Digital technologies underpin almost every aspect of contemporary European society, from public administration and healthcare to trade, security, and democratic governance. Yet much of the infrastructure that enables these systems is not controlled within Europe. Cloud services, digital platforms, hardware supply chains, and core software are largely owned, governed, or legally constrained by actors outside the European Union. This condition of digital dependency has long been treated as a technical or economic issue, managed through markets and regulation.
Today, that assumption no longer holds. Europe’s digital dependencies have become a strategic concern in a rapidly shifting geopolitical landscape. Alliances that once appeared stable can no longer be taken for granted. Russia’s war against Ukraine has fundamentally reshaped Europe’s security environment, China’s growing influence increasingly affects global technology and supply chains, and even the transatlantic relationship with the United States shows signs of strain. In this context, reliance on digital infrastructure controlled by foreign states or corporations is not a neutral feature of globalization, but a source of vulnerability.
Control over cloud services, data flows, and critical digital technologies can be leveraged politically, economically, or legally, with immediate consequences for European institutions and public services. Dependencies on actors in the United States, China, and Russia expose the EU to external pressure precisely in areas central to sovereignty, including justice, security, and public administration. Recent events demonstrate that digital dependence now intersects directly with geopolitics, turning digital sovereignty from a long-term aspiration into an immediate policy question. This article maps out the dependencies in Europe's digital sector and dives into the question of digital sovereignty.
Mapping the EU’s Digital Dependencies
Europe relies on digital systems in ways most people do not notice, but the stakes are high. These dependencies stretch across platforms, hardware, and public digital infrastructure. They give power to actors outside the EU and limit Europe’s ability to act on its own.
Platforms and Cloud Services
Many European governments, schools, hospitals, and offices depend on cloud services and software controlled by US‑based companies like Microsoft, Google, and Amazon. Emails, administrative systems, and classroom tools often run on platforms that answer to laws and political pressures outside Europe. That dependence is not just technical, it has real consequences for everyday operations such as accessing email systems, cloud services and digital learning environments.
The International Criminal Court in The Hague provides a stark example. After the court issued arrest warrants for Israeli Prime Minister Benjamin Netanyahu and former Defence Minister Yoav Gallant over the genocide in Gaza, the United States imposed sanctions on the ICC’s chief prosecutor, Karim Khan. As part of those measures, Microsoft disabled Khan’s access to his Microsoft email account, forcing him to switch to a different provider and disrupting his communications. The move showed how political pressure from an outside country can translate into digital disruption through corporate infrastructure on which European institutions depend.
Hardware and Semiconductors
Another product that can create dependencies in Europe’s digital sector is the semiconductor. Semiconductors are materials that control electrical currents, making them essential components of most modern electronics, from household appliances to medical systems and the electrical grid. Control over semiconductor production therefore has major strategic importance.
The Dutch Nexperia case illustrates this clearly. The company, located in Nijmegen, is majority-owned by China’s Wingtech, and investigations revealed plans to reduce chip production in Europe while transferring both manufacturing capacity and technological know-how to China. When Dutch authorities signaled possible intervention, China responded by threatening import taxes, leaving the dispute unresolved. This episode demonstrates how foreign ownership and geopolitical tensions can directly undermine Europe’s control over technologies that are critical to its infrastructure and public services.
Public Digital Infrastructure
Even national citizen-facing systems are at risk. Solvinity, which hosts government platforms including the Dutch digital identification system DigiD are in the process of being acquired by the US company Kyndryl. Although DigiD formally remains under Dutch control, the acquisition has raised significant concerns about the resilience and sovereignty of national digital infrastructure. In particular, the takeover could bring parts of critical public systems within the scope of the US Cloud Act, a law that permits US authorities to compel companies under US jurisdiction to provide access to data, even when that data is stored outside the United States.
Lawmakers and digital security experts warn that this legal exposure could undermine effective operational control, limit the Dutch government’s ability to guarantee data protection, and increase vulnerability to political or legal pressure from foreign authorities. Given DigiD’s central role in access to public services, healthcare, and taxation, any erosion of control carries immediate risks for both governmental autonomy and citizen trust.
