The sane insanity of digital sovereignty

Matthew Kilcoyne is a Policy Analyst at the Information Technology and Innovation Foundation’s Center for Data Innovation, and focuses on data, AI, and digital policy in the UK and EU

Every major economy is now hedging against digital dependence. Europe plans to consciously decouple from American tech and even has EuroStack proponents demanding the Commission spend €300 billion building indigenous cloud and AI infrastructure, in fact, an entire new stack.

The United States restricts chip exports to protect its lead. China pours resources into semiconductor self-sufficiency. India mandates local data storage. Each move is individually rational—a reasonable response to genuine vulnerabilities. Collectively, they risk destroying the integrated digital economy that made these technologies valuable in the first place.

This is the sane insanity of digital sovereignty: policies that make perfect sense in isolation but threaten catastrophe in aggregate. We are watching a slow-motion prisoner’s dilemma unfold across the global technology landscape, and no one seems able to stop it.

The fears are overblown

The sovereignty impulse responds to real dependencies. Europe relies on American technology for roughly 90 percent of its cloud infrastructure, according to Cristina Caffarra of the EuroStack Foundation. In 2024, US-based institutions produced 40 notable AI models; China produced 15; Europe produced three. US private AI investment reached $109.1 billion—nearly 12 times China’s $9.3 billion. For policymakers watching these numbers, the conclusion seems obvious: without intervention, Europe becomes a backwater unable to have any say over its future.

But what exactly is the threat?

The US CLOUD Act gets cited endlessly as justification for European digital sovereignty. The 2018 law allows American authorities to compel US-based companies to provide data regardless of where it is stored. This sounds alarming—but alarming for whom, and under what circumstances? The scenario sovereignty advocates fear is American technology companies being weaponized against European interests.

Yet the mechanism that prevents this is precisely the interdependence they want to sever: American cloud providers have billions of dollars in European revenue at stake. Microsoft, Amazon, and Google are not going to help the US government torch their largest export market. The mutual dependency is the protection.

More fundamentally, there is no viable alternative. Europe is not going to build competitive hyperscale cloud infrastructure from scratch. The EuroStack proposal calls for €300 billion over a decade—and even its advocates acknowledge this buys catch-up, not leadership.

European cloud providers like OVHcloud and Deutsche Telekom’s T-Systems exist, but they cannot match the R&D investment, talent pools, or economies of scale of American hyperscalers. The gap is not closing. It is widening.

And if not American technology, then what? Chinese? Huawei and Alibaba Cloud would be delighted to fill any vacuum European protectionism creates. If the concern is extraterritorial government access to data, China’s National Intelligence Law makes the CLOUD Act look quaint. Trading American dependency for Chinese dependency solves nothing—except perhaps the career prospects of the consultants and politicians pushing the transition.

The honest assessment is uncomfortable: Europe is dependent on American technology because American technology is better, and no amount of industrial policy will change that within any relevant timeframe. The choice is not between sovereignty and dependence. It is between productive dependence on allies (however shaky that may seem right now) and destructive dependence on adversaries—or simply falling further behind while pretending otherwise.

The honest assessment is uncomfortable: Europe is dependent on American technology because American technology is better, and no amount of industrial policy will change that within any relevant timeframe

How sovereignty measures actually work

Digital sovereignty initiatives share a common toolkit: procurement mandates requiring domestic providers, data localization rules preventing crossborder transfers, and subsidies for domestic champions. Each mechanism has its stated rationale. But strip away the security language, and what remains is protectionism by firms that cannot compete on merit.

The EuroStack initiative makes this explicit. Its framework proposes ‘Buy European’ procurement rules with jurisdictional control as a non-negotiable prerequisite for strategic procurement. The stated goal is resilience. The actual effect is to exclude superior foreign competitors so that inferior domestic providers can win contracts they would otherwise lose.

This is not speculation. When the Dutch managed cloud provider Solvinity was acquired by American IT giant Kyndryl in November 2025, several Dutch government clients—including the Ministry of Justice and Security—expressed dismay. They had specifically chosen Solvinity to avoid American providers.

But Solvinity was acquired precisely because it could not compete independently. The market delivered its verdict: European cloud providers lack the scale to survive without either protection or acquisition. Procurement mandates do not fix this. They merely hide it. The correction is costly in due course.

The costs are concrete. The OECD estimates data localization measures raise data management costs by 15 to 55 percent. Procurement mandates exclude foreign competitors regardless of capability, meaning governments pay more for less. Subsidies for domestic champions distort investment toward politically favoured firms rather than technically superior ones. The beneficiaries are not European citizens but European technology executives who prefer guaranteed contracts to market competition.

Each jurisdiction implementing these measures forces others to respond in kind. When Europe mandates European cloud providers, it invites retaliation. When export controls restrict chip sales, they accelerate indigenous development programs that might otherwise never have been funded. The hedging creates the instability it was meant to prevent.

The golden goose accounting

The integrated digital economy is not merely convenient. It is the foundation of modern productivity growth.

McKinsey estimates that global data flows raised world GDP by approximately 3.5 percent over what would have occurred without them—equivalent to $2.8 trillion annually. Digital trade has raised US GDP by 3.4 to 4.8 percent while creating an estimated 2.4 million jobs. A 10 percent increase in internet penetration in exporting countries leads to a 1.9 percent increase in export volumes. These are not marginal effects. They represent the difference between stagnation and growth.

