While Europe’s position in the information technology sector has been waning for decades, recent events have resulted in an ever-louder chorus of voices concerned about the continent’s ability to control its digital destiny.
There are several pressing reasons behind this concern. First, a weak technology sector in Europe has critical consequences on the economy. ‘For years, Europe has outsourced its digital foundations, becoming what many call a “digital colony”. This leads to a recurrent, massive outflow of resources: a recent study estimates that European businesses’ reliance on US-based cloud and software services benefits the US economy to the tune of € 264 billion annually – a figure comparable to our total energy-import bill, or which represents three million jobs in Europe,’ says Stéfane Fermigier, founder and chief executive of the open-source software vendor Abilian and a co-founder of the EuroStack Initiative Foundation.
The implications are grave, according to the economist and EuroStack Chair Cristina Caffarra, who agrees with the conclusions of Mario Draghi’s 2024 report, The future of European competitiveness. ‘We are an exporting economy which is being clobbered by an active trade war with China, and loss of competitiveness with both China and the United States (US). While productivity growth was similar 20 years ago between the US and Europe, there has been a major decoupling as the US pulled ahead, driven by its tech sector. Digital is – and artificial intelligence (AI) will be – an all-purpose technology. If you are behind with adoption and diffusion of these technologies, you lose out in every sector of the economy. So to me this is not remotely an anti-US campaign: US suppliers have filled a vacuum we have left for them to fill, kudos. But if we don’t focus on building our own capabilities in this space, we will fall further and further behind.’
Second, recent geopolitical events have thrown Europe’s vulnerability, through its reliance on imported technologies, into sharp relief. ‘Global instability means that Europe can no longer take for granted the reliability of its traditional partners. Our dependencies are no longer simply a commercial issue, but a critical strategic vulnerability,’ says Stéfane. There is also growing awareness of the legal and security risks that reliance on extraterritorial technology entails: ‘European companies’ data and intellectual property are exposed to extraterritorial laws like the US CLOUD Act and FISA, which can compel disclosure to a foreign government without regard for European privacy and business secrets standards. This is a direct threat to our competitiveness and security,’ adds Stéfane.
Cristina Caffarra speaking at the European Digital Sovereignty Summit, November 2025Defining ‘digital sovereignty’
For Stéfane, digital sovereignty is ‘the ability of individuals, organizations, and governments to independently control, manage, and use their digital infrastructure, data, and technologies, free from undue external systems in a self-determined manner’. In addition to the governance of critical infrastructure, this also entails ‘the ability to make autonomous decisions about the use and management of applications and technologies, safeguarding privacy, data integrity, and digital independence’.
However, as Koen De Bosschere notes in his introduction to HiPEACinfo 77, the power to govern the digital space is dependent to a large extent on the technical capacity to implement European laws – i.e. reducing dependency on technologies from other regions. For Cristina, attempting to tame technology companies through regulation is a failed approach; the emphasis must shift to building up the technology sector in Europe. ‘We are now a digital colony, because while we were busy regulating Google Search, Apple’s App Store, Meta’s social networks, companies were building data centres, laying cables, appropriating the data – which effectively means that the digital infrastructure we rely on today is not ours.’
Cristina fiercely rejects the negative attitude exhibited by some which suggests that Europe has missed the boat on technological development – noting that Europe has ‘incredible capabilities, incredible assets, some of the best engineers’, with dynamic ecosystems – even for chips – in places like Dresden, Eindhoven, and Grenoble – but laments that Europeans are ‘complacent beyond words’.
Sovereign European Provider: The EuroStack framework
EuroStack, which has evolved from a broad, informal coalition into a non-profit association, aims to provide a pragmatic response to this situation. To avoid vague definitions and what Stéfane refers to as ‘sovereignty washing’, where ‘non-European providers use marketing and superficial corporate structures to create an illusion of compliance’, EuroStack has translated the concept of ‘digital sovereignty’ into a concrete, legally robust framework built on five pillars, as set out below:- 1. Jurisdiction and governance – accountability to EU law: the ultimate parent entity of the provider must be headquartered and legally incorporated in the European Territory (EU, EEA, EFTA), and must be free from decisive non-EU control.
- 2. Technical sovereignty – freedom from technological lock-in: an antidote to the scenario in which Europeans’ data is in Europe but trapped within proprietary foreign technology. ‘We mandate that services be built predominantly on open-source software and implement open standards, guaranteeing data portability, interoperability, and even operational reversibility,’ explains Stéfane.
