Ninety percent of the European Union’s data sits in the hands of American companies. Let that sink in for a second.
I have spent years watching this industry talk about sovereignty, and the talk never changes. Trade fairs like Cyber Security World, panels full of serious people, everyone nodding at the diagnosis and nobody touching the starting point. The infrastructure we are all debating does not belong to us.
We talk about the cloud. We talk about public administrations. We talk about adapting to the digital age. Europe puts itself on alert so its data stops depending on third parties, and calls that a priority. Fine. Now look at where that priority actually lives today.
The cloud belongs to Amazon, Google and Microsoft. Read that again. We are arguing about how to protect data that already sits in somebody else’s hands. Their systems go down from an attack or from one silly mistake, and when they go down the real question is who gets to decide. Knowledge, patents, intellectual property, capital. Every one of them, foreign.
The European Commission wants technological independence by 2030. Good. Now look at its own figures. Ninety percent of EU data is managed by American companies, and I suspect they are being generous. Less than 4% of the leading online platforms are European. The European market does not reach 10% of microchip manufacturing. Forget the risk coming down the road. That is the photo of today.
Say it plainly. In most cases, Europe is a net consumer. It buys other people’s technology, essentially American. It adopts standards set somewhere else. And when it does innovate, it builds on top of somebody else’s platform. The Digital Compass puts targets and deadlines on that ambition, more digitalisation, more investment, more autonomy by 2030. The industry itself admits there is a long way to go. Too many legacy systems are still running, and they keep you from using the security you already have.
Now, two things get mixed up all the time, and the mix-up is expensive. Digitalising more is not the same as depending less. You can install monitoring and harden your cybersecurity, and you should, while you keep hosting everything in somebody else’s cloud. Falling behind in euros is the least of it. The real risk is that you keep building on ground that is not yours.
And this is not just an infrastructure problem. When your data and your services live under somebody else’s laws, dependency stops being technical and becomes legal. Who can access that information, under which rules, with what order, in how long. That is why Europe is pushing alternatives of its own, from Gaia-X to the European cloud sovereignty framework. For one reason: to stop building its digital future on foundations it does not control. And there is a second price, the one that only shows up the day you try to leave. Moving data and services out of a hyperscaler is slow, it is expensive, and in practice almost nobody ever gets around to doing it.
Here is what that costs you as a citizen. Every time a public service runs on infrastructure you do not control, the terms of that service are written somewhere else. That is fine until the day those terms change. Then you find out you never had a seat at the table, and nobody is going to give it to you.
Then there are the cities. Smart cities are where this stops being abstract. Waste collection where the waste actually is. Public transport tuned to real accessibility. Streetlights that switch off when nobody needs them. All of it thanks to data. Sounds good, and it is, as long as the data is yours.
Because a smart city is, above all, a measured city. It decides what to collect, when and where from, on continuous information. Hand that data, and the platforms that process it, to a third party, and your efficiency comes with a mortgage attached. Control. At that point it stops being a debate about sovereignty and becomes a neighbourhood problem. Whoever decides what gets measured also decides what gets fixed and what gets ignored. The platform that coordinates the city ends up writing the rules of the city, and nobody voted for it.
Europe’s stake is deciding for itself. Its data, its infrastructure, its cities. Digitalising is not enough. It has to be done on something of your own. You do not buy tech sovereignty by the pound and you do not settle it with a headline. You build it provider by provider, decision by decision, and you notice it most on the day something fails. Because if the power button is not yours, sovereignty is just a word.
Do you want that?