Digital sovereignty in Europe: definition, state of play and how to assess a vendor
.svg)
- Digital sovereignty is the capacity to decide and act in the digital domain: having the necessary competences, capacities and control (definition from the European Parliament study, December 2025).
- Europe is far from it: around 80% of European companies’ software and cloud spending goes to US vendors, and AWS, Microsoft Azure and Google Cloud hold around 70% of the EU cloud market.
- Server location is not enough: data stored in Europe by a provider subject to US law remains exposed to the CLOUD Act. What matters is who owns and who controls.
- Eight criteria let you assess a vendor, modelled on the European Commission’s sovereignty framework: strategy and ownership, applicable law, data, operations, supply chain, technology, security and compliance, environment.
- A sovereign organisation begins with a controlled structure: its roles, decisions and governance are data too, to be kept under European jurisdiction.
What is digital sovereignty?
According to the European Parliament study “European Software and Cyber Dependencies” (December 2025), digital sovereignty is the capacity to decide and act in the digital domain, that is, to have the necessary competences, capacities and control, without depending on a party subject to foreign law.
The study (section 4.1, p. 97) starts one level up. Sovereignty is “to be able to decide and act on the own future, in the economy, society and democracy”; digital sovereignty is the means to achieve it in the digital domain. EU texts also use the term digital strategic autonomy: it is the same notion.
This page is about the digital sovereignty of companies and organisations, not only of states. For a CIO in Brussels, Amsterdam or Luxembourg, the question is practical: which tools, under which law, and how easily can we leave them?
Digital sovereignty, data sovereignty, sovereign cloud: three notions
Data sovereignty and sovereign cloud are two components of digital sovereignty, not synonyms. The first is about data, the second about infrastructure; digital sovereignty covers the whole chain, from software to skills.
The three notions compared
| Notion | What it covers | The question to ask |
|---|---|---|
| NotionDigital sovereignty | What it coversThe whole chain: software, cloud, skills, decisions | The question to askCan we decide and act without depending on a party subject to foreign law? |
| NotionData sovereignty | What it coversWhere data sits, who can access it, which law applies | The question to askWho can access our data, and under which law? |
| NotionSovereign cloud | What it coversThe hosting infrastructure | The question to askAre the provider and the infrastructure European and under European jurisdiction? |
Mixing the three leads to a common mistake: choosing an EU data centre and calling the matter closed, while the software vendor, its parent company and its sub-processors have not been examined at all.
Where Europe stands: the figures from the European Parliament study
According to the European Parliament study, the EU’s digital sovereignty is “an aspiration rather than a reality”. Four figures, taken from the study and its “At a glance” summary (PE 780.413, December 2025), with the source the study gives:
- About 70% of the EU cloud market is held by AWS, Microsoft Azure and Google Cloud; the combined share of EU providers fell to roughly 13% by 2022 (Synergy Research Group).
- Around 80% of EU corporate spending on software and cloud flows to US vendors (Asterès study for Cigref, 2025).
- Roughly EUR 264 billion a year, around 1.5% of EU GDP, flows to foreign cloud and software vendors (Asterès for Cigref, 2025).
- Around 80% of core digital technologies are imported, according to the EuroStack initiative, cited by the study.
The study adds an estimate: retaining 15% of those outflows could create around 500,000 jobs in Europe by 2035 (Asterès for Cigref, 2025). The full study is available from the European Parliament: European Software and Cyber Dependencies (PDF).
What is at stake for a company
For a company, digital sovereignty comes down to four stakes: the law that applies to its data, the continuity of its tools, its ability to leave, and compliance.
Applicable law
The US CLOUD Act and FISA allow access to data stored in Europe by a US provider. The European Parliament study is explicit (p. 23): “Storing data locally does not guarantee immunity from extraterritorial requests.”
Continuity
The same page of the study notes that “the continuity of access to these services cannot be entirely guaranteed”: sanctions, a provider’s unilateral decisions, changed terms. A tool your daily work depends on is a tool whose interruption stops the work.
Reversibility
The study’s summary names three lock-in mechanisms: long contracts, proprietary formats and network effects. The question to ask before signing is simple: how do we get out, with which data, in which format, and how fast?
