virkkunen believes that Europe can provide viable alternatives––if member states work together, potentially providing services as a consortium.

‘I think in many fields that is the solution when we look at satellite services, production of semiconductors, cloud services and also supercomputers,’ she says. ‘But it's always our challenge that we are still too fragmented.’ 

Lehdonvirta agrees that the way to be globally competitive is to build scale, in terms of investment and production. He puts the challenges more bluntly. ‘If we all keep promoting our national champions, then we are all going to remain too small to compete against our main geostrategic rivals.’

The discussion took place at Pikkuparlamentti on 25th August 2026. Watch the full interview below.