These cases show that Europe’s digital dependencies are tangible, affecting everyday life and strategic capacity alike. Schools, hospitals, courts, and government offices all rely on systems that can be influenced by foreign law, corporate decisions, or geopolitical tensions. Without a clearer strategy to reduce these vulnerabilities, Europe remains exposed.
Digital Sovereignty: EU Ambitions and Gaps
Digital sovereignty has become a core goal of EU policy, but it is often misunderstood. For the EU, it is not about cutting Europe off from global technology. Rather, it refers to the ability to act autonomously in critical digital areas while safeguarding privacy, fairness, and trust.
The EU pursues this goal through three main pillars. First, regulation: frameworks such as the General Data Protection Regulation (GDPR), the Digital Services Act (DSA), and the Digital Markets Act (DMA) give the EU leverage over digital platforms and data flows by setting enforceable rules on data protection, content moderation, and market competition that apply even to non-European firms operating in the EU. In practice, this means global technology companies must adapt their services to EU standards, rather than the EU adapting to theirs.
Second, industrial and technological capacity: initiatives such as the European Chips Act and Gaia-X aim to reduce strategic dependencies by building European capabilities in key technologies. The Chips Act seeks to strengthen domestic semiconductor production to secure supply chains, while Gaia-X promotes a federated cloud model that allows organizations to retain control over how and where their data is stored and shared. These initiatives focus on resilience and choice rather than excluding non-European providers.
Third, values-based governance: EU digital policy emphasizes citizen rights, secure public services, and democratic oversight. Instruments such as the European Declaration on Digital Rights and Principles embed privacy, transparency, and inclusion into digital transformation, while public-sector strategies increasingly stress control over sensitive data and critical digital infrastructure. EU officials consistently frame this approach as one of strategic autonomy rather than protectionism, maintaining openness to global markets while ensuring that digital systems align with European values.
Despite these efforts, questions remain. Experts argue that regulation alone cannot overcome deep dependencies. Building industrial capacity is slow, and public digital infrastructure is still limited. Even with laws, projects, and investments underway, Europe’s reliance on foreign platforms and supply chains continues to expose it to political and operational risk. In today’s geopolitical context, it is unclear whether these steps are enough to ensure real digital sovereignty or whether more decisive action will be needed to secure Europe’s strategic freedom.
Are we willing to endure discomfort to realise a sovereign future?
Europe’s digital dependencies create real vulnerabilities. Foreign control over platforms, semiconductors, and cloud services affects everything from citizen services like DigiD to critical institutions, as shown by the Nexperia case and the ICC disruption. Even everyday tools, including widely used social media platforms, are largely controlled by companies outside Europe, shaping communication, information flows, and public discourse. These dependencies shape politics, security, and daily life.
The EU has responded with regulation, industrial investment, and initiatives like Gaia‑X, aiming to reclaim some control. But building European alternatives takes time, and integration with global technology networks means vulnerabilities remain. Experts question whether current efforts are enough to ensure real autonomy.
The challenge now is broader: it calls on governments, institutions, and citizens alike to rethink dependency. Are we willing to invest in new allies, support national innovation, and relearn how to rely on alternative digital services? It is possible to move away from structures of digital dependencies, but only if Europe actively reduces critical vulnerabilities rather than assuming technology will remain neutral. Digital sovereignty is ultimately about who controls the systems underpinning democracy, public services, and strategic decision-making, and whether Europe chooses to remain constrained, or take steps to shape its own digital future. Shall we?
This article is part of The Outside World, ftrprf’s very own research center.
For organizations, it’s pivotal to thoroughly understand what is happening in society. We help companies generate comprehensive insights into societal change and its potential effects on their strategy and operations, both negative and positive. With actionable societal insights, courageous plans, and a can-do mentality, we connect the outside world to your company's strategy. For these outside-world insights, we use a rigorous methodology that includes data processing, quantitative and qualitative analysis, and a thorough review process to ensure the accuracy and consistency of our findings.
For more information, please contact theoutsideworld@ftrprf.com.