You can choose your level of sovereignty and with it the amount of time your business can keep operating despite geopolitical events. Each level has a different balance between foreign dependency risk, operational control and flexibility. Most organizations don't need to aim for the highest level; they need to choose the right level for their risk profile.
Unknown Most organizations are flying blind, often unknowingly. You're likely fully dependent on non-European cloud services with no real insight into your dependencies across the technology stack. Geopolitical events can put you out of business, with no recovery possible. The risk profile includes maximum foreign exposure.
Recoverable IT At this level, dependencies are mapped and documented, including supply chains, and a clear understanding of what breaks when foreign services suddenly become unavailable. To reach this level, companies need recovery plans in place for critical business services, which crucially includes off-cloud backups of their data. For cloud native or SaaS applications (or their API-integrations), extracting data may be difficult, and would likely not be useable even then. Restarting operations is possible, but expect painful weeks of recovery. This is an achievable short-term goal for most commercial enterprises that boosts resilience without overwhelming operational complexity.
Continuity Organizations at this level have capabilities in place to restart critical services either in their own data centers or European hosting services. For cloud native solutions, this requires re-architecting the solution significantly, see this article. Non-critical processes may use non-European cloud for efficiency and innovation. Recovery takes hours or days, making this the sweet spot for organizations with higher availability requirements or those needing NIS2 compliance.
Cloud Independent Fortress mode: all business operations continue during loss of foreign cloud functionality. Non-European cloud services can be used strategically for capacity and innovation, never for critical operations. Recovery happens in minutes to hours. For most companies, this level only makes sense if your clients and partners are also striving for at least Level 3, otherwise, you're building fortress-level capabilities while your ecosystem remains vulnerable. This level suits high-resilience organizations and critical infrastructure operators, like governments and defense contractors. These high-resilience organizations can secure investment in a viable European alternative. This level requires accepting that all benefits of outsourced technical capabilities disappear, demanding maximum operational security responsibility. Hardware dependency on non-European vendors typically remains.
Digital Sovereignty National security: critical operations use European hardware and software exclusively. Non-European services are used only for non-critical innovation. This level is currently unattainable: most hardware is designed in the US and produced in China, with insufficient production capacity in Europe. Currently only relevant for governments and national security infrastructure.
If there’s ever a need to consider sovereignty in a stricter sense: the steps for national sovereignty are similar to the ones for European sovereignty.
TL;DR: Most organizations should target Level 2. NIS2-regulated companies or government entities typically need Level 3. National security, intelligence services, their contractors, or critical infrastructure operators should consider Level 4 and beyond.
Your sovereignty level should reflect the considerations below: not wishful thinking, but operational logic. Choose a level that makes sense given your constraints and capabilities.
- Acceptable recovery time: Financial services need minutes, manufacturing can accept days, professional services might tolerate weeks
- Competitiveness of your market: Sovereignty costs more and doesn't yield immediate benefits; commodity businesses have less margin for this investment
- Technical capabilities: Higher levels demand more technical expertise; Level 2 needs planning, Level 4 needs operations rivaling hyperscalers in all aspects.
- Industry ecosystem dependencies: If your supply chain runs on specific platforms, going sovereign alone creates isolation rather than independence
- Regulatory requirements: NIS2-covered entities face specific obligations; other industries may see requirements intensify over time
- Type of organization: If you're owned by a US company, sovereignty efforts become academic; focus on operational resilience instead
Remember: building more resilience and flexibility benefits you beyond sovereignty concerns. Better disaster recovery, reduced vendor lock-in, and improved operational flexibility serve your business regardless of geopolitical developments.
A future article will explore each of these considerations in detail, providing assessment frameworks and decision tools for sovereignty planning.