When I talk about digital sovereignty with a South Tyrolean entrepreneur, the first reaction is almost always the same: a polite smile and “that is for the big players, we are an SME.” Then I ask: “If tomorrow your e-mail and cloud document provider suspended its service for a week, what would happen?” The smile disappears.
For a small or medium-sized company, digital sovereignty is not geopolitics. It is a very concrete question: who does our company depend on, and did we choose that dependency?
What has actually been decided (and what has not)
On 3 June 2026 the European Commission presented the Tech Sovereignty Package. I put it precisely, because I often hear that it is “already in force”: it is not. The package contains two legislative proposals, the Cloud and AI Development Act (CADA) and the Chips Act 2.0, and two non-legislative initiatives, the open source strategy and a roadmap for digitalisation and AI in the energy sector. According to the European Parliament’s Legislative Train (updated 20 September 2026), the proposals are still under examination by Parliament and Council.
For anyone dealing with cloud, the heart of it is CADA. According to an analysis by an international law firm (Covington), the Commission starts from two findings: Europe’s data-centre capacity deficit and its dependence on a few non-EU cloud providers. In its explanatory notes the Commission states that the market share of EU-based providers fell from about 29% in 2017 to about 15% in 2022. And the open source strategy recalls that the EU spends about 264 billion euro a year on US proprietary IT products and services.
CADA proposes a cloud sovereignty framework with four Union assurance levels. In short:
Level 1 (the minimum, required of almost all cloud providers serving the public sector): infrastructure, assets and customer data in the EU; providers controlled from a third country must guarantee that they are not required to report unexploited vulnerabilities to public authorities of that country.
Level 2: personnel, infrastructure and assets in the EU, European cloud certification, measures against third-country access to customer data and clear separation between an EU parent and non-EU subsidiaries.
Level 3: provider owned and controlled in the EU, with very narrow derogations. Level 4: the strictest, with no derogations, with a “high” level certification and effective provider control over all software.
Important: these levels would apply first of all to providers serving public administration. But the text also provides that “essential” entities under NIS2 may carry out similar assessments of their own cloud providers, and the Commission could make them mandatory for certain sectors in future.
What does this mean for a South Tyrolean SME? Today no direct obligation. But, and this is what I stress to my clients, your larger customers, those subject to NIS2, those in energy, healthcare or transport, will start asking you questions: where is my data when I entrust it to you? Who controls the provider you use?
My opinion: sovereignty is not “buying European”
Here I have to say something some will not like. European does not automatically mean safe, and American does not automatically mean dangerous. Sovereignty is a matter of choice and control, not of flags. Two cases show it better than any slide.
July 2024: CrowdStrike. A faulty update from a security vendor crashed, according to Microsoft’s estimate, about 8.5 million Windows devices worldwide, less than 1% of all Windows machines. Companies, airports and hospitals stood still for hours. There was no attack: there was a dependency on a single supplier, with an automatic update that nobody could stop. The issue here is not the supplier’s nationality: it is what happens when one link in the chain breaks.
March 2021: OVHcloud, Strasbourg. A fire destroyed the SBG2 data centre of one of Europe’s largest cloud providers. According to the trade press, some customers had paid for backup too, but the copies were in the same building as the live servers and were lost with them. A French commercial court later ordered the provider to compensate two customers. It was a European provider, with data in Europe, under European law. Yet for those customers sovereignty was not enough: resilience was missing.
Sovereignty is the consequence of orderly management of dependencies. Not the other way round.
What this means here
In South Tyrol the economy consists of family businesses with cross-border supply chains, bilingual markets and customers in Germany, Austria and Switzerland. That is a strength. But it also means the question “who do we depend on?” often has three or four layers: the management software of an Italian supplier that runs on the cloud of an American provider, managed by an external IT support firm, connected to the platform of a German customer.
I describe a typical situation, not a client case: a manufacturing company uses cloud management software. The owner thinks the data are “in Italy”. In reality the software is Italian, the infrastructure belongs to a large non-EU provider, support comes from an outside firm with remote access, and the backups are in the same environment as the data. When I ask “what happens if you cannot log in for a week?”, nobody can answer. Not because they are careless: because nobody has ever put the question to them in an understandable way.
My advice: five steps, without buying anything
Make a dependency map, on one page
List the ten services without which the company stops: management software, e-mail, files, telephony, banking, support, logistics. For each, note who the supplier is, where the data are, who manages them, and what happens if it stops for a day and for a week.
Identify the truly critical data
Not the whole infrastructure: the data that would cause serious damage if lost or exposed (customer data, drawings, prices, contracts). Those are the ones for which it is worth asking under which jurisdiction they sit.
Ask suppliers for three things in writing
Where the data and the backup are physically located. Who has access, including remotely. What happens to the data if the contract ends. A serious supplier answers within an hour. If it does not, you have already learned something.
Test restoring, not just backing up
After OVH the lesson is one: a backup in the same place as the data is not a backup. At least one copy must be elsewhere, and it must be test-restored at least once a year.
Prepare an “exit route”
You do not need to change supplier: you need to know how it would be done. How long, how much, which data are exported and in what format. Those with an exit route negotiate better and sleep better.
What I do not recommend: buying services with a “sovereign” label without asking what it means, concretely, for your data. A label is not a control. And with CADA under discussion, the assurance levels may still change.
There is an operational point that links this topic to NIS2: ACN’s FAQ explain that, for NIS entities, security requirements in contracts with suppliers that may affect security must be included in contracts concluded, renewed or extended from the deadline for adopting the baseline measures. There is no need to rewrite everything now, but renewals are the right moment to introduce the clauses.
What I think, in conclusion
The European package is an opportunity, but it does not ask you to do anything today. It asks something more useful: to know. Companies that in the coming months have a clear map of their dependencies will be able to answer calmly when an important customer, or an authority, asks the question. The others will answer in a hurry, and badly.
In South Tyrol we are used to thinking long term: we cultivate trust, not haste. Let us apply that to digital too. For an SME, sovereignty simply means being able to say: we chose this dependency.
Sovereignty does not mean depending on no one. It means knowing whom we depend on and having chosen to.
Three questions for management
Where are our most critical data, and under which jurisdiction?
Not the whole infrastructure: the most critical data. Customer data, process data, supply chain information.
What happens to our business if a supplier we depend on stops for a week?
These are not theoretical scenarios: they have already happened.
Did we choose this situation consciously, or did we simply find ourselves in it?
This is the central point. Sovereignty means having made a choice. Not having inherited a situation.
Sources
European Commission, Commission proposes tech sovereignty package (3 June 2026); Covington, The EU Cloud and AI Development Act in Depth (11 June 2026); European Parliament, Legislative Train Schedule, Cloud and AI development act (updated 20 September 2026); Microsoft, Helping our customers through the CrowdStrike outage (20 July 2024); Blocks & Files, OVHcloud must pay damages for lost backup data (23 March 2023); ACN, NIS FAQ, security measures (MSB.12, in Italian).