Beyond Politics and Ideology:Why Digital SovereigntyCan Affect Your Daily Business
A Pragmatic Approach Beyond Ideology
to manage Digital Dependencies of your Business
WHY Digital Sovereignty should matter to Your Business but WHAT does Digital Sovereignty REALLY mean?
“I have been using my non-European hyperscaler subscription for ten years without a local European backup — and I have never had an issue.”You may be absolutely right. But does ten years without an issue mean that the dependency carries no risk? Or does it mean that the conditions surrounding that dependency have remained stable enough so far? The growing debate around Digital Sovereignty did not appear without reason. Governments, European institutions, technology vendors, industry and the open-source community are all discussing how these dependencies should be addressed. Inevitably, that debate has also become political and ideological. You are free to consider some of these risks important and others unlikely. You do not need to share a particular political view — or even be interested in the political debate at all. But if external decisions can affect the availability, cost, conditions or delivery of technology your organization depends on, they become a business consideration. At NUVO, this is where Digital Sovereignty begins. For us, Digital Sovereignty does not mean eliminating every external dependency, preparing for catastrophe or attempting to become technologically self-sufficient. It means maintaining control over your data and consciously managing the risks and dependencies surrounding the technology your business relies on. It means knowing where important dependencies exist, understanding how external changes could affect them, managing those risks proactively and predictably, and maintaining realistic alternatives where the potential impact justifies them. A dependency is not automatically a problem. And eliminating every dependency is neither possible nor necessarily desirable. The objective is to make dependencies conscious, manageable and proportionate to their business impact — rather than discovering them only when circumstances outside your control have already turned them into a problem.
Beyond Politics and Ideology
The concerns behind the European debate on Digital Sovereignty are real, and they can affect businesses of any size.
But a discussion that began with real technological dependencies and risks has increasingly divided into two opposing political and ideological positions.
On one side, institutional strategies have promoted European data location and Open Source only approaches, including the exclusion of commercial software from multinational vendors. On the other, defenders of the existing global technology model have often treated established platforms and hyperscalers as the natural choice, while giving too little consideration to the dependencies and risks they create.
Technology and business operations, however, cannot be driven by ideology.
Technology ultimately has to serve the organization using it. Systems need to deliver the capabilities the business requires, at a sustainable cost, while keeping dependencies and the risk of disruption at an appropriate and manageable level.
Changing political priorities can move organizations rapidly from one model to another — and sometimes back again. Infrastructure, applications, technical skills and users cannot change at the same speed. Every such reversal can introduce new costs, disruption and dependencies instead of resolving the original ones.
From a technological and business perspective, we believe four important aspects have been underestimated:
Location is not Control. Where data is stored matters, but so does the applicable jurisdiction. Who can access and control the data matters — and so does who can access and control the platforms and infrastructure on which that data depends.
Open Source First is not Open Source Only. Open Source can provide greater control, transparency and freedom, but it is not synonymous with “free”, requires sustainable development and financing, and an adequate alternative does not always exist.
Infrastructure remains a dependency. Data centres, networks and international connectivity are physical systems. Location alone cannot protect against failures, disruptions or deliberate damage to the infrastructure connecting your business to its data.
Complex systems need time to change. Alternatives need to mature, migrations need planning, technical teams need skills and users need training. Political timelines cannot eliminate these requirements.
In the following sections, we will examine these aspects individually and add the technical and business considerations that we believe are too often missing from the debate.
Where Your Data Lives Is Only Part of the Story
Maybe Your Data Is in Europe. Is it Under Your Control?
Keeping data in Europe can be an important part of Digital Sovereignty. But before considering the problem solved, there are a few more questions worth asking.
The first is obvious: do you actually know where your data is?
Many businesses use email, file sharing, SaaS applications and cloud services without ever asking where their information is physically stored or under which jurisdiction the service operates.
But even when the answer is Europe, location alone tells only part of the story.
Keeping data in Europe does not make it free from risk or dependency.
Whenever your data is stored outside infrastructure you directly control, your organization depends on somebody else to keep it available and accessible. That dependency may be entirely reasonable and well managed — but it still exists.
A European provider can fail, change its commercial conditions, discontinue a service or experience technical and connectivity problems just like any other provider. European location can reduce certain risks; it does not eliminate the need to manage dependency
Which jurisdiction applies to the provider and the service? Who can access and control your data?
And there is another, often overlooked question: who controls the platform that holds and processes that data?
A global cloud provider may guarantee that your data is stored and processed in European data centres. But the platform may still depend on control planes, identity systems, licensing services, software distribution, administration or other critical components operated elsewhere.
