Digital sovereignty has gone – relatively quickly – from being a niche policy interest, to a mainstream business consideration across multiple regions of the world.

One of the most outspoken players has been the European Union, with its Gaia-X initiative, a wave of binding regulation, and a series of high-profile procurement decisions.

The combination of these changes made it unequivocally clear that the question of who controls critical data infrastructure is no longer a theoretical debate. Awareness of what has actually changed (and what this change means in practice) is becoming increasingly relevant for any business working across borders.

From summits to something tangible

The first European Summit on Digital Sovereignty was convened in November 2025 with the initiative of France and Germany. It brought in politicians, regulators, and industry leaders with the goal of mapping out concrete commitments instead of position papers.

A joint task force on digital sovereignty was produced as a result of this summit, due to report back in 2026. Meanwhile, Gaia-X released its Trust Framework 3.0 that enabled federated trust structures across borders and sectors.

The figures revealed during this summit are more telling than the announcement itself. Gaia-X now counts more than 15 operational data spaces, which is a noticeable difference from the long list of projects that were previously only known as “in preparation.” Cloud Temple became the first provider that got certified at the highest sovereignty label of this initiative.

Corporate procurement has also begun to follow the same route. Airbus issued a tender worth more than €50 million to migrate mission-critical environments to a sovereign European cloud. BMW continues its expansion of the Catena-X data-sharing network. Germany’s armed forces have signed a seven-year-long contract with the purpose of using an open-source alternative to replace Microsoft 365.

While none of this can be treated as the EU being on par with the American hyperscalers, it is an indication of procurement decisions and infrastructure investments being made based on security concerns, not just policy statements.

Why “stored in Europe” is not the same as “sovereign”

There is an important distinction relevant to this topic: where data is stored physically is not the same as whose laws govern it.

For example, AWS launched a European Sovereign Cloud in Brandenburg in January 2026. It’s structured as a standalone German entity with EU-based executives and an investment fund of several billion euros behind it. On paper, it resembles exactly the kind of cloud storage European regulators have been looking for. In reality, the parent company of AWS is still American, meaning that the US CLOUD Act still applies – allowing US authorities to compel American companies to hand over data they control at any point in time.

The chief executive of Gaia-X has been very blunt on this topic, clearly stating that the highest level of sovereignty can only be achieved by providers that have their headquarters on European soil. If the service is run by a US company (even with European staff and data centers), it’s still subject to American legislation.

This single factor cannot be considered a mere technicality. It’s significant enough to be the difference between a compliance checkbox and a genuine answer to a question of who can access this data and under what authority.

What it means for business decisions

Sovereignty is no longer a question that can be stalled indefinitely from the business side. Not only the EU Data Act has been in force since September 2025, but there are also multiple sector-specific rules (such as DORA for finances and NIS2 for critical infrastructure) that are tightening the same constraints, as well. None of these regulations treat sovereignty as optional.

According to survey data from Germany’s Bitkom, there are already many businesses around the globe that want independence from foreign infrastructure but have not acted on these wishes yet, despite the trust in some foreign providers having fallen sharply recently. This specific gap between intention and action is exactly where all the rushed and expensive decisions come from – mostly under regulatory pressure instead of a considered timeline.

In this context, there are a few basic questions that are worth raising as early as possible from the business side: where does data actually reside, and under whose jurisdiction; what do existing cloud contracts say about data access requests from foreign authorities; and were a rapid migration away from a provider necessary, would it actually be possible?

The recovery question most discussions overlook

Most discussions about digital sovereignty work from determining where data lives day by day: including specific cloud providers, specific data centers, and the specific jurisdiction it works under. These are legitimate questions, but they address only the visible layer of a much deeper dependency.

Sovereignty, properly understood, also requires control over what an organisation can recover from when infrastructure fails – and this dimension is one that policymakers have been slower to address than the infrastructure and regulatory questions that tend to dominate the conversation.

The gap is significant. Regulatory frameworks such as the EU Data Act, NIS2, and DORA establish requirements around data residency, access controls, and operational resilience, but they leave the specifics of backup architecture and recovery sovereignty largely to individual organisations to determine. A business can be fully compliant on paper while remaining entirely dependent on a foreign vendor’s proprietary backup infrastructure – one it cannot fully audit, migrate away from, or recover independently in a crisis.

This is precisely the argument that backup and recovery vendors have begun to make recently. Swiss company Bacula Systems describes this logic as “sovereign recovery” – the idea that a sovereign cloud strategy at a given moment is only going to be as resilient as the recovery infrastructure it works under.

Whenever a backup data is stored in an environment the organization does not have a full control over, created using formats that are problematic migration-wise, or tied to the infrastructure of an individual vendor – the validity of sovereignty claims becomes significantly less absolute and may not hold up under real pressure.

Irrespective of whether or not a given vendor’s approach is going to suit a particular organization, the overall point still stands. Cloud provider selection has been dominating the sovereignty conversation, while the recovery layer has received a lot less scrutiny in comparison.

The whiteboard phase is over

None of these arguments mean that all the existing infrastructure should be disassembled overnight. No serious case is being made for businesses to sever all ties with their current “foreign” technology. However, it does increase the likelihood that businesses treating digital sovereignty as someone else’s problem are the ones that are most likely going to have to make some rushed decisions under regulatory pressure within the next year or two.

The policy debate has finally moved on from abstract principles to creating practical operational data spaces, substantial procurement tenders, and binding regulations. This change is the reason why most businesses cannot simply consider sovereignty as an optional topic – as they now have to think whether they have established where their data resides, who has access to it, and what they are going to recover from if the need to do so arises.