"Digital sovereignty" is easy to nod along to and hard to pin down. For a European business or public authority, it comes down to a practical question: who ultimately controls the software your organisation depends on to function — and what happens when their interests, prices, or legal obligations stop aligning with yours?
Of all the answers on offer, open source is the most concrete lever you can pull. Not because open source is a magic word, but because it changes the fundamental relationship you have with your technology: from trusting a vendor's promises to being able to verify, adapt, and leave on your own terms. This article walks through why that matters — auditability, freedom from lock-in, control over the stack, and the "public money, public code" principle — and points to European projects already proving it works at scale.
The dependency you may not have priced in
Most European organisations run their daily operations on a handful of platforms headquartered outside the EU. That is not inherently reckless, but it carries a risk that many decision-makers have never fully costed.
Consider the legal ground under your data. In July 2020, the Court of Justice of the EU struck down the Privacy Shield framework in its Schrems II ruling, finding that US surveillance law gave EU citizens no equivalent protection. The 2023 EU-US Data Privacy Framework restored a legal basis for transatlantic data transfers — but it rests on a US executive order that a future administration could amend, and it already faces fresh legal challenge. In other words, your compliance foundation can shift without you doing anything wrong.
Legal exposure is only part of it. Dependency also shows up as sudden price increases, forced upgrade cycles, features you relied on being discontinued, and the plain geopolitical risk of a supplier who can be pressured by a government that is not yours. Sovereignty, in this framing, is simply operational control over systems you cannot afford to lose.
Auditability: verify, don't just trust
Proprietary software is a black box. You are told what it does with your data, and you take that on faith, because the source code is a trade secret you are contractually forbidden to inspect. When telemetry flows somewhere you did not expect, you usually find out after the fact.
Open source inverts this. The source code is public, which means your own security team — or an independent auditor you hire — can read exactly how encryption is implemented, what data leaves the machine, and whether anything unexpected is happening. Serious vulnerabilities are found and fixed in the open rather than hidden.
This is not a guarantee of security on its own: open code still has to be actively maintained, funded, and reviewed to be trustworthy. But it moves you from "trust us" to "verify for yourself." For organisations in regulated sectors — now including everyone brought into scope by the NIS2 directive — demonstrable transparency across your software supply chain is shifting from a nice-to-have to an expectation.
No lock-in: owning your exit
Vendor lock-in is the situation where the cost of leaving a supplier is so high that you stay even when the relationship no longer serves you. It is built from proprietary file formats, closed APIs, and sheer data gravity — and it is often designed in deliberately.
Open source, paired with open standards, dismantles that trap. When your documents live in an open format like OpenDocument (ODF) and your systems speak documented, standard protocols, your data stays portable. You can self-host, move to a different provider, bring in a different integrator, or — in the extreme case where a project is abandoned — fork the code and keep it running. Crucially, you also control your own upgrade timeline instead of being marched onto the next version on the vendor's schedule.
The actionable takeaway is simple and applies today, long before any migration: demand open formats and a documented, tested data-export path in every procurement. An exit strategy is not disloyalty to your supplier — it is basic due diligence, and it dramatically strengthens your negotiating position.
Public Money, Public Code
Since 2017, the Free Software Foundation Europe has run the "Public Money? Public Code!" campaign, backed by an open letter signed by more than 200 organisations. Its argument is disarmingly simple: if software is paid for by the public, it should be available to the public under a free and open licence. Code paid by the people should be code the people can use, study, share and improve.
The practical payoff is real. Software commissioned once by one administration can be reused by another instead of being procured from scratch, tax money goes further, and public bodies escape dependence on a single vendor while gaining a better foundation for IT security. The principle is increasingly being written directly into public procurement rules across Europe — and private businesses can adopt the same logic when they commission bespoke software: insist on owning and being able to reuse what you paid for.
Proof it works: European success stories
This is no longer theoretical. The German state of Schleswig-Holstein is migrating roughly 30,000 administrative workstations away from Microsoft. By late 2025 around 80 percent had moved to LibreOffice, running increasingly on Linux, with Nextcloud for collaboration; the switch from Exchange and Outlook to Open-Xchange and Thunderbird — more than 40,000 mailboxes — was completed in October 2025. The government reports saving well over 15 million euros in licence costs, framing sovereignty as not just possible but economical.
At the federal level, the Centre for Digital Sovereignty (ZenDiS), founded in 2022, develops openDesk — a modular sovereign workplace assembled from established open-source components including Nextcloud, OpenProject, Open-Xchange, Collabora Online, XWiki and Element (built on the Matrix protocol). In a striking vote of confidence, the International Criminal Court moved from Microsoft 365 to openDesk in October 2025.
France offers a parallel model with La Suite numérique from the DINUM digital agency: its Tchap messenger, built on Matrix, already serves more than 600,000 state employees, and its collaborative editor Docs is being developed jointly with Germany's ZenDiS, with the Netherlands joining in 2025. That cross-border co-development is the point — a shared European digital commons that no single vendor owns.
Regulation is moving your way
The policy environment is tilting toward exactly the properties open source provides. The EU Data Act, which entered into application in September 2025, gives customers the right to switch cloud providers more easily and pushes toward removing the egress fees and interoperability barriers that entrench lock-in. The Digital Markets Act imposes interoperability obligations on the largest gatekeeper platforms. NIS2 raises the bar on supply-chain security and transparency.
The common thread across all of it is a regulatory push to reduce lock-in and increase openness and portability. Choosing open source and open standards is not a bet against the direction of European law — it is alignment with where that law is clearly heading.
Where to start
None of this requires ripping everything out overnight; that would be reckless in the opposite direction. Sovereignty is a spectrum, and every step along it reduces risk. Start by mapping your dependencies honestly and identifying the single points of failure — the systems whose sudden loss, price hike, or legal disruption would hurt most.
Then pilot in a lower-risk area: file sharing on Nextcloud, or standardising on OpenDocument formats, are common first moves that build confidence without betting the business. Write open-standard requirements and exit clauses into your next procurement. And when you evaluate replacements, look deliberately at the mature European open-source alternatives that now exist in nearly every category — office suites, collaboration, messaging, cloud storage, and more. You do not have to solve sovereignty in one project. You just have to stop deepening the dependency, and start owning your stack one deliberate step at a time.
