For most of the past decade, "digital sovereignty" was a phrase for conference panels. In 2025 and 2026 it turned into policy, budgets and actual migrations. If you sell, buy or run technology in Europe, it is worth understanding what changed, because the ground moved under a lot of assumptions about where data and computing are allowed to live.
The number that started the conversation
Estimates vary, but the shape is consistent and uncomfortable. Something like ninety percent of Europe's digital infrastructure runs on non-European, mostly American, providers, and the three big US hyperscalers hold roughly two-thirds of the European cloud market. The European providers' share actually fell over recent years. Analyses like the EuroStack work from the Bertelsmann Stiftung lay out the dependence in detail. Once you see the figures, a lot of European policy over the past two years reads as a single reaction to them.
The laws catching up
Several legal threads pull in the same direction. The EU Data Act, applicable since September 2025, is dismantling the fees and technical obstacles that lock customers into a cloud provider, and it obliges providers to guard non-personal data against unlawful foreign-government access. The GDPR's transfer rules, shaped by the Schrems II ruling, keep the risk of sending personal data abroad firmly on the table. And in June 2026 the Commission proposed a Cloud and AI Development Act, part of a wider tech-sovereignty package, whose own framing is blunt: over-reliance on non-EU cloud providers is a significant risk to Europe's digital autonomy. The proposal talks about tripling EU data-centre capacity and defining tiers of cloud sovereignty, the strongest of which rules out third-country corporate control for the most sensitive public workloads.
Sweden puts it in writing
This is not only a Brussels story. On 28 May 2026 the Swedish government adopted its first national cloud policy for public administration, stating in plain Swedish that the country is heavily dependent on suppliers outside the EU. The policy does not ban American cloud. It requires risk assessments, open standards, clear contracts and exit plans, so that a public body can actually leave a provider if it needs to. The direction is unmistakable even where the language is careful.
Notice the recurring word in all of this: exit. The Data Act removes exit fees. The Swedish policy demands exit plans. The EU sovereignty tiers are about not being trapped. Regulators have concluded that the ability to leave is the thing that was missing. The cleanest version of an exit plan is the arrangement you never have to exit, because the data was in your building the whole time.
From policy to actual migrations
The most telling signal is that organisations stopped waiting for the laws to finish. In June 2025 Denmark's digitalisation ministry announced a move from Microsoft software toward open-source alternatives, on explicit sovereignty grounds, as reported at the time, with Copenhagen citing a Microsoft licence bill that had climbed sharply over five years. In Germany, the state of Schleswig-Holstein set out to move tens of thousands of machines off Windows and Office to Linux and open-source tools, projecting real annual savings, as covered in the trade press. These are not startups making a point. They are governments moving payroll and email.
Where AI fits
AI sharpens every part of this. An assistant that sends prompts and documents to a foreign-controlled cloud is the exact dependence the sovereignty debate is about, applied to your most sensitive internal knowledge. Running the model on your own hardware is not a clever hedge against the trend. It is the trend, expressed at the level of a single deployment. When the computation happens where the data already lives, there is no provider to be locked into, no border to defend, and no foreign statute that reaches the server.
None of this means American cloud is going away, and this guide is not a prediction that it should. It is a map of a real shift in what European institutions consider prudent. For a Swedish company that has always built AI to run inside the customer's walls, the map mostly confirms a bet we made early. The rest of the continent is now describing, in law and in budgets, the thing we build.