So another question becomes relevant:
If your data is in Europe, can the platform that makes it usable continue operating independently there?
These questions do not automatically make a global cloud service the wrong choice.
Cloud platforms provide real technological and economic advantages. In some cases, a locally or fully European-controlled alternative provides comparable capabilities at a sustainable cost and can be the preferable choice. In others, the available alternatives may lack important functionality, require substantially greater investment or simply not yet provide an equivalent service.
Moving such a workload on-premises is not automatically safer either. Infrastructure, expertise, redundancy and maintenance have real costs, and a poorly designed local system can introduce greater risks than the cloud dependency it was intended to remove.
We therefore consider each of these options according to the actual requirements of the organization — and, where appropriate, combine them.
At NUVO, we believe the underlying principle behind many European Digital Sovereignty initiatives is correct: important business data should have an independent copy under a level of control and jurisdiction appropriate to the organization relying on it.
Where we differ is in treating this principle as an architectural objective rather than prescribing a single technological model.
We analyse and document relevant jurisdictions, access rights, platform dependencies and operational constraints. We evaluate their potential business impact and define how data and operations could be recovered if an important dependency became unavailable.
Depending on the workload, this may mean using a European-controlled platform, a global cloud service with an independent copy, local infrastructure at the customer’s premises — or, ideally where the requirements and economics justify it, a combination of these approaches with defined integration and recovery paths.
The objective is not to eliminate every external dependency.
It is to ensure that critical data remains independently accessible and recoverable under the organization’s own control, even when the best operational platform for the workload depends on somebody else.
Open Source Only? We Agree on Open Source First — Where It Makes Sense.
At NUVO, we believe in and apply an Open Source First approach — without ideology.
Open Source can be one of the strongest instruments for Digital Sovereignty. Access to source code provides transparency, the possibility to audit and modify software, and greater freedom to operate it independently or entrust its development and maintenance to somebody else.
These are important advantages, and the reason why Open Source is our preferred starting point whenever it provides an appropriate solution.
But Open Source is frequently confused with free of cost.
Think of software as a recipe. Open Source gives you access to that recipe: you can study it, adapt it and choose who prepares it for you. It does not mean that the cook should work for free.
Professional software still requires developers, security work, testing, documentation and long-term coordination. Open Source changes the freedoms associated with software; it does not eliminate intellectual work or the need for sustainable financing.
The community is an important part of this ecosystem, including voluntary contributions. But major professional software cannot realistically depend only on unpaid work. Some of the world’s largest technology companies and hyperscalers understand this very well: they employ developers, contribute code and finance Open Source projects on which their own platforms depend.
The same principle applies to institutions promoting Open Source and technological independence. Encouraging adoption is only part of the equation. Sustainable alternatives also require continuous development, coordination and investment. This can happen through companies, foundations, universities, public development teams, contracted development or coordinated contributions to existing projects.
Without that investment, development resources can become fragmented across projects and forks, while promising alternatives struggle to reach the maturity expected from business-critical software.
Open Formats Matter
Digital Sovereignty is not only about the software running an application. It is also about the information inside it.
Open and documented data formats allow information to be accessed independently, exchanged with other systems and migrated to another platform. APIs and interoperable standards can provide similar freedom even when the application itself is proprietary.
This distinction is important because Open Source does not automatically prevent lock-in. An Open Source application can still use difficult-to-migrate data structures or depend on a hosting platform, infrastructure or service that creates its own dependencies.
Conversely, a proprietary application with well-documented formats, complete APIs and reliable export mechanisms may provide considerable practical freedom to move data elsewhere.
Open Source gives you access to the recipe. Open formats help ensure that your ingredients do not become trapped in the kitchen.
The Cost of Leaving Matters Too
Technical portability does not necessarily mean practical portability.
A platform may allow you to export all your data while making that process expensive, slow or operationally complex. Large data transfers can involve egress charges, migration services, conversion work and substantial technical effort.
These egress and exit costs can themselves create lock-in.
For this reason, our Open Source First approach looks beyond the software licence. We also consider open formats, interoperability, APIs, export capabilities and the real technical and economic cost of moving to another platform.
Open Source remains our preferred starting point where it meets the requirements of the organization.
But the objective is not simply to use Open Source.
The objective is to preserve control, portability and realistic freedom of choice.
An Alternative Has to Exist — and It Has to Work. But What If It Doesn't?
Reducing technological dependencies requires alternatives.
Europe has strong technology companies, capable infrastructure providers and an important Open Source ecosystem. But equivalent European or Open Source alternatives do not exist for every technology businesses and public organizations depend on today.
