When should you consider using sovereign technologies?

It is important to ignore the hype and make decisions based on what is important for your organisation



There has been much discussion regarding sovereignty in the last year, which has seen more fevered debate in the last few months in European technology circles. The first question to ask is what is meant by sovereignty?

It can be a very emotive, politically charged subject, so it is important that technologists focus on engineering and practical risk management as opposed to political uncertainties.

There are three separate dimensions of sovereignty, namely AI, data and cloud. Each of these has distinct considerations.

Sovereignty explainer

Image

If an organisation is assessing a move to a sovereign IT architecture it is clearly important to know what exactly is being discussed. At its most basic level, moving to a European sovereign technology stack means that the technology being used by a European company and data residing therein is completely under the jurisdiction of a European sovereign nation. Customer data remains free from interference from another country.

Current geopolitical tensions have caused some countries and organisations to re-evaluate their reliance on non-European providers including Germany pushing for GAIA-X, the French Government moving away from Zoom and Teams and the International Criminal Court (ICC) switching from MS Office to open source.

The business case for change

However, before prioritising technological sovereignty, it is important for an organisation to ask: what is the business case for change?

As we saw during the Covid-19 pandemic, there are clear economic and security reasons for ensuring stability of supply and access to services or materials. Similarly, when considering technology sovereignty, there is an argument for greater control over IT assets as geopolitical tensions increase the threat of tariffs and other economic sanctions. That said, it is equally important to qualify whether technology sovereignty is right answer for an organisation. Organisations should ask themselves several key questions first:

Perception vs reality

The reality is that there have been very few publicly listed examples of foreign governments demanding, let alone being granted access, to data stored in Europe. Many providers publish transparency reports on this topic showing very low levels of access requests for EU-hosted data. Therefore, even though such requests are rare and would only arise in exceptional circumstances (such as a criminal investigation), it remains important, given the perceived volatility of some regimes, to understand the stance of the global technology vendors who are responsible for a large share of data stored in the cloud.

Perhaps more of a concern, highlighted by the recent example of US sanctions against the ICC, is an overreliance more generally on systems (whether traditional infrastructure or AI models) which are controlled by enterprises operating under foreign jurisdictions.

Factors to weigh up

Is this sufficient reason for European organisations to prioritise switching technology assets to home-grown alternatives? There are a number of factors to weigh up, which should inform discussions around the business case for change:

  1. What do you lose if you move away from a global technology provider? Global vendors have dominance due to the breadth and depth of their technology offerings. If an organisation trades that for a local alternative they must consider the consequences (such as reduced availability and resilience of the hyperscalers; or a reliance on regressive/ legacy systems that are unable to benefit from the pace of technological development). If this creates gaps, can an organisation take on those responsibilities cost effectively or find local partners to support them?
  2. What do you gain by switching to a European provider? In addition to control over data and reduced dependency, there are also brand and customer perception benefits to being local. There is a growing desire to strengthen the European technology sector, so by choosing “locally sourced” providers an organisation could be seen to be supporting European growth.
  3. Is all data equally important? This is particularly relevant when considering the data layer of technology sovereignty. Some data is more important and company sensitive (such as special-category data, criminal data etc.) compared to other data so there are arguments for separating out certain (more sensitive) information to ensure it is stored locally and not exposed to the jurisdiction of another country.
  4. Do you know where your data has been? With the increasing use of AI, tools may be trained on data sourced from a variety of locations which may not be immediately transparent or obvious. When considering AI sovereignty, an organisation must be able to determine where both the data and models processing it have come from and therefore what jurisdiction it might fall under.
  5. What legal, technical and operational frameworks have you (and your chosen vendors) put in place to protect your data? You need to consider not only the measures your own organisation can take, but also the practical, technical and legal safeguards implemented by your technology vendors. These safeguards help reduce dependency on platforms that may not themselves be sovereign, but the key question is whether these protections give you enough assurance to rely on a fully non‑sovereign technology stack.

These are just some of the considerations organisations should evaluate whilst weighing up the costs and benefits of adopting a European sovereign provider. It is clearly a live issue and there are good reasons to consider technology sovereignty, but it is important to ignore the hype and make decisions based on what is important for your organisation, your people and your customers. Most organisations will not require full sovereignty across all layers; a tiered, risk‑based model is often more proportionate.

Noah Phillips is Data Protection Officer and Assistant General Counsel at Unit4.