Compliance
The GDPR applies to everyone. The public sector and regulated industries add national frameworks, for example SecNumCloud in France (ANSSI) and C5 in Germany (BSI). For details, see what SecNumCloud qualification requires and our article on GDPR-compliant collaboration tools.
The “sovereignty-washing” trap
A server in Europe does not make a service sovereign if its provider remains subject to foreign law. The European Parliament study (chapter 4) puts it plainly: “ownership and control are what matter for jurisdiction, not the physical location of data”.
Local EU regions, onshore support and customer-held encryption keys reduce the risk, but they do not neutralise US jurisdiction. In the study’s words, “True sovereign cloud implies that both the provider and infrastructure are based in Europe and fully under European jurisdiction.” Some observers, cited by the study, call offers that claim sovereignty without meeting both conditions “sovereignty-washing”.
Digital sovereignty is judged by who owns and who controls, not only by where the servers are.
How to assess a vendor’s sovereignty: eight criteria
Assessing a vendor means checking eight points, from ownership to environmental footprint, not just the hosting location. The European Commission turned sovereignty into measurable criteria for its own cloud procurement: its Cloud Sovereignty Framework has 8 objectives, 48 criteria and five levels, SEAL-0 to SEAL-4. It was applied to a EUR 180 million contract awarded in April 2026, and the Commission “encourages all organisations, both public and private” to use it (Commission pages of 17/04/2026 and 01/06/2026). The grid below takes its eight objectives, phrased for buying software.
The eight-criterion assessment grid
| Criterion (Commission framework objective) | The question to ask the vendor | What counts as proof |
|---|---|---|
| Criterion (Commission framework objective)Strategic | The question to ask the vendorWho owns the company, where is it headquartered? | What counts as proofPublished ownership, headquarters in the EU or Switzerland |
| Criterion (Commission framework objective)Legal and jurisdictional | The question to ask the vendorWhich law applies, is the vendor subject to the CLOUD Act? | What counts as proofParent company and hosting provider outside non-European jurisdiction |
| Criterion (Commission framework objective)Data and AI | The question to ask the vendorWhere is the data, who accesses it, what happens to it with AI? | What counts as proofNamed hosting location, access policy, data processing agreement |
| Criterion (Commission framework objective)Operational | The question to ask the vendorWho runs and supports the service? | What counts as proofNamed operations and support teams, in Europe |
| Criterion (Commission framework objective)Supply chain | The question to ask the vendorWhich hosting provider and sub-processors does the service rely on? | What counts as proofPublished list of sub-processors |
| Criterion (Commission framework objective)Technology | The question to ask the vendorCan we leave, and in which formats? | What counts as proofData export, open formats, documented API |
| Criterion (Commission framework objective)Security and compliance | The question to ask the vendorWhich certifications, which audits? | What counts as proofISO 27001, SecNumCloud (France), C5 (Germany), GDPR |
| Criterion (Commission framework objective)Environment | The question to ask the vendorWhat footprint, what commitments? | What counts as proofData published by the vendor |
A vendor that meets all eight is rare. What matters is knowing which ones are missing, and why. “Not published” is an answer, not a detail: it tells you what the vendor is not ready to put in writing. For vendors assessed one by one, see our comparison of collaboration platforms hosted in Europe.
The grid applied to Talkspirit
Talkspirit publishes this page: here are its own answers, including what is missing. Every row comes from the public pages of talkspirit.com (about pages, legal notice, terms of sale, privacy policy), reread on 14/10/2026. This is not a comparison: no other vendor appears in this table.
