Ask ten European officials what digital sovereignty is and you will get ten answers: industrial policy, European cloud, data protection, strategic autonomy. Each is part of it. None is a definition an institution can test on a Monday morning. This essay offers one.
A definition you can test
Digital sovereignty is the demonstrated ability to keep operating your digital systems, under your own legal order, when any single external dependency is removed or turned against you.
Three words do the work:
- Demonstrated — shown in an exercise, not claimed in a contract.
- Operating — the test is continuity of the service you are mandated to deliver, not ownership of technology.
- Any single dependency — a provider, a jurisdiction, a model, a network, a key person. Sovereignty is set by the weakest one.
The definition does not require building everything in Europe. It requires knowing what you depend on and having a way out that you have tried.
What digital sovereignty is not
- It is not data residency. Residency says where data is stored. A dataset stored in Frankfurt by a company whose parent must obey a foreign disclosure order is resident and not sovereign. We set out the difference in data residency vs data sovereignty.
- It is not autarky. No European institution will run without non-European technology. The goal is choice and exit, not isolation.
- It is not a label. A "sovereign cloud" offer is an input. Whether you are sovereign depends on what you do with it.
The four layers where sovereignty is won or lost
- Data — who can compel access to it, and under which law.
- Infrastructure — compute, network, identity and keys. Who holds the encryption keys often matters more than where the servers are.
- Software and models — operating systems, platforms, AI models and their weights. A European model served through a non-European orchestration layer has a non-European dependency.
- People and skills — whether your own staff can run, change and replace the above. An institution that cannot evaluate its own AI systems has outsourced its judgement.
How to measure it
We apply three tests on every engagement, explained further in digital sovereignty as resilience:
- Substitution: if this provider disappeared on Monday, what is your position on Friday?
- Jurisdiction: which legal regimes, plural, can compel disclosure, change or interruption?
- Continuity: have you moved this workload to an alternative within a set window in the last twelve months?
The result is a short list of dependencies with a substitution window next to each. That list is your sovereignty position. In the Resilience Audit it is scored under two of the six dimensions: third-party dependencies and sovereign infrastructure.
Where European law already asks for it
No EU law uses "digital sovereignty" as a legal duty, but several already require the work behind it:
- NIS2 requires supply chain security and business continuity for essential and important entities. See NIS2 compliance.
- DORA requires financial entities to manage ICT third-party risk, including exit strategies for critical providers.
- The EU AI Act makes deployers of high-risk systems answer for the whole chain, including the general-purpose models underneath. See the EU AI Act explained.
- GDPR restricts transfers of personal data to third countries without adequate protection.
Read together, these laws turn sovereignty from a political slogan into an operational duty that can be audited.
Frequently asked
What is digital sovereignty? The demonstrated ability of an organisation or state to keep operating its digital systems under its own legal order when any single external dependency — a provider, a jurisdiction, a model or a network — is removed or turned against it.
Is digital sovereignty the same as data sovereignty? No. Data sovereignty concerns which legal regime can compel access to data. Digital sovereignty is broader: it covers data, software, models, infrastructure and skills, and asks whether operations continue when a dependency fails.
Does a European cloud region make us sovereign? No. A region decides where data is stored. Sovereignty also depends on who controls the operator, which foreign laws reach it, and whether you can move to an alternative within a defined window.
To see where your institution stands, the six dimensions of the UberConsul Resilience Audit give a one-page position you can take to a board or a supervisor. Book a time to discuss it.
This essay is general information, not legal advice. Check the national law that applies to you.
First published October 2026 · Frankfurt am Main.