Goodbye, US tech! How France is forcing Europe's digital independence

Linux instead of Windows: The radical IT master plan for Europe's public administrations

The Schrems III Trap: Why US Clouds Suddenly Become a Risk for the State

Europe's public administrations are trapped in a costly and highly risky dependency: billions of euros flow annually to a few non-European tech giants for IT infrastructures that, in a crisis, cannot be controlled or operated independently. While the concept of "digital sovereignty" often remains an empty phrase in politics, France is now taking action. With a radical roadmap that mandates a switch to open-source solutions by 2030 and a complete abandonment of US cloud services, Paris aims to end technological paternalism. Germany and the EU are following suit with projects like "openDesk" and new procurement guidelines – but budgets and the necessary political will remain obstacles. This analysis examines the long-overdue liberation of European IT and explores why open source has long ceased to be mere ideology and has become a stark economic and security policy necessity.

Vassalage at the click of a button: How Europe is mortgaging its digital future to third parties

The price of convenience: A billion-dollar bill with no return

Europe's public administrations are trapped in a costly and highly risky dependency: billions of euros flow annually to a few non-European tech giants for IT infrastructures that, in a crisis, cannot be controlled or operated independently. While the concept of "digital sovereignty" often remains an empty phrase in politics, France is now taking action. With a radical roadmap that mandates a switch to open-source solutions by 2030 and a complete abandonment of US cloud services, Paris aims to end technological paternalism. Germany and the EU are following suit with projects like "openDesk" and new procurement guidelines – but budgets and the necessary political will remain obstacles. This analysis examines the long-overdue liberation of European IT and explores why open source has long ceased to be mere ideology and has become a stark economic and security policy necessity.

The French state spends around €1.5 billion annually on software developed and controlled outside of Europe. This figure initially sounds like a dry budget item, but it is in reality a political symptom. It describes a situation in which a sovereign state relies on infrastructure for its core functions—from administration and education to internal security—that it does not control, cannot monitor, and cannot shut down in an emergency without jeopardizing its own operations. The French parliamentary committee that calculated this sum chose a word rarely heard in political debate, and precisely for that reason, it is striking: vassalage. The term originates from feudalism and describes a relationship of dependency in which the weaker party owes loyalty to the stronger, in exchange for protection and usage rights that can be revoked at any time. This image perfectly reflects the current situation of many European administrations vis-à-vis a few non-European technology companies.

The committee didn't stop at diagnosis, but formulated 29 concrete proposals for countermeasures. The most politically significant of these stipulates that, starting in 2030, open-source software should become mandatory in public tenders in France. In addition, the use of proprietary office software in schools and universities is to be reduced – a particularly sensitive area because it shapes the technological habits of future generations. Students who grow up exclusively with a specific software environment are unlikely to question it as adults. France is therefore attempting to set a new course not only in adult administration, but also within the education system itself.

From paper tiger to procurement reality: France's concrete roadmap

Digital sovereignty is often invoked in political speeches, but rarely translated into concrete procurement rules. France differs remarkably from the usual rhetoric here, because at an interministerial seminar in April 2026, it adopted a tangible roadmap to systematically reduce its dependence on non-European IT providers. A central element of this roadmap is the migration of government workstations from Windows to Linux – a technically complex but symbolically powerful step, as it recognizes the operating system as the foundation of all digital sovereignty. In addition, there is a clear directive with a strict deadline for all ministries: By autumn 2026, they must systematically assess their digital dependencies and submit concrete migration and reduction plans. This is not a vague commitment, but a homework assignment with a deadline and accountability.

In parallel, France is building its own open collaboration platform for public administration, known as Suite numérique. This suite, also called LaSuite numérique, is developed and operated by DINUM, the Directorate for Interministerial Digitization, which reports directly to the Prime Minister's Office and is licensed under an open MIT license. The goal is to provide a comparable alternative to standard American office software and collaboration packages, with all data stored exclusively in France on an infrastructure certified according to the stringent national security standard SecNumCloud. The suite now comprises seven core components, including an encrypted messaging service with approximately 600,000 users, a video conferencing solution, a collaborative writing tool, cloud storage, a no-code database, a service for large file transfers, and an AI assistant based on a European language model. Since July 2025, the messaging service has been mandatory for all ministries – a clear signal that this is not a pilot project, but a binding strategic priority.

The real trigger: A statement made under oath that alarmed Europe

France's withdrawal from American cloud and collaboration services is driven not only by technical but, above all, by legal reasons. In June 2025, Microsoft France's legal director testified under oath before the French Senate that he could not guarantee that French citizens' data would never be transferred to American authorities without French authorization. This statement was so consequential because it revealed a legal reality that many officials had previously ignored: the American Cloud Act obligates US companies to hand over data to American authorities, regardless of where in the world that data is physically stored. A European data center operated by an American provider, therefore, does not automatically protect against American access. This realization clearly acted as a catalyst in Paris, transforming the hitherto rather technocratic debate on sovereignty into a political urgency.

