In the summer of 2026, German digital policy picked up a pace not seen for years: a joint Franco-German definition of digital sovereignty in June, closer cooperation on AI in July, a cabinet decision on cybersecurity days later. For mid-sized companies this raises a very practical question that no press release answers: which part of this should actually change what you do — and which part is location policy?
This article is an in-depth expert contribution from our content cluster. Discover the complete overview on our main page:Services & Consulting →
- Sovereignty is a policy term with an operational translation: Germany and France presented a joint definition in June 2026 and agreed closer cooperation on AI in July. For a company this does not produce a list of prohibitions but a requirement to be able to switch.
- Reversibility beats migration: A full move to European infrastructure is neither necessary nor economical for most mid-sized firms. A demonstrable ability to switch within a defined period delivers the same protection at a fraction of the cost.
- Four checks are enough: Storage location, export format, exit clause, tested recovery path. Answering those four per system settles the bulk of the sovereignty question for your organisation.
Sovereign is not the one with no dependencies
Sovereign is the one who knows their dependencies and can end them. The difference between those two sentences decides whether digital sovereignty becomes a seven-figure programme or a contract amendment.
1. What was decided in the summer of 2026
The German government frames its reorientation openly in geopolitical terms: technological dependencies count as a strategic risk, with cloud services, network technology and operating systems among the areas concerned. Three events from the summer of 2026 mark the current state.
Germany and France agree a common approach. The summit is the starting point for the concrete steps of the following year and anchors sovereignty as a European rather than a national project.
Both countries present a shared definition of digital sovereignty. That sounds academic but matters in practice: definitions migrate into procurement policies, and procurement policies migrate into tenders.
At the Franco-German Council of Ministers, Federal Digital Minister Karsten Wildberger and his French counterpart Anne Le Hénanff agree closer cooperation on artificial intelligence and digital sovereignty.
The federal cabinet adopts a new programme to strengthen cybersecurity in Germany, explicitly responding to the tense threat landscape.
Alongside this, the consultation process on the Germany-Stack has been running since October 2025, aiming to develop shared standards for public sector digitalisation. Institutionally it is flanked by the Centre for Digital Sovereignty founded in December 2022 and the German Administration Cloud from July 2023.
For mid-sized companies the chain of effect is indirect but reliable: what becomes a requirement in public procurement shows up two to four years later in the supplier questionnaires of large corporates. Anyone supplying public bodies or their suppliers is well advised to know the vocabulary before it appears in a tender.
The context in which this policy emerges is also worth noting. Germany appeared as partner country at VivaTech in Paris in June 2026, and in August the digital ministry launched a participation process on the further development of its strategic framework for open data. Both point in one direction: sovereignty is understood as European cooperation and investment in key technologies, not as isolation. Reading the debate as a call to withdraw from international platforms misreads it.
That nuance matters operationally because it widens the room for manoeuvre. The question is not whether a German company may use American software — it is whether the company knows what happens when it can no longer, or no longer wants to. That is a matter of preparation rather than conviction, and it can be settled with the means every company already has: contracts, documentation and one test appointment.
2. The three layers of dependency
The sovereignty debate suffers from very different matters being negotiated under one word. For an operational assessment it helps to separate three layers, which differ considerably in how hard they are to resolve.
Data storage and jurisdiction
Where does data physically sit, and which law governs the operator? The CLOUD Act can oblige US providers to disclose data even when servers stand in Europe. This layer is legally complex but technically the easiest to address — through provider choice or encryption with your own key custody.
Technical entanglement
How deeply is the application woven into proprietary platform services? A container on managed infrastructure is portable; an application built from twelve platform-specific services is not. This layer accrues gradually and is the most expensive to unwind.
Capability and operations
Can your team or your provider actually run the alternative? Sovereignty that rests entirely on one external partner merely relocates the dependency. This layer is almost always overlooked in strategy papers.
Switching cost
The three layers converge on one number: what does switching cost, and how long does it take? As long as that number is unknown, every statement about sovereignty is a guess. It becomes known through a test, not through an estimate.
