Technology procurement and adaption was largely treated as a business decision all these years. Organisations compared various aspects like functionality, cost, performance, support and integration before deciding which technology to adopt.
Now you can see a change in this perception.
Europe increasingly has started viewing, technology dependency as a strategic issue. Today, the question is no longer simply whether technology works well or is commercially competitive & viable. Governments and institutions have started asking many questions like who controls the technology, which jurisdiction applies, how dependent they have become on it, and how difficult it would be to move away if circumstances changed.
This is exactly the reason why Europe’s growing interest in alternatives to foreign technology should not simply be viewed as a move away from Microsoft or a preference for open source.
The bigger issue is control over the digital infrastructure on which governments, businesses and economies increasingly depend.
When Software Becomes Infrastructure
The distinction of thin line between software and infrastructure is even fading away.
Government services, healthcare systems, financial institutions, businesses and industrial operations now rely on operating systems, productivity platforms, cloud services, identity systems and interconnected software ecosystems. Once these technologies become deeply integrated into the day-to-day business operation, replacing them is not that easy.
A change in platform or technology can affect applications, data, identities, integrations, security controls, business processes and workforce skills. In industrial environments, the implications can extend further into engineering systems and operational continuity.
The result is a dependency that may not have been obvious when the technology was originally selected.
Europe is increasingly recognising this. The European Commission’s technology sovereignty agenda now looks at Europe’s ability to develop and control important technologies, data and infrastructure while reducing critical dependencies on providers outside the EU. Its 2026 initiatives bring semiconductors, cloud, AI and open source into the wider discussion on technological sovereignty and resilience.
This is significant because Europe is beginning to look at these technologies as interconnected parts of its digital infrastructure rather than simply as individual products.
The Bigger Picture
Microsoft inevitably appears in this discussion because its technologies are deeply embedded across European governments and businesses. But treating digital sovereignty as a Microsoft issue misses the bigger picture.
Replacing Microsoft with another foreign provider would not necessarily solve the underlying dependency. It could simply move that dependency elsewhere.
The same question applies to cloud platforms, identity services, cybersecurity technologies, semiconductor supply chains, AI platforms and industrial systems.
Open source is relevant for a similar reason. It can reduce certain forms of vendor lock in and give organisations greater ability to inspect, modify and maintain software. But open source does not automatically create sovereignty. An open source platform can still depend on foreign cloud infrastructure, hardware, developers, support providers or supply chains.
Data Location Does Not Always Mean Data Control
The same distinction applies to data.
For years, much of the discussion focused on where data was physically stored. Data residency remains important, but location alone does not necessarily determine control.
An organisation may store its data in a European data centre while depending on a provider headquartered elsewhere. Ownership, jurisdiction, administrative access, contractual arrangements and the underlying software supply chain can all affect the organisation’s actual level of control.
This is one reason Europe’s discussion has expanded from data residency towards a broader question of data sovereignty. The European Commission’s emerging approach to cloud and AI sovereignty considers factors beyond physical location, including ownership, control, third country dependencies and software supply chains.
Data residency determines where data is stored, while data sovereignty involves broader questions of legal jurisdiction, access and control. For governments and businesses, understanding both is important when evaluating their dependence on external technology providers.
When Vendor Lock-in Becomes Strategic Dependency
Vendor lock-in has traditionally been viewed as a commercial concern. Organisations worry about licensing costs, difficult migrations, proprietary formats or contractual restrictions.
However, when technology becomes essential to the functioning of a government, business or critical service, vendor lock-in moves beyond a commercial concern and becomes a matter of strategic dependency.
This does not mean every dependency is a problem. Modern economies depend on global suppliers, cloud providers, software companies, telecommunications networks and technology partners. Complete technological independence is neither realistic nor necessarily desirable.
The real concern is when dependency becomes critical more like a monopoly and credible alternatives are limited.
An organisation may depend heavily on technology and still remain resilient if alternatives exist and migration is practical. Another may face significant exposure because replacing one essential platform, component or supplier could take years.
The real concern arises when critical dependencies are concentrated among a limited number of providers, with few practical alternatives available. This risk is particularly significant in critical infrastructure, where a manufacturing facility may depend on engineering software, industrial automation platforms, network infrastructure and specialised vendor support.In these environments, replacing technology is very different from changing an office application because technology is directly connected to physical processes and operational continuity.
From an OT cybersecurity perspective, resilience therefore goes beyond protecting systems against cyberattacks. It also means understanding what happens when a critical technology, service, component or support capability is no longer available.
AI Is Adding Another Layer
Artificial intelligence is making this discussion even more important.
AI depends on an ecosystem of advanced semiconductors, computing infrastructure, cloud platforms, data, models and specialised technical capabilities. As AI becomes integrated into government services, financial systems, healthcare, industrial automation and business decision making, dependence on this ecosystem will grow.
This is why Europe’s current approach increasingly connects semiconductors, cloud infrastructure, software, data and AI rather than treating them as separate technology issues.
A European organisation may use a European AI application while the underlying model, cloud infrastructure, computing hardware or specialised chips originate elsewhere.
The dependency may therefore exist several layers below the technology that the organisation actually sees.
Understanding that dependency chain is becoming an important part of understanding sovereignty itself.
Sovereignty Is About Retaining Choice
Digital sovereignty should not be confused with technological isolation.
No modern economy can realistically develop all the technologies it needs within its own borders, from semiconductors and software to cloud platforms, AI and industrial systems.
The objective is not to eliminate dependency. It is to understand which dependencies are acceptable and which have become strategically important.
Some can be managed through diversification. Others may require alternative suppliers, contractual safeguards, open standards, domestic capability or credible fallback arrangements.
This changes how technology decisions need to be viewed.
Functionality, cost and performance will continue to matter. But for technologies that become critical to governments, businesses or infrastructure, another set of questions is becoming equally important.
Who controls the technology? Which jurisdiction applies? How dependent are we on it? How difficult would it be to replace? What alternatives exist? What happens if access, support or supply is restricted?
These are no longer questions only for technology teams. They are questions about business continuity, resilience and strategic risk.
Europe’s digital sovereignty debate therefore represents something larger than a change in software preference.
A country does not necessarily lose sovereignty because it uses foreign technology. Nor does it automatically gain sovereignty by replacing foreign technology with a domestic alternative.
The more meaningful measure is whether it understands its critical dependencies and retains enough control, capability and alternatives to act when circumstances change.
Europe is therefore not simply asking what technology it should use.
It is beginning to ask how much control it should retain over the technology on which it depends.
About the Series
This article is part of the broader series:
Digital Sovereignty, Cyber Power and the New Geopolitical Landscape