This fundamental legal issue affects not only France, but every European state that relies on non-European cloud infrastructure. It also explains why terms like Schrems II and the looming Schrems III lawsuit are gaining increasing attention in legal circles, as they describe the ongoing legal debate about whether data transfers to the United States can even be compatible with the European General Data Protection Regulation (GDPR). A service that is subject exclusively to European law from the outset is completely exempt from this ongoing legal uncertainty.

“Schrems III” – What it’s specifically about

“Schrems III” refers to the looming third round of the dispute by Austrian data protection activist Max Schrems over the legality of data transfers between the EU and the USA, following the already successful lawsuits against Safe Harbor (Schrems I, 2015) and the Privacy Shield (Schrems II, 2020).

At the heart of the matter is the current EU-US Data Privacy Framework (DPF), the European Commission's third attempt to create a legally sound basis for transferring personal data of EU citizens to the US. Schrems' central objection remains unchanged: despite new terminology and cosmetic adjustments, the DPF does nothing to address the core problem that US intelligence agencies can still extensively access the data of EU citizens based on laws such as FISA Section 702 and Executive Order 12333, without this complying with the principle of proportionality enshrined in the EU Charter of Fundamental Rights.

The ombudsman mechanism as a weak point

Criticism has also been leveled at the legal protection mechanism for data subjects provided for in the DPF, consisting of a Civil Rights Officer (CLPO) and a newly created Data Protection Review Court. From the perspective of Schrems' organization, noyb, this body is not a truly independent judicial body, as it was established by presidential decree and could just as easily be abolished or modified without involving the US legislature.

The current trigger is 2026

The issue has gained renewed urgency due to a US Supreme Court ruling that restricts the independence of the Federal Trade Commission (FTC), which plays a crucial role in enforcing the Data Protection Fund (DPF). According to Schrems, personnel changes at the Privacy and Civil Liberties Oversight Board, which is responsible for oversight, further weaken the already fragile independence of the regulatory bodies.

Possible consequences for companies

Should the European Court of Justice overturn the Data Protection Fund (DPF), as it has its two predecessors, the underlying adequacy decision would become invalid with immediate effect, significantly hindering data exports to the US. This would particularly affect common US cloud and collaboration services such as Microsoft 365, Google Workspace, AWS, Salesforce, Slack, and Zoom, whose use would become even more questionable than it already is without a sound additional legal basis. This very uncertainty is one of the reasons why France, and increasingly Germany as well, are relying on their own European-controlled alternatives, as described in the previous analysis.

Between principle and pragmatism: Why open source must not be an ideology

However, it would be an oversimplification to reduce the debate to a simple comparison of good open-source and bad proprietary software. Open source is not an end in itself, and not every proprietary solution is automatically inferior or dangerous. Many proprietary products are technically mature, well-supported, and unrivaled in certain use cases. The crucial question is not whether software is open or closed, but who ultimately retains control over data, source code, and further development, and whether this control actually remains with the user in critical situations, such as geopolitical tensions or unilateral contract changes. This is precisely why the new approach in France, and increasingly in Brussels as well, formulates a principle that goes beyond mere preference: In future government IT procurement, open standards and open-source solutions should be the default, and anyone wishing to deviate from this must justify their deviation—not the other way around. This reversal of the burden of proof is the true structural core of the French initiative.

This way of thinking is also prevalent at the European level. In June 2026, the European Commission presented a package on European technological sovereignty, which, in addition to a revised Chips Act and a Cloud and AI Development Act, also includes a standalone EU Open Source Strategy that positions open source as a tool for reducing technological dependencies across the entire technology stack. For public procurement, one goal is particularly central: Public contracting authorities should explicitly act as anchor purchasers and co-creators in the open-source ecosystem, no longer merely as passive consumers of finished software products. Specifically, guidelines are planned to ensure a fair evaluation of open-source bids in procurement procedures, under the banner of an open-source-friendly tendering practice.

Our EU and German expertise in business development, sales and marketing - Image: Xpert.Digital

Industry focus areas: B2B, digitalization (from AI to XR), mechanical engineering, logistics, renewable energies and industry

More information here:

• Expert Business Hub

A thematic hub offering insights and expertise:

• Knowledge platform covering global and regional economies, innovation and industry-specific trends
• A collection of analyses, insights, and background information from our key areas of focus
• A place for expertise and information on current developments in business and technology
• A hub for companies seeking information on markets, digitalization, and industry innovations

Germany's interim situation: Movement within the system, but no system change

Germany is not entirely inactive in the face of this development, but the pace and commitment lag significantly behind the French model. In March 2026, the Federal Ministry for Digital Affairs and Transport and the digital association Bitkom agreed on standardized contract terms for the procurement of open-source software, the so-called EVB-IT Open Source. These new contract terms make open source the standard option when awarding software development contracts and eliminate legal uncertainties that have previously hampered the use of non-proprietary solutions in public administration. In addition, in April 2026, the Lower Saxony State Parliament passed a motion demanding that software developed on behalf of the state be fully transferred to public ownership so that the public sector can continue to develop the solution independently. This is a crucial step, because without this transfer of ownership, even self-financed software ultimately remains dependent on the respective contractor.