3. Why the full move is rarely the answer
The obvious response to the political debate would be a move to European infrastructure. For some use cases that is right; as a blanket strategy it is generally neither affordable nor necessary for mid-sized firms.
Comparison: full migration vs. reversibility strategy
- Effort: Very high one-off cost, tying up for months exactly the people who also run daily operations.
- Benefit: Resolves layer 1 completely, layer 2 only if decoupling happens at the same time.
- Risk: The new provider creates the same entanglement within two years.
- Economics: Pays off mainly when modernisation is due anyway.
- Effort: Distributed, largely contractual and architectural, without operational disruption.
- Benefit: Addresses layer 2 permanently and keeps layer 1 executable at any time.
- Risk: Becomes an assertion without a test — which is why a trial run is part of it.
- Economics: Considerably cheaper and additionally a lever in price negotiations.
The second point in the right-hand column is the economically most interesting one. A company that knows and can evidence its switching effort negotiates differently at every renewal. Reversibility is therefore not purely a risk measure but a pricing instrument.
4. The four checks per system
Four questions per system are enough for the assessment. They fit in a spreadsheet and together produce a realistic picture — considerably faster than any strategy paper.
Region, operator, applicable law, and who holds the keys. For managed services this includes where backups and log data live — they do not always follow the primary region.
A complete export in an open, documented format is the baseline. A proprietary backup format only the platform itself can read is not an export.
Deadline, scope, cost and proof of deletion. Without an Exit Clause, switching is formally possible and practically expensive — which is exactly where the binding effect of many contracts comes from.
One full export followed by a trial import into a test environment. Only that test turns a contractual promise into a dependable capability — and produces the number for your switching window.
Expert tip: put the export test on an annual cycle
Book one date a year for a full export of your two most important systems, including a trial import. The effort is typically one day; the result is a defensible number for your switching window. In several projects this test alone exposed gaps that the contract had described differently — missing attachments, truncated histories, configurations that could not be exported at all.
A common objection is that mid-sized firms have no time for any of this. That is true of a full migration and untrue of the four checks. The system list takes half a day because the information already exists — it simply sits in four different folders. The only item with genuine time requirement is the export test, and it can be scheduled on one of the quieter days of the year.
A side effect is worth having too, and we see it in nearly every project: the system list regularly surfaces services nobody uses any more but which are still being paid for. In several cases the assessment recovered its own cost purely through cancelled legacy contracts. Sovereignty starts, in other words, as plain visibility — and visibility has never been a cost factor.
5. What belongs in the contract
The most effective part of a sovereignty strategy sits not in the architecture diagram but in the contract. Five points are worth negotiating, and none of them is unusual enough to scare off a provider.
Data return with deadline and format. Complete export in a documented format within a named period after contract end, at costs agreed in advance. Without a stated cost the commitment is worthless.
Sub-processors and locations. A list of sub-processors with registered office and processing location, plus a duty to notify changes. This is required under data protection law anyway and still rarely maintained.
Key custody. Where possible, encryption with your own keys managed outside the platform. That defuses layer 1 regardless of where the servers stand.
Continuity in a crisis. Provisions for insolvency, acquisition or discontinuation of the service, including access to data and, where sensible, escrow of source code or configurations.
Price adjustment mechanics. Caps and notice periods for price increases. Without the ability to switch, every price round is a one-sided negotiation; with it, a two-sided one.
Interoperability is a further consideration. The European legal framework has been moving towards easier provider switching for some time — provisions on data access and portability form part of the ongoing simplification package, whose data half was still with Parliament in the summer of 2026. For companies this means that what is a matter of negotiation today may be a statutory minimum in a few years. Asking for those clauses now leaves nothing to catch up on later. We set out the state of the procedure in Digital Omnibus.
In practice it works better to formulate these clauses not as a special request but as a standard annex to your own purchasing terms. Providers respond far more calmly to a supplied text block than to a free-form discussion, and internal enforcement becomes easier because nobody has to re-argue the case contract by contract.
