Sovereignty is not patriotism, it is a supply chain question

Digital sovereignty is having the decade that cybersecurity had in 2015: a real concern, a genuine shift in buyer behaviour, and a word applied to everything by everybody until it means nothing. It is being used as a synonym for patriotism, for local hosting, for compliance, and occasionally for a flag on a pricing page.

The definition worth using is narrower and has nothing to do with where a supplier is registered.

The definition

An organisation is sovereign with respect to a system if it can run it, inspect it, move it and stop using it without needing anybody’s permission.

Four verbs, all testable. Run it: on infrastructure you chose, with credentials you hold. Inspect it: read what it actually does, not a description of it. Move it: to different infrastructure or a different provider, in bounded time and cost. Leave it: with everything you put in and everything it produced, in formats something else can read.

Nothing in that requires the supplier to be European, or the hosting to be domestic, or the software to be free.

What the definition excludes

Local hosting alone. A datacentre in Frankfurt running software you cannot inspect, cannot move and cannot leave provides jurisdictional comfort and no sovereignty. It is the most commonly sold version and the weakest.

Nationality of the supplier. A European vendor with proprietary formats and punitive exit terms is exactly as constraining as an American one. Substituting one dependence for another is not independence, it is a change of counterparty.

Compliance certificates. They describe how a supplier handles obligations. They say nothing about whether you could leave.

What it does not require

Running everything yourself. Sovereignty is about the option, not the exercise. An organisation using managed hosting for something it could move is sovereign with respect to it; one running its own servers for something with no export path is not.

Refusing large suppliers. The question is what the arrangement looks like, not who is on the other side of it. Plenty of arrangements with large vendors are portable, and plenty of arrangements with small ones are not.

Ideology. This is procurement, not politics. The buyers moving fastest on it are doing so because a price change or a discontinued product hurt them, not because of a position on technology policy.

Why it is being repriced now

Concentration risk became concrete. Enough organisations have experienced a unilateral price increase, an acquisition that changed a roadmap, or a product withdrawn with a year of notice, that dependence has moved from an assumption to a line in a risk register.

Regulation reinforced it rather than causing it. European rules on data, cloud services and AI increasingly expect portability, transparency and oversight, which gives buyers firmer ground to ask for them and gives auditors a reason to check. The practical effects are slower than the legislation implies, but the direction has not wavered.

And the alternatives got good. Ten years ago choosing a portable stack meant accepting a materially worse product. In several categories that is no longer true, which is the change that makes the rest matter.

The test we apply

One question, asked of any company: if a customer decided to leave next quarter, what exactly would they take, in what format, and how long would it take?

A company built on this thesis has an answer immediately, because it was designed in. A company that has to think about it is telling you where its retention comes from — and that answer is the whole investment decision compressed into a sentence.