Joint research by the OECD and World Trade Organization quantifies what fragmentation would cost. Full data autarky—where all economies fully restrict their data flows—would reduce global GDP by 4.5 percent and cut exports by 8.5 percent. Even partial fragmentation along current trajectories would cost more than 1 percent of global GDP. These are not rounding errors. They represent trillions of dollars in forgone growth.

The benefits of integration are equally concrete. If all economies adopted open data flow regimes with appropriate safeguards, global GDP would grow by 1.77 percent and exports by 3.6 percent. Low and lower-middle income economies would see GDP increases exceeding 4 percent. Crossborder data flows enable smaller firms to access global markets, allow researchers to collaborate across borders, and let supply chains coordinate production efficiently.

The mechanism matters: digital services exhibit extreme economies of scale. The marginal cost of serving an additional user approaches zero. A cloud provider operating across 50 markets can spread infrastructure costs across billions of users; one restricted to a single market cannot. An AI model trained on global data outperforms one trained on a single jurisdiction’s corpus. Fragmentation does not merely reduce efficiency—it makes certain capabilities economically impossible.

Consider the AI investment gap through this lens. Europe’s three notable AI models in 2024 versus America’s 40 reflect not just funding differences but market size differences. American AI companies can amortize development costs across 330 million domestic users plus global export markets. European companies facing fragmented markets and procurement restrictions have smaller addressable markets, which means smaller sustainable R&D investments, which means inferior products, which reinforces the dependency that sovereignty measures were meant to address.

The game theory trap

Why don’t rational actors simply cooperate? Because unilateral openness in a fragmenting world creates asymmetric vulnerabilities. If Europe maintains open procurement while America and China restrict theirs, European firms face competition at home while being locked out of foreign markets.

If America maintains open data flows while Europe and China localize, American companies bear compliance costs their competitors avoid. The first mover toward openness loses; the first mover toward restriction gains a temporary advantage.

This creates a ratchet effect. Each restriction justifies the next. American export controls on advanced chips to China justify Chinese semiconductor investment programs. Chinese semiconductor programs justify American restrictions on investment in Chinese technology. European concerns about American data access justify European localization mandates. European localization mandates justify American concerns about European protectionism.

The equilibrium toward which we are drifting is not sovereignty but mutual impoverishment. Each jurisdiction achieves nominal control over an increasingly inferior technology stack. The global frontier advances more slowly because innovation resources are scattered across duplicative national programs rather than concentrated at the cutting edge. Everyone loses except the advocates whose careers depend on the conflict.

The alternative path

The choice is not between naive openness and managed sovereignty. It is between uncoordinated fragmentation and coordinated frameworks that address legitimate concerns without destroying integrated markets.

The OECD’s work on ‘Data Free Flow with Trust’ provides a template. Regimes that combine open data flows with appropriate safeguards—privacy protections, security requirements, accountability mechanisms—generate better economic outcomes than either unregulated openness or restrictive localization. The challenge is building mutual recognition frameworks that allow data to cross borders while ensuring it receives adequate protection on arrival.

For procurement, the answer is interoperability requirements and security standards that any qualified provider can meet—not mandates based on corporate nationality. Legitimate security concerns about government access to sensitive data can be addressed through technical controls: customer-held encryption, operational isolation, and audit requirements. These achieve actual security rather than the theatre of excluding competitors under the guise of sovereignty.

For AI, the path forward is shared infrastructure rather than duplicative national champions. The computing resources required to train frontier models are so expensive that no single European country can afford them alone. The EU’s InvestAI initiative aims to mobilize €200 billion and build AI gigafactories hosting 100,000 chips each—four times larger than current EU AI factories. But if these facilities prioritize national champions over open access, they will replicate the fragmentation problem at European scale.

A coordinated European computing infrastructure available to researchers and companies across the bloc could achieve scales competitive with American hyperscalers—if it is designed for shared access rather than national preference.

None of this is easy. It requires trust between governments that increasingly view each other as competitors. It requires domestic political constituencies willing to accept foreign participation in sensitive sectors. It requires international institutions capable of monitoring compliance and resolving disputes. But the alternative—uncoordinated fragmentation into incompatible technology blocs—is worse for everyone.

The stakes

We are not choosing between sovereignty and dependence. We are choosing between managed interdependence that preserves the gains from integration and mutually assured digital poverty that destroys them.

The at least €300 billion EuroStack proponents are pushing to see spent on duplicative digital infrastructures could, instead, in an expansive environment work to purchase real resilience: diversified supply chains, a tech stack far broader than current assumptions—including modalities and applications we have yet to imagine—solutions to longstanding challenges, interoperable systems, and shared governance of common infrastructure.

Spent on duplicative national champions protected by procurement mandates, it will purchase inferior technology at a higher cost while accelerating the fragmentation that makes everyone poorer.

The sane insanity can end. But it requires recognizing that individual rationality produces collective catastrophe, and that the only escape is coordination none of us can achieve alone.

We can all win. Or we can all lose together. The current trajectory leads to the latter, and inertia will not change it.