When U.S. export controls forced Anthropic to suspend two of its most advanced AI models in June, customers outside the U.S. lost access overnight — and European politicians found their case study.
Bruno Retailleau, a former French interior minister now running for president in 2027, said it should “serve as a wake-up call,” and that “a nation that depends on others for this technology is a nation that can be unplugged overnight.”
Al Carns, the British MP and former armed forces minister, said: “This week the most advanced AI model on the planet got switched off by a foreign government. British researchers were studying it, British companies were testing it. British hospitals were piloting it. Not anymore.”
Access was restored after 19 days, but the suspensions left an impression. “We saw the risk with Mythos and Fable 5, where a government can shut down access to technology,” says Paul-Henri Charrier, director of public affairs and strategic partnerships at French firm Upsun. “The real issue today is that the global market is fragmenting into jurisdictions.”
A September report from consultancy Capgemini, based on a survey of 1,300 executives at organizations with more than $1 billion in revenue, found that 93% have discussed digital sovereignty at the board level. Half have appointed, or are considering appointing, a chief sovereignty officer, and 65% have set money aside for it.
Three-quarters of those surveyed are highly concerned about protecting critical operations amid geopolitical tension, and 65% agree that excessive reliance on foreign providers is a significant risk to digital resilience.
Defining sovereignty
Digital sovereignty is the concept of a company or country claiming independent control of its digital infrastructure, including data, cloud and AI. That can extend to control over where technology is stored and processed.
“Sovereignty is a suitcase word, and you can put anything in it,” Charrier says. At the state level, he argues, the question is jurisdiction. For an organization, it is dependencies: whose software, running on whose hardware, operated by whom.
Capgemini’s respondents are prioritizing accordingly. Data is the layer most often covered by sovereignty strategies (78%), followed by cybersecurity (75%) and cloud (72%). Software (61%) and AI (56%) trail. The main motive, cited by 80% of respondents, is operational resilience in the face of geopolitical disruption. Control over data, models and intellectual property, and risk mitigation, each drew 76%.
The pressure to go sovereign
Andreas Prins, who leads sovereign solutions at SUSE, an open-source software company, sees three forces behind the interest in not only digital sovereignty but also open-source.
The first is regulation. Europe’s Digital Operational Resilience Act is in force, its Cyber Resilience Act is phasing in through 2027 and a proposed Cloud and AI Development Act was proposed in June. “They all have elements of open-source or control measures where open-source is almost the only way to achieve that level of autonomy,” says Prins. The CRA in particular pushes suppliers in critical sectors toward transparency about what is inside their products, like the ingredients on a food label.
The second is concentration. “A lot of executives are realizing that five of their eight components depend on a single vendor,” Prins says. A French bank might rely on one supplier for its mainframe, its virtualization and its cloud. “It’s been nice for procurement, because you optimize for cost, but from a security perspective, is that a good optimization?” He says this is why some customers who already use Linux from Red Hat, the largest enterprise Linux vendor, now want “a second, European alternative next to it.”
The third is “exit velocity,” says Prins: how long it would take to leave a technology. Customers are increasingly looking for flexibility in a world of supply-chain flaws, price rises and, at the extreme, export controls.
The vendor lock-in squeeze
Vendor lock-in, where switching suppliers is so costly or disruptive that customers stay put, is a universal pressure. Research published in October by Origina, a Dublin-based firm that sells third-party support for IBM, Oracle and other enterprise software — a business built on customers who want to defer vendor-mandated upgrades — put a number on it. Censuswide surveyed 2,018 CIOs and senior IT decision-makers at large U.S. and UK organizations in May. On average, 28% of their software budgets go to vendor-mandated upgrades, migrations and licensing changes the buyer would not have chosen.
Some 95% said they had paid for such a change in the past three years that their organization believed would reduce performance, reliability or business value, and 53% had done so more than once.
Customers exercise choice at the point of purchase, but 78% agreed that their primary vendor, not their own organization, sets the timing and terms of the change thereafter.