Talkspirit’s answers, criterion by criterion
| Criterion | Talkspirit’s answer | Source (reread on 14/10/2026) |
|---|---|---|
| CriterionStrategic | Talkspirit’s answerTalkspirit SAS, headquartered in Paris (60 rue François 1er); “over 20 years of independence” | Source (reread on 14/10/2026)Legal notice; About Talkspirit page |
| CriterionLegal and jurisdictional | Talkspirit’s answerCompany under French law; “beyond the reach of the US Cloud Act” | Source (reread on 14/10/2026)Legal notice; home page and About page |
| CriterionData and AI | Talkspirit’s answerHosted in France and Switzerland; Talkspirit acts as processor under the GDPR, the client organisation remains controller. Use of data by AI: not published on the pages reread | Source (reread on 14/10/2026)About page; terms of sale, section 4.2 |
| CriterionOperational | Talkspirit’s answer“Dedicated security team: in-house security expertise and responsive support”; “built, hosted, and operated in Europe”. Location of support teams: not published | Source (reread on 14/10/2026)About page |
| CriterionSupply chain | Talkspirit’s answerOnly named sub-processor: OVH (Roubaix, France). The Swiss host is not named. Published limitation: the site’s privacy policy states that some of the website’s technical providers (support, email routing) are located in the United States, under standard contractual clauses | Source (reread on 14/10/2026)Terms of sale, section 4.2.4; legal notice; privacy policy |
| CriterionTechnology | Talkspirit’s answerRight to export hosted data at any time during the contract, except private chat messages; at the end of the contract, return within seven days or deletion, at the client’s choice notified fifteen days before the end. Export formats and API: not published on the pages reread | Source (reread on 14/10/2026)Terms of sale, section 4.2.1 |
| CriterionSecurity and compliance | Talkspirit’s answerISO 27001:2022 certified; GDPR; regular audits; no SecNumCloud qualification | Source (reread on 14/10/2026)About page; About Talkspirit page |
| CriterionEnvironment | Talkspirit’s answerNot published on the pages reread | Source (reread on 14/10/2026)None |
Three criteria have a complete, sourced answer; five carry a gap written in black and white. That is the exercise the grid asks of every vendor, and Talkspirit does it first. The hosting and certification evidence is set out on the page hosted in France and Switzerland.
A sovereign organisation begins with its structure
Digital sovereignty is not only about infrastructure: an organisation’s roles, decisions and governance are data too. An organisation that describes its roles, circles and decisions in a tool subject to foreign law hands over the very picture of how it works.
A sovereign organisation begins with a controlled structure. That is the idea behind Talkspirit: “Your data, your decisions, and your governance remain under European jurisdiction.” The Structure module makes explicit who holds which role and who decides what, in a system hosted in France and Switzerland.
CEA, a public research organisation of more than 10,000 people across nine research centres in France, has used Talkspirit since 2020. Céline Massy, Deputy CIO and Digital Transformation Architect: “We needed an easy-to-use, ergonomic collaboration suite that met our security constraints and was GDPR-compliant. Talkspirit checked every box!” See how CEA collaborates under high security, or, closer to Benelux, the story of Great Place to Work Netherlands.
Further reading
- The leader’s guide to digital sovereignty in Europe (white paper to download)
- Collaboration platforms hosted in Europe
- GDPR-compliant collaboration tools hosted in the EU
- What SecNumCloud qualification requires
- Digital sovereignty for local government
Not a tool. Your Organisation’s Operating System.
FAQ
The capacity to decide and act in the digital domain, with the necessary competences, capacities and control. This is the definition in the European Parliament study of December 2025. For a company, it means controlling the law that applies to its data and its tools.
Data sovereignty is one component of it: it covers where data sits, who can access it and which law applies. Digital sovereignty covers the whole chain: software, cloud, skills and decisions.
Not necessarily: a provider subject to US law can be compelled to hand it over, wherever it is stored. The European Parliament study writes that local storage does not guarantee immunity. This is why Talkspirit, a company under French law hosted in France and Switzerland, sits beyond the reach of the US Cloud Act.
By checking eight criteria: ownership, applicable law, data, operations, supply chain, technology, security and compliance, environment. These are the eight objectives of the sovereignty framework the European Commission published for its own cloud procurement. Talkspirit publishes its own answers in this article.
No: Talkspirit does not hold a SecNumCloud qualification. Talkspirit is ISO 27001:2022 certified and GDPR compliant, and its data is hosted in France and Switzerland.
Because an organisation’s roles, decisions and governance are sensitive data. In Talkspirit, the organisation’s structure and its decisions stay under European jurisdiction, just like its conversations.