6. Where sovereignty really is mandatory
There are situations where reversibility is not enough and data genuinely has to sit inside your own jurisdiction. These cases are rarer than the debate suggests, but they are real.
Professional confidentiality
Client, patient and comparable data subject to special duties of confidentiality. Here it is not residual risk that counts but the legal position — which sometimes demands explicit commitments on processing location and access.
Design and process data
Core trade secrets with decades of competitive relevance. They are also the classic case for post-quantum consideration, which we described in The Crypto Inventory.
Public sector clients
Where tender documents set requirements on processing location or operator jurisdiction, the question is settled. It pays to look early at the documents of comparable tenders from the previous year.
AI processing of sensitive holdings
Once internal documents pass through a model, knowledge leaves the building in condensed form. For sensitive holdings, local operation is the cleaner answer — details in On-Premise AI in the DACH Region.
For everything else the pragmatic route is a graduated answer. Sensitive holdings local or under your own key custody, the rest wherever it runs most economically — combined with a demonstrated ability to change that at any time.
7. Implementation in five steps
-
Step 1: system list with the four checks
Every production system with storage location, export format, exit clause and test status. A five-column spreadsheet suffices; the insight lies in the empty cells.
-
Step 2: classify your data holdings
Three tiers are enough: open, confidential, especially sensitive. Only the third tier justifies the expensive answers — and in most organisations it covers less than ten per cent of the estate.
-
Step 3: export test for the two most important systems
Full export with trial import into a test environment, with time and completeness logged. The result is the dependable figure for your switching window and the basis for every further decision.
-
Step 4: amend contracts at the next renewal
Bring the five points from chapter 5 into upcoming renewals. Timing is decisive: renegotiating mid-term rarely succeeds, at renewal almost always.
-
Step 5: decouple during the next modernisation
Do not launch migration projects of their own; use planned modernisations to reduce platform-specific dependencies. Reversibility then emerges without a dedicated budget.
A note on sequence to close. We regularly see companies wanting to start with step 5 because it is technically the most interesting. That is understandable and usually wasted effort: without the system list from step 1 you decouple the wrong system, and without the export test from step 3 you have no yardstick for whether the decoupling achieved anything. Doing the unspectacular steps first saves measurable budget here.
The political debate asks where the servers stand. The operational question is how long it takes to leave them. Only the second question has an answer a company controls itself.
Quick check: your ability to switch
Conclusion
Digital policy in the summer of 2026 sharpened a term that had long been vague. For companies the most important insight is not the definition itself but the route by which it arrives: through procurement policies, tenders and supplier requirements — not through a law forbidding anyone anything.
Turning that into a migration programme is over-investment. Turning it into nothing at all means being reminded of it at the next tender or the next price round. The middle path is the commercially sensible one: know your dependencies, evidence your ability to switch, treat sensitive holdings separately.
Getting started costs less than the debate suggests. A four-column spreadsheet, one export test in a day, and five sentences in your next contract renewal. With that, a mid-sized company stands better on this question than most of its competition — and demonstrably so, which is what makes the difference in a tender.
Do you have questions about the digital sovereignty of your IT?
Book a free initial consultationOur Regional Expertise
We are your digital partner – regionally anchored and successfully scaling across borders.
Have a vision?
Let's check together how we can make your idea take flight.
Book your free strategy call nowExtended Specialized Glossary
Reversibility
The ability to undo a technology decision at reasonable cost. In the cloud it is measured by how quickly and completely data and processes can be moved to another provider or into your own infrastructure.
CLOUD Act
A 2018 US law that can oblige US providers to hand over data even when it is stored on servers outside the United States. It sits at the core of the sovereignty debate about data centre locations.
Germany-Stack
A federal initiative to develop shared standards and building blocks for public sector digitalisation. Its consultation process started in October 2025.
Exit Clause
A contractual provision defining scope, format, deadline and cost of data return at the end of a contract. Without one, changing provider remains technically possible but is often commercially unattractive.
Sovereign Cloud
A cloud offering in which operation, data storage and legal control sit inside a defined jurisdiction. The term is not protected, so the specific contractual commitments matter rather than the label.