- 3. Operational sovereignty – control over the entire service-delivery chain: ‘It’s not enough for data to reside in the EU; it must also be managed from the EU. We require that the entire physical infrastructure – and, critically, the operational control plane – are located and operated from within Europe,’ says Stéfane. ‘All personnel with privileged access must be European residents, employed by a European entity, and working from within the EU.’
- 4. Data sovereignty – verifiable protection of all data: exclusive EU residency for all data, including metadata and backups, with additional credits for verifiable technical measures that make it impossible for any unauthorized party – including the provider itself – to access unencrypted data.
- 5. Economic sovereignty – a net contributor to the European economy: ‘This ensures that public money is used to build our own industrial base. We require that the majority of a provider’s research and development (R+D) expenditure and personnel for the core technology are located in Europe, and that their business model is fair and transparent, free from punitive tactics like exorbitant data egress fees,’ Stéfane says.
EuroStack graphic showing the digital ecosystem
From ideas to action: EuroStack’s priorities for digital sovereignty
With all this in mind, how should European actors – in both the public and private sectors – move forward to reverse the trend towards digital subjection?
EuroStack has defined three priorities for action, as follows:
- 1. ‘Buy European’: Drive demand through strategic procurement
‘We must amend EU public-procurement directives to mandate that a significant and growing share of public IT spending is directed towards sovereign European solutions,’ says Stéfane. ‘This isn’t protectionism; it’s a strategic investment in our own industrial base. It creates the vital customer revenue that our companies need to scale and compete.’ Cristina agrees unequivocally: ‘Every other region in the world says, “buy from yourself”. The default in Europe is “buy from everywhere”. It might have made sense originally because we don’t want individual states in Europe to just buy from themselves – but now it is being weaponized against us by the hyperscalers,’ she says. ‘The outflow of public procurement to the US is around €80 billion a year, so if we reserved 20-30% to European suppliers via strategic public procurement rules, the “shot in the arm” would be sizeable.’
In addition to specifying European providers, EuroStack also wants procurement processes to be simplified to avoid disadvantaging small and medium enterprises (SMEs).
- 2. ‘Sell European’: Organize and strengthen European supply
The success of the US hyperscalers is not accidental: they offer user-friendly, effective, vertical solutions. Cristina emphasizes that customers are understandably partial to integrated solutions (convenience, performance and sovereigntyreliability) so European suppliers will realistically need to develop comparable bundles, by collaborating in various ways. ‘What is the European alternative to the stack that goes from chips, to compute, to software, to AI that I can use instead of Amazon or Microsoft?’ she asks. ‘The truth is that we don’t have one. We have lots of bits and pieces, but they need to be put together. This cannot be the responsibility of the customer; it needs to be the responsibility of the supplier. Improve your product. Join forces with someone. Create a portfolio. This is what is needed, and we are seeing that it is beginning to happen. EuroStack suppliers are clubbing together to meet demand from industrial customers.’
Of course, following this advice is more challenging for the patchwork of European SMEs than it might be for a single large enterprise. A central plank of EuroStack’s strategy is to make it easier for buyers to find trustworthy European solutions. ‘We are creating a vetted, dynamic catalogue of European digital capabilities, performing strategic gap analyses, and aggregating offers through open standards. The goal is to break down siloes and allow our innovative SMEs to compete collectively,’ explains Stéfane.
‘But a catalogue is not enough. We are also facilitating contacts between demand (customers) and suppliers who can create work together to create collaborative integrated solutions to respond to customers’ needs,’ adds Cristina. ‘EuroStack is aiming to play an active role in creating these solutions and architectures – “matching” demand and supply. The success of European tech depends entirely on customers moving their purchases away from current patterns and starting to “buy European” for real. The public sector is not enough: we need to get customers shifting.’
- 3. ‘Fund European’: Mobilize strategic capital
‘We must be smarter about how we use public and private funds,’ says Stéfane. ‘An immediate action should be to stop the subsidization of non-European technologies and redirect funds to where they can have most impact. We also proposed a dedicated “EuroStack Fund of Funds” to de-risk adoption, support foundational open-source projects, and help our tech companies scale up, with an investment logic that accounts for a “sovereignty dividend”.’
In terms of R+D, Stéfane advocates for a strategic approach: ‘Key R+D priorities must include genuinely sovereign cloud and edge infrastructure, trustworthy artificial intelligence, next-generation cybersecurity, and continued investment in foundational open-source components that underpin our entire infrastructure,’ he says.