Furthermore, the law to accelerate the awarding of public contracts came into force on July 1, 2026. While its primary focus is on streamlining procedures and reducing bureaucracy, it also contains provisions relevant to digital sovereignty. If an information infrastructure is classified as security-relevant, public contracting authorities can now procure it directly and explicitly choose European or national providers without having to go through the usual, time-consuming tendering process. This is a pragmatic lever, but it only works if public administrations are willing to actively use it – which, given established procurement routines and the personal preferences of individual IT managers, is by no means a given.

At the European level, the Commission has presented the Cloud Sovereignty Framework, an assessment model that defines eight sovereignty objectives – from strategic integration within the EU and data sovereignty to sustainability – and combines these with five levels of security. This framework allows sovereignty to be integrated into procurement procedures not merely as a political buzzword, but as a quantifiable award criterion. For German contracting authorities, this offers practical starting points at four levels: in the specifications through requirements for data residency and source code disclosure; in the eligibility criteria through required security certifications; in the award criteria through the integration of a sovereignty score; and finally, in the principle of proportionality, according to which higher sovereignty requirements should only apply to genuinely security-critical use cases.

The criticism from trade associations: Between announcement and underfunding

Despite these on-paper advances, the Open Source Business Alliance has accused the German government of practically failing to deliver on key promises made in the coalition agreement regarding the promotion of open-source software. The association criticized the fact that, despite announced record investments in the federal budget, open source and digital sovereignty played virtually no role in the government's actual projects. This criticism was particularly evident in the case of the Center for Digital Sovereignty (ZenDiS), which, according to its own statements, required at least €30 million annually, but was actually budgeted with only around €2.6 million – a sum that, in the association's view, is simply too small to achieve the announced goals. The Alliance also saw untapped potential in the Public Procurement Acceleration Act, because a clear legal requirement in favor of open source as the standard option would have significantly strengthened the position of European IT providers, but this was missing from the actual legislation.

The Free Software Foundation Europe shares this assessment and demands that the German government guarantee secure, long-term funding for free software and its initiatives such as ZenDiS, and consistently prioritize free software in public procurement; otherwise, technological sovereignty will remain a mere declaration of intent. This accusation touches a raw nerve in German digital policy: The problem is rarely a lack of strategy papers, declarations of intent, or expert discussions, but rather a lack of consistent translation of these documents into budgetary resources, personnel, and binding procurement practices.

The Franco-German alternative: openDesk meets LaSuite

Parallel to the French Suite numérique, Germany is pursuing its own, structurally similar approach with openDesk. The Center for Digital Sovereignty, with a budget of approximately 45 million euros, has developed a suite that integrates existing open-source components such as Nextcloud for file storage, Collabora for office applications, Open-Xchange for email, Element for messaging, Jitsi for video conferencing, and OpenProject for project management. Around 80,000 workstations have already been migrated, including 60,000 teachers in Baden-Württemberg and the German Armed Forces under a multi-year contract with the IT service provider BWI. This demonstrates that a migration of significant scale is technically feasible, provided the political will and the necessary resources are available.

It is also noteworthy that Germany and France have been cooperating in a trilateral agreement since February 2024, which the Netherlands joined in December 2024. In joint, short-term development sprints, known as 100-Day Challenges, the relevant authorities of both countries are developing shared functionalities, such as a shared component for collaborative writing. This cooperation is strategically sound because it pools resources and prevents each country from building its own, comparatively small digital infrastructure that would be difficult to compete with the sheer size and financial strength of non-European providers. At the first EU summit on digital sovereignty in Berlin in November 2025, this European dimension was further emphasized, among other things, by the announcement of a European digital infrastructure consortium for digital commons.

There is also solid experience at the state level. Schleswig-Holstein has been conducting a comprehensive migration to open-source solutions since 2018 and, according to its own statements, has saved considerable licensing costs, partly by switching 40,000 email accounts from a proprietary platform to an open solution. Denmark has fully migrated to an open operating system and an open office suite by 2025. Both examples demonstrate that the transition is practically feasible, but in any case requires a multi-year transformation process with considerable effort for change management – ​​that is, for training, supporting, and motivating employees who have to give up their familiar tools.

