On June 3, 2026, the European Commission unveiled its European Technological Sovereignty Package in Brussels. Commission President Ursula Von der Leyen did not mince her words when introducing the new measures.
“We cannot afford to depend on others for the technologies that keep our hospitals running, our energy grids stable and our services secure,” she said. “This is about protecting our citizens, defending our interests and making our own choices.”
The rhetoric was stark, but so were the numbers behind it: the EU now relies on suppliers outside its borders for more than 80% of its key digital products, services, infrastructure, and intellectual property. The package is a genuine shift, both in what it introduces—including a new Chips Act, a Cloud and AI Development Act, and a full Open Source Strategy—and in the level at which it treats the problem, casting digital dependence as a question of strategic security and self-determination rather than something that can be left to procurement teams.
But this logic doesn’t stop at national borders. The same dependence reproduces itself anywhere an organization runs on technology it does not own and cannot readily leave; a company built on infrastructure, models, and platforms it has no way to exit is in much the same position as a continent that is reliant on foreign suppliers, only at a smaller scale. Which raises the real question: If this sort of dependence is a strategic risk that can threaten even a continental-scale political union, why are so many companies doing so little to protect their own sovereignty?
{“blockType”:”mv-promo-block”,”data”:{“imageDesktopUrl”:”https://images.fastcompany.com/image/upload/f_webp,q_auto,c_fit/wp-cms-2/2025/10/creator-faisalhoque.png”,”imageMobileUrl”:”https://images.fastcompany.com/image/upload/f_webp,q_auto,c_fit/wp-cms-2/2025/10/faisal-hoque.png”,”eyebrow”:””,”headline”:”Ready to thrive at the intersection of business, technology, and humanity? “,”dek”:”Faisal Hoque’s books, podcast, and his companies give leaders the frameworks and platforms to align purpose, people, process, and tech—turning disruption into meaningful, lasting progress.”,”subhed”:””,”description”:””,”ctaText”:”Learn More”,”ctaUrl”:”https://faisalhoque.com”,”theme”:{“bg”:”#02263c”,”text”:”#ffffff”,”eyebrow”:”#9aa2aa”,”subhed”:”#ffffff”,”buttonBg”:”#ffffff”,”buttonHoverBg”:”#3b3f46″,”buttonText”:”#000000″},”imageDesktopId”:91420512,”imageMobileId”:91420514,”shareable”:false,”slug”:””,”wpCssClasses”:””}}
Acknowledgment without action
In a recent survey conducted by enterprise software firm SUSE, IT leaders in 98% of organizations called digital sovereignty a priority—but only 52% reported taking any action on it. More revealing still is that when companies do move, it is rarely the principle of maintaining sovereignty that sets them into motion. Instead, they start addressing issues around sovereignty in a reactive way when they are forced to by circumstances.
This pattern tends to take one of two forms. Sometimes, the cost of ignoring sovereignty surfaces from within. The financial services sector, for example, became a heavy investor in open source technologies after years of steadily increasing IT bills that were the result of firms finding themselves locked into relationships with vendors with no easy route out. More often, though, the pressure arrives from outside—sometimes as a result of regulatory pressure but more often because important customers set their own sovereignty demands and those requirements ripple across the marketplace.
Reacting under time pressure is usually the least effective way to address any problem, and the most expensive—in organizational disruption as much as in money. A company that moves early can choose its own timing, survey the full range of options, and pick the ones that fit it best. A company forced to move on someone else’s schedule has less leverage, less optionality, and higher costs to bear in making the shift. Freedom of this kind is never free—but it is far cheaper bought now than paid for under duress later.
What sovereignty actually means
Before a company can develop a strategy for securing its sovereignty, it first needs to gain clarity on what sovereignty actually means—and that is easier said than done. The term comes laden with many meanings, and the potential for confusion is increased by the fact that vendors tend to locate sovereignty in whatever it is they happen to be selling at the time. For some, the essence of sovereignty lies in control over data. For others, it is in who runs your infrastructure or programs your software. But the truth is, sovereignty is not a feature you can simply purchase. In fact, at its highest level, it is not a property of a product at all. It rests instead with the user: in the capacity to understand what a system is doing, to govern it, and to change course when circumstances demand. A product that looks sovereign today may not be sovereign tomorrow—what endures is whether the organization can still make and revise its own choices.