Cristina appearing on Bloomberg Daybreak Europe
The role of open source
According to Stéfane, the role of open source in European digital sovereignty is transformative. ‘It is simultaneously the technical key to unlocking technological autonomy, the foundation upon which we can build a collaborative and innovative ecosystem, and the central instrument in a pragmatic policy strategy to reclaim our digital future. It is, quite simply, the European way to build digital sovereignty.’
To understand the role of open source, Stéfane refers to the definition laid out in a recent report by the European Alliance for Industrial Data, Edge and Cloud: ‘Digital sovereignty = data sovereignty + technological autonomy. While data sovereignty – controlling where our data is stored – is important, it is insufficient. Without the ability to control the underlying software and hardware that processes this data, we risk creating “sovereign prisons” where our data is in Europe but we are completely locked into foreign technology,’ adds Stéfane.
Open source offers a way out of vendor lock-in, says Stéfane, as it provides full control over the code, ‘giving us the ability to maintain our systems, innovate independently, and switch providers’. The ability to audit the source code also allows for collective, independent verification, ensuring there are no hidden backdoors or vulnerabilities. It also allows Europe to build on its strengths by enabling companies, research institutions and public bodies to pool resources and collaborate on cutting-edge technologies that no single entity could build alone, he adds.
However, open source must be approached strategically if Europe is to fully benefit from it, says Stéfane, citing five critical gaps currently preventing Europe from fully leveraging open source. Standards and interoperability are required to escape the fragmented market where dominant players create proprietary ecosystems disguised as open. Financial viability is important given the lack of long-term funding for European solutions, as is market visibility, which is also currently lacking. The shortage of expertise in sovereign open-source technologies needs to be addressed, as does the governance and influence of open-source projects: ‘While Europe contributes a vast amount of code globally, we lack proportional influence over the strategic direction of key projects, which are often governed by foundations outside the EU.’
Stéfane Fermigier speaking at Open Source Experience, December 2025
Photo credit: William Jezequel
Next steps – and how HiPEAC can help
In line with EuroStack’s pragmatic outlook, the next steps for the EuroStack Initiative Foundation will be building operational capacity to deliver its vision, Stéfane says. ‘Over the coming months, we will be implementing our governance model, defining a formal membership program to bring hundreds of aligned companies into the fold, and expanding our working groups focused on concrete outcomes in integration, procurement, and communication. Our focus is on tangible outcomes: interoperable technology, reliable procurement frameworks, and stronger ties between European innovators,’ he adds.
HiPEAC can play a critical role in contributing to the full-stack endeavour – from silicon to software – required for technological sovereignty, according to Stéfane. ‘EuroStack's role is to create the market demand and industrial strategy for sovereign technologies. The HiPEAC community's role is to deliver the foundational research and development that makes these technologies possible. We see this as a necessary partnership to build a competitive European digital sector.’
In particular, Stéfane highlights three main areas where HiPEAC could contribute:
- 1. Ensure a viable, sovereign hardware-software stack
‘Initiatives like the European Processor Initiative are fundamental,’ says Stéfane. ‘What’s needed from our point of view is to ensure the output of such projects is not only technically excellent but also commercially viable and designed for integration. We need a collaborative approach to co-design,ensuring that Europe develops a coherent and optimized stack where sovereign software can run efficiently and securely on the next generation of European processors.’
- 2. Inform strategic and technical roadmaps
- 3. Develop sovereignty-oriented talent
‘We need the HiPEAC community’s help to shape programmes that produce engineers, architects and researchers with a full-stack, sovereignty-oriented, and open-source / open-hardware mindset,’ says Stéfane. ‘This means cultivating talent that understands not just deep technical challenges,but also the requirements for building secure, open, transparent and interoperable systems.’
‘We need the expertise within the HiPEAC community and the analysis from resources like the HiPEAC Vision to help us identify critical technological dependencies and strategic opportunities. This will directly inform our gap analyses and help guide the “Fund European” pillar of EuroStack to make targeted, high-impact investments,’ says Stéfane.
A new horizon for European technology
Although sobering, the reckoning with Europe’s technological dependency is finally provoking action. ‘Our leaders are starting to wake up to the fact that by not controlling our critical digital infrastructure: we have ceded control over our economic future and our ability to uphold our own laws and values,’ says Stéfane. ‘Concrete action is needed now to reclaim our autonomy, and we believe it has to come from a multifaceted approach.’
The end goal for EuroStack is not to answer all of Europe’s needs with homegrown technology, according to Cristina. ‘EuroStack is not about autarchy protectionism: again, we are not anti-American and the goal is not to replace American suppliers,’ she clarifies. ‘But at the moment we’ve shrunk to 10-20% of the market in several segments – can we reach 30-40% of our own market for digital technologies?’