“If you have no alternative and no freedom to get out of the contract, you’re in a pickle,” says Peter Farkas, CEO of Percona, which supports open-source databases. “You can be told to pay $1 million more next year, and you’ll pay it because you’re locked in and have no reasonable way out.”
The cloud is one common example. Falling into lock-in is easy, Farkas says: “It’s a couple of clicks and you have a database.” The cost arrives later. “They can say, ‘We don’t like this pricing for next year. It should be twice as expensive,’ and they know it would be a world of pain and expense for you to move.”
Tomás O’Leary, CEO and founder of Origina, says the bill is only part of it: “Once you factor in engineering time, hardware replacement and delayed innovation, the true cost extends far beyond the software bill.” Some 84% of those surveyed say engineering talent always or often spends its time maintaining vendor-driven change instead of building future capability.
Open-source as an answer
Open-source software is code that its authors publish for anyone to read, use, modify and share, usually under a license that sets the terms. Proprietary software is typically sold as a finished program whose underlying code stays private. For sovereignty, this is important because if the code is public, a customer can fix problems itself, hire another company to support it or, if the original developers change course, copy the code and carry on independently, a move known as forking.
“[Open-source] gives you a fantastic level of independence because it gives you the right to fork,” says Peter Zaitsev, Percona’s cofounder. “If you’re cut off from a system for whatever reason, you can at least do something.” With proprietary products, “all you have is a binary and can’t do anything.”
Prins says the benefits are exit, ownership and auditability. “Imagine [an open-source software] stopped existing tomorrow. Every company could continue with its stack, patch it themselves or find another partner.” Because the source and the build process are open, customers can inspect both.
Zaitsev points out that projects such as PostgreSQL, a widely used database, are not controlled by one country or company, as their contributors are spread across the world. Even if one government outlawed open-source, “contributors in many other countries could still push it forward.”
Open-source shifts dependency rather than eliminating it, though — from a vendor to a community and to a firms’ own engineering capacity. “Open-source by itself won’t give you freedom from lock-in,” warns Farkas. “It needs to be an open-source project supported by multiple vendors.”
Getting out
The advice from the five experts begins with mapping out what you depend on.
“Before choosing technology, they need an inventory of what they’re paying for,” says Charrier, then sort it: “What’s a commodity I should absolutely buy because five providers offer it? What’s a genuine innovation with only one provider, where I need an escape plan?” Many firms, he says, don’t currently have one.
O’Leary suggests that leaders “settle the terms of your exit before you commit to the entry.”
“A customer’s greatest leverage comes before the first contract is signed, and after that the balance shifts.”
Second, Prins suggests working with a risk officer to find the biggest exposure, whether geopolitical or concentration-related. The riskiest systems are rarely the easiest to move, he cautions, so engineers should also pick off low-hanging fruit deeper in the stack.
One example: a company running servers on several hyperscalers — the giant cloud providers such as Amazon Web Services, Microsoft Azure and Google Cloud — can manage them all through a single open-source control plane instead of each provider’s console. The rest stays the same. “The way of working, the knowledge, all the data and all the capabilities remain exactly the same.”
Third, design for departure. “You should architect with exit in mind,” Prins says. “For each layer of your stack, how would you exit?”
O’Leary adds: “More modular environments can give businesses greater flexibility because one vendor controls less of the entire technology estate.”
Fourth, treat the cloud as a commodity. Farkas wants it used “as a utility, like electricity,” buying raw computing and storage that can be swapped for another supplier’s, but not proprietary database products that exist only on one platform.
Fifth, read the contract. Charrier argues that AI-assisted coding is shifting the risk from technical to contractual lock-in. A 10-year deal can be a sensible bet on stable prices, but “when things go bad, you look at the contract. When they go well, you don’t.”
None of this makes a company sovereign overnight, and most are not trying. In Capgemini’s survey, 59% said full digital sovereignty is not a realistic goal, and two-thirds defined it instead as “resilient interdependence.
“This isn’t about avoiding major software vendors altogether,” says O’Leary. “It’s about creating genuine options so that staying with a vendor remains a choice rather than something the business has little practical ability to refuse.”