Why the concept of sovereignty pays off economically

Digital sovereignty is often discussed in public debate primarily as a security policy or data protection issue, but its economic dimension is regularly underestimated. When a state pays billions annually for licenses to companies headquartered and subject to taxation outside Europe, this capital permanently drains from the European economic cycle instead of strengthening domestic software development, jobs, and innovation. Every euro invested instead in European open-source providers, system integrators, or publicly funded but openly accessible development projects tends to remain within the domestic or at least European economic area and can be reinvested, further developed, and exported. This economic circularity logic is a key, yet often overlooked, argument for a consistent open-source procurement policy that extends beyond the purely security-related debate.

Another aspect that is particularly relevant for medium-sized IT companies is this: a procurement practice that favors European or national providers and requires open standards opens up market access that would remain virtually closed if the focus were solely on established global software corporations. Smaller European providers can rarely compete with the marketing budgets, lobbying departments, and bundling strategies of the large platform companies – but they can compete with technical expertise, provided the procurement rules give them a fair chance. This is precisely the practical core of the principle of an open-source-friendly tendering practice being discussed in Brussels, a principle that is not only ideologically driven but also firmly motivated by economic policy.

The security policy reality: When software becomes a geopolitical weapon

The geopolitical situation of recent years has shown that technological dependencies can become tools of political pressure in a crisis. Sanctions, export controls, or sudden contract terminations are no longer purely hypothetical scenarios, but have become real instruments of international power politics. A state whose entire administration relies on a handful of non-European cloud and software platforms would be virtually paralyzed within days in the event of a targeted access block, because neither email communication nor document management nor many specialized applications would function. This vulnerability affects not only France or Germany, but practically every European state to a similar degree, and it explains why the sovereignty debate has evolved in recent years from a niche academic discussion to a central security policy issue.

This is precisely why France's commitment to systematically assess digital dependencies before even discussing their reduction is methodologically sound. You can't manage a risk you don't know, and many public administrations simply lack sufficient precision today to what extent individual applications, communication channels, or data repositories depend on specific non-European providers. A reliable inventory is therefore a necessary prerequisite for any serious sovereignty strategy, regardless of whether the end result is a complete migration or merely targeted risk diversification.

To put it bluntly: Will, budget, and procurement are what matter

Digital sovereignty is not achieved through strategy papers, but through concrete procurement decisions, adequately funded budgets, developed in-house expertise, and the political will to genuinely change entrenched administrative structures. With its binding deadline of 2030, the establishment of its own collaboration platform, and the systematic recording of digital dependencies, France has set a benchmark against which other European states must measure themselves. Germany has certainly made progress with its new contract terms for open-source procurement, the Public Procurement Acceleration Act, and its own openDesk project, but the ongoing criticism from industry associations regarding insufficient funding for key institutions like ZenDiS demonstrates that a significant gap remains between announcements and actual implementation.

The crucial question for the coming years is therefore not whether digital sovereignty is important – there is now broad consensus on that – but whether Germany and Europe are prepared to exchange short-term convenience and established supplier relationships for long-term strategic independence. The French approach shows that such a transformation is possible if one is willing to set binding deadlines, reverse procurement rules, and provide the necessary resources. With the Cloud Sovereignty Framework and the European Commission's new open-source strategy, Europe now also has the appropriate overarching instruments at its disposal. Whether these instruments are actually used consistently or disappear into drawers once again will become clear in future procurement decisions – not in further strategy papers.

☑️ Our business language is English or German

☑️ NEW: Correspondence in your native language!

Konrad Wolfenstein

I and my team are happy to be available to you as your personal advisor.

You can contact me by filling out the contact form here [email protected]:or simply call me at +49 7348 4088 965. My email address is

I'm looking forward to our joint project.

☑️ SME support in strategy, consulting, planning and implementation

☑️ Creation or realignment of the digital strategy and digitization

☑️ Expansion and optimization of international sales processes

☑️ Global & Digital B2B trading platforms

☑️ Pioneer Business Development / Marketing / PR / Trade Fairs

From visibility to trust: Your scalable path with Xpert.Digital - Image: Xpert.Digital

In industrial B2B, sustainable business relationships rarely emerge overnight. They develop step by step – through visibility, professional relevance, recurring touchpoints, and growing trust. Xpert.Digital's 4-stage model addresses precisely this: It offers a structured path that begins with a manageable entry point and can evolve into deeper collaboration in business development if needed.

Instead of relying on loud marketing promises, this model puts the relationship at the forefront. Companies start with clearly defined, easily calculable measures and then decide, based on their own experience, how far they want to expand the collaboration. A key factor for this undisturbed trust-building process: The platform completely avoids annoying advertising ads, so the editorial focus remains solely on the companies' expertise.

More information here:

• From visibility to trust: Your scalable path with Xpert.Digital