Series: "Digital Sovereignty in Practice" Part 1 of 3

C5, C3A, EU CSF, SEAL, SecNumCloud, EUCS, CADA, IRN: In a short space of time, more acronyms have emerged around digital sovereignty than even specialists can immediately categorise. In this three-part series, we provide an overview. Part 1 demonstrates why the topic is pressing right now, why sovereignty cannot be the goal at all costs, and which four questions help clear a path through the jungle.

On 10 June 2025, Anton Carniaux, Director of Public Affairs and Legal at Microsoft France, testified under oath before an inquiry committee of the French Senate examining public procurement. The rapporteur wanted to know whether Microsoft could guarantee that data belonging to French citizens would never be disclosed upon order of the US government without France's explicit consent.

He added that such a case had not yet occurred. The statement remains remarkable nonetheless, as it openly describes the applicable legal position: since the US CLOUD Act of 2018, American providers must disclose data upon official request, “regardless of whether it is located within or outside the United States”². A data centre in Frankfurt does little to change this, as long as the parent company remains subject to US law.

A second example from spring 2025 concerns the International Criminal Court in The Hague. Its Chief Prosecutor, Karim Khan, was placed on a US sanctions list in February 2025.³ In May, the news agency AP reported that his Microsoft mailbox had been deactivated and that he had had to switch to Proton Mail. Microsoft clarified that it had never suspended services for the Court as a whole, but had merely disconnected the sanctioned official.⁴

Regardless of the details, both cases demonstrate that the decisive question has shifted. Previously, it was: Where is my data stored? Today, it is: Who can flip the switch?

The case had a sequel: in October 2025, Handelsblatt⁵ reported that the Criminal Court was transitioning its office software to openDesk, an open-source suite backed by the Centre for Digital Sovereignty of the German Federal Government (Zentrum für Digitale Souveränität des Bundes). An international court that had just experienced dependence on a US corporation in very concrete terms was thus turning, of all things, to a solution from the German public administration.

The obvious reaction would be to bring everything back in-house. That falls short. Microsoft 365, the clouds of AWS, Microsoft and Google, AI assistants such as ChatGPT or Copilot: without these technologies, hardly any business remains competitive. Yet with them arise dependencies that must be actively managed.

The Dilemma of Modern Technologies

Modern technologies are indispensable for competitiveness, but create dependencies that can become critical.

Digital sovereignty therefore does not mean renouncing everything that does not come from Europe. What is meant is the ability to make technological decisions autonomously and to manage critical dependencies: regarding data, operations, and the technology itself. Each of these dimensions comes at a price: greater sovereignty usually costs money, increases complexity, and often reduces innovative power.

The goal is therefore not maximum sovereignty, but the right balance between independence and technical excellence, and this may differ for every use case.

To determine this balance, numerous frameworks have emerged in a short space of time: EU CSF, C3A, CADA, and IRN, alongside established standards such as C5 in Germany and SecNumCloud in France, as well as the EU certificate EUCS, which has been under negotiation for years. Anyone looking to engage with the topic now faces an alphabet soup in which every acronym promises to make sovereignty tangible. That is precisely where the first misunderstanding begins.

The maze clears as soon as one stops asking which framework is the right one, and instead asks which question it answers. In essence, there are only four:

1. Security: Is the cloud service secure?
2. Sovereignty: How independent is the service from states outside the EU?
3. Obligation: Which provider is permitted for which task?
4. Resilience: How effectively does my own organisation master its critical dependencies?

The first three questions focus on the provider. The fourth focuses on your own organisation. This task is not new: managing dependencies on vendors and service providers is a classic discipline of IT, supplemented in regulated institutions by risk management and compliance as a second line of defence. What is new is the benchmark: geopolitical risks are now explicitly included, and the time available to respond to them has become shorter.

As part of our three-part blog post series, we examine the four questions step by step. In Part 2, we turn our attention to providers of sovereign products and examine how C5 and the stalled EUCS govern security, how EU CSF, C3A and SecNumCloud make sovereignty measurable, and why the Cloud and AI Development Act (CADA) could soon turn this voluntary exercise into a mandatory requirement. Part 3 focuses on your organisation's resilience and what the Indice de Résilience Numérique (IRN) means for you in practical terms.

Sources:

1. Senate, Minutes of the Committee of Inquiry on Public Procurement, June 10, 2025 – https://www.senat.fr/compte-rendu-commissions/20250609/ce_commande_publique.html 
2. U.S. Congress, CLOUD Act (H.R. 4943) – https://www.congress.gov/bill/115th-congress/house-bill/4943 
3. AP/PBS: Trump’s sanctions on the ICC’s chief prosecutor have halted the tribunal’s work, May 15, 2025 – https://www.pbs.org/newshour/world/trumps-sanctions-on-iccs-chief-prosecutor-have-halted-tribunals-work-officials-and-lawyers-say 
4. Microsoft Denmark: Statement regarding the ICC, May 28, 2025 – https://news.microsoft.com/da-dk/2025/05/28/kommentar-fra-microsoft-vedr-icc/ 
5. netzpolitik.org: International Criminal Court Removes Microsoft from Its Administration, October 2025 – https://netzpolitik.org/2025/sorge-vor-us-sanktionen-internationaler-strafgerichtshof-kickt-microsoft-aus-seiner-verwaltung/