This is why the real goal is best understood as adaptability—the ability to change your mind, drop a vendor or product, or change strategic direction with a minimum of friction. Open source software offers one powerful tool for securing some of these goals, but it is neither sufficient nor necessary for building a sovereign enterprise. It is not sufficient, because an organization can run an entirely open-source stack and still be trapped if it lacks the skills to manage that stack or migrate it. And not necessary, because a company can build a genuinely sovereign posture on proprietary foundations through hard-won contract terms, guaranteed exit rights, portability designed in from the start, and deliberate multi-sourcing—though each of these carries real cost and fragility.
AI as an amplifier
Artificial intelligence raises the stakes for every dimension of enterprise sovereignty, because the dependencies it creates have the potential to run deeper than those created by other types of tech. An AI model’s behavior is not written in code that can be read and edited; it is trained into the model’s weights. Operating or licensing a model therefore confers far less authority over how it actually behaves than using a piece of software once did.
That difficulty compounds as the technology moves inward. A conventional tool sits in a workflow you can isolate and, with enough cost and effort, replace. AI rarely stays there. It works its way into how an organization analyzes, weighs options, and decides. This is a deeper kind of lock-in than the contractual sort: beyond the possible costs of an exit, it has the potential to erode the capacity to judge whether exit is warranted at all. The faculty a company would use to assess its dependence is the very thing the dependence begins to absorb.
Yet most organizations are leaning into that dependence, not guarding against it. The pull of AI adoption is strong enough that when extra budget becomes available, it tends to go toward implementing new AI capabilities rather than managing the dependencies that the existing capabilities already create. The gap between recognizing the risk and acting on it is not closing as the technology advances. It is widening—and widening fastest exactly where the stakes are highest.
Four ways to act before you are forced to
The gap will not close by itself, but it is not hard to start moving in the right direction.
1. Map what you cannot easily leave. Sovereignty begins with an honest inventory of dependence. Which systems, models, and providers are so woven into your operations that leaving would be slow, expensive, or impossible? You cannot manage an exposure you have never identified.
2. Make exit a design requirement, not an afterthought. The time to secure the ability to leave is before you commit, not when you need to get out. Build exit planning into contracts and architecture from the start—guaranteed exit rights, data portability, the avoidance of single points of dependence—and treat the absence of an exit as a cost, even when the system in front of you works beautifully today.
3. Invest in the capacity to judge, not just the tools to run. Sovereignty rests with the user, which means it depends on people who can evaluate what a system does, weigh alternatives, and operate what they own. Outsource that judgment entirely and you are dependent no matter what your contracts say. This is the capability that survives any particular vendor or product.
4. Treat AI dependence as different in kind. You cannot read a model’s values off its source code the way you once could with software, because its behavior is trained in, not written down. That makes the choice of model a governance decision, not merely a technical one—to be interrogated before deployment, when you still have leverage, rather than discovered afterward.
The work falls to leaders
Europe’s Technological Sovereignty Package is a reminder that technological dependence has become a question of self-determination. But it is also a reminder of how much the regulation leaves undone. The resources committed come nowhere near the scale of the problem named, and for most companies the binding rules will never apply at all. The bulk of the work, in other words, falls to business leaders, not lawmakers.
{“blockType”:”mv-promo-block”,”data”:{“imageDesktopUrl”:”https://images.fastcompany.com/image/upload/f_webp,q_auto,c_fit/wp-cms-2/2025/10/creator-faisalhoque.png”,”imageMobileUrl”:”https://images.fastcompany.com/image/upload/f_webp,q_auto,c_fit/wp-cms-2/2025/10/faisal-hoque.png”,”eyebrow”:””,”headline”:”Ready to thrive at the intersection of business, technology, and humanity? “,”dek”:”Faisal Hoque’s books, podcast, and his companies give leaders the frameworks and platforms to align purpose, people, process, and tech—turning disruption into meaningful, lasting progress.”,”subhed”:””,”description”:””,”ctaText”:”Learn More”,”ctaUrl”:”https://faisalhoque.com”,”theme”:{“bg”:”#02263c”,”text”:”#ffffff”,”eyebrow”:”#9aa2aa”,”subhed”:”#ffffff”,”buttonBg”:”#ffffff”,”buttonHoverBg”:”#3b3f46″,”buttonText”:”#000000″},”imageDesktopId”:91420512,”imageMobileId”:91420514,”shareable”:false,”slug”:””,”wpCssClasses”:””}}
Source link