In some areas, there is still a gap in functionality, maturity, integration, scalability or cost. Expecting communities alone to close these gaps without adequate coordination and sustainable institutional or commercial financing is unrealistic. Strategic technological independence also requires strategic investment.
Ignoring this gap does not make it disappear.
Forcing organizations to adopt an inadequate alternative can increase costs and complexity, reduce functionality and even produce technological steps backwards. It can also create conflicts between institutional objectives and operational requirements.
When political direction changes again, the result can become an expensive technological ping-pong: repeated migrations, discarded investments and skills, retrained users and technical resources spent moving systems instead of improving them.
When There Is No Realistic Alternative
There are undeniable business cases where global platforms and hyperscalers provide capabilities, scale, integration or economics for which no realistic alternative currently exists.
In these cases, we believe using them can be the right business and technological decision.
But the concerns surrounding those dependencies remain legitimate.
Our approach is therefore to manage the dependency rather than pretend it does not exist.
We analyse the risks and business impact, document the dependency, evaluate data portability, egress and exit costs, and define what would be required to recover or migrate if circumstances changed.
For critical data, our preferred approach is to maintain an independent copy outside the primary platform — locally at the customer’s premises, within infrastructure under the customer’s appropriate jurisdiction and control, or through a combination of both where justified.
This protects the data, but it does not automatically replace the service.
Where interruption would have a significant business impact, a recovery plan can therefore include an alternative environment with reduced capabilities, designed to maintain essential operations until the primary service is restored or a migration becomes possible.
When a dependency cannot reasonably be eliminated, Digital Sovereignty means understanding it, controlling its consequences and maintaining a realistic path to your data and essential operations.
Complex Systems Cannot Change Overnight
A new technological direction can be decided quickly. Making it work can take years.
Moving away from an existing platform does not mean that every workload can immediately move with it. A European or Open Source alternative may already work well for some applications, while others still lack the functionality, integration or maturity the organization requires.
This is where many technology transformation projects have failed.
They tried to change too much, too quickly.
Timelines were defined by political or strategic objectives rather than by the time actually required to migrate complex systems. And in some cases, organizations tried to move every workload — including those for which no adequate alternative was ready.
The result was predictable: higher costs, operational problems, frustrated users and, in some cases, projects that were stopped or reversed.
A more realistic transition accepts that different workloads can move at different times. What has a suitable alternative can move first. What does not can remain on the existing platform while a replacement matures, is developed or receives the investment required to become viable.
For some time, old and new platforms may need to coexist. That is not a failed migration. It can be part of a successful one.
And technology is only half of the transition. People need time too.
Employees may have worked with the same tools and processes for years. Learning something new creates uncertainty and can initially reduce productivity. “We have always done it this way” can be resistance to change, but it can also express a simple concern: “I know how to do my job today. Will I still know how to do it tomorrow?”
Training is therefore a real migration cost, not something to add afterwards.
Users need time to learn the new tools, understand why processes are changing and become comfortable with them. The advantages of a better system may only become visible after this transition — not on the first day.
Digital Sovereignty cannot be imposed by an unrealistic migration deadline.
It is built by moving what is ready to move, managing what still needs to remain, investing in the alternatives that are still missing, and giving both technology and people the time required to make the transition succeed.
the NUVO approach
Digital Sovereignty is not about choosing between Europe and the rest of the world, Cloud and On-Premises, or Open Source and proprietary software.
It is about understanding and managing the dependencies your business relies on.
Those dependencies can be geopolitical or regulatory. But they can also be much simpler: a single cloud provider, a proprietary data format, an expensive exit process, a critical SaaS application, an infrastructure provider, a software vendor — including a European one.
European location can reduce certain risks. Open Source can provide greater control. Open formats can improve portability. Independent copies can protect important data. Local infrastructure can provide continuity when connectivity becomes a dependency. And global platforms can provide capabilities or economics that make them the right choice for a particular workload.
None of these choices alone creates Digital Sovereignty.
At NUVO, we start with the architecture.
We identify important data, workloads and dependencies. We consider their business impact, jurisdiction, portability, exit costs and available alternatives. We then decide where each workload makes sense and where additional control, independent copies, recovery options or alternative platforms are justified.
Sometimes that means European infrastructure. Sometimes Open Source. Sometimes infrastructure at your own premises. Sometimes a global hyperscaler.
And very often, the right architecture is a combination of them.
The objective is not technological independence. Modern businesses will always depend on technology, providers and infrastructure they do not completely control.
The objective is to ensure that those dependencies remain understood, proportionate and manageable — and that an external decision, technical failure or changing market condition does not unnecessarily become your business problem.
If you want to understand and better manage the digital dependencies behind your business — wherever those dependencies are located — talk to us.