Tech sovereignty should not be a subscription model

Concern about the loss of jurisdiction and agency to US companies is becoming more pressing for Europeans

Marietje Schaake

European Commission president Ursula von der Leyen and Donald Trump in New York last year. The need to untangle from US dependencies is now urgent for Europe © Chip Somodevilla/Getty Images

The writer is a fellow at Stanford University’s Institute for Human-Centered Artificial Intelligence. She is the author of ‘The Tech Coup’

In 2026, challenges to sovereignty will extend far beyond the borders of Ukraine or Denmark. A quieter, equally consequential battle is being fought in the cloud. As European leaders double down on “digital sovereignty” in the face of threats from the White House, Big Tech companies have performed a remarkable rebranding and are now marketing “sovereign solutions” encompassing AI, cloud services and data centres. Sovereignty, however, is an inherent right of democratic states, not a subscription model provided at the mercy of foreign entities.

Concern about the loss of jurisdiction and agency to US tech companies is becoming more pressing for Europeans. With US President Donald Trump threatening to seize Greenland, withdrawing from international organisations and undermining the EU in his support of nationalist parties, the need to untangle and de-risk from American dependencies is now an urgent security requirement.

Reading the tea leaves, Amazon Web Services, Microsoft and Google are racing to reassure customers before they think about migrating to independent European digital infrastructure — the so-called “Eurostack”. The US companies are offering European customers sovereign cloud solutions that promise data localisation and operational control.

Yet these offerings avoid the elephants in the room: the US Cloud Act and the Foreign Intelligence Surveillance Act.

The former, signed by Trump (probably with a Sharpie) in his first term, grants American authorities the power to force US companies to hand over data around the world. The latter gives US intelligence services significant powers, including access required for digital snooping.

Cybersecurity expert Fleur van Leusden likens tech company attempts to sell sovereignty as a service to vegan chicken breast; it cannot be both. Technology is either sovereign or it is foreign.

This is not a uniquely European challenge. It impacts people around the world. Data may be stored within a nation’s own borders, but no amount of localisation can override the legal reality that the US companies selling the storage are answerable to American courts, and more importantly, are increasingly treated as instruments of American politics.

The International Criminal Court chief prosecutor Karim Khan lost access to essential digital services and financial accounts following US sanctions against him last year.

In this context, relying on American companies for critical infrastructure becomes a national security vulnerability. Denmark’s dependency on US tech may be weaponised in Trump’s pursuit of Greenland. Information manipulation through social media is another risk, as it bypasses traditional offensive tools.

There are exceptional technical architectures and encryption standards that truly fence off data from anyone’s access. This “zero trust” design assumes there is always someone hostile to your interest that you need protection from. But these “air-gapped” data storage methods are typically only used in highly sensitive contexts.

Moreover, continued investment in foreign tech means a corporate takeover can instantly alter the sovereign status of critical infrastructure. The Dutch learnt this lesson in November when the US-based IT infrastructure services provider Kyndryl announced it would buy Solvinity, the “sovereign” cloud company that hosts citizen’s identity for key government services such as taxes and social security benefits.

When critical state functions depend on foreign infrastructure, sovereignty is outsourced, repackaged and ultimately risks being surrendered.

Going forward, sovereignty will have to be stipulated in procurement contracts as well as through the location and design of products and services. The upcoming EU Cloud and AI Development Act seeks to set standards to clarify which providers truly answer to European law and European democratic institutions.

So far, the main benefactors of this shift have been the “sovereign” sellers. But true sovereignty cannot be purchased. It entails ownership, control and the capacity to make autonomous decisions free from external coercion. It means having freedom and agency.

The decisions made now about the true value of sovereignty will determine whether countries retain meaningful autonomy or become clients of foreign imperialism. A citizen is not a customer and sovereignty is not a service.

Concern about the loss of jurisdiction and agency to US companies is becoming more pressing for Europeans

FT Opinion, every weekday

Follow the topics in this article