French Digital Sovereignty

Critical Dependencies Under Review: What Organizations Can Take Away from France’ Initiatives

French policymakers have long championed digital strategic autonomy. Long persuasive though vague, since 2026, the strategic intent has been crystallizing into first institutional structures – the Avant-Garde Initiatives. French public and private entities face new governmental frameworks to assess their dependencies, as well as regulations to comply with.

The Malaise
Avant-Garde Initiatives
Souvereign Institutionalization
Promoting European Alternatives
Digital Sovereignty for Operators

This editorial provides context for the status quo of dependencies throughout the French system and the strategic rationale for sovereignty on the national and European level, before turning to its institutional manifestations in the French system and its effects on public and private entities. As and outlook, this overview can guide NIS2 and CER operators for upcoming souvereignty regulation.

Digital Sovereignty in France

The Malaise

The Deepening Economic and Strategic Dependence on Non-EU Tech Stacks

European capitals have been wary of strategic digital dependencies on the US ever since the Snowden revelations in 2013. With the return of an US administration willing to coerce Europe through its dependencies on America’s monopolistic, frontier technologies, concerns have multiplied.

In the coming months, existing dependencies risk compounding drastically. As AI adoption accelerates and European companies continue to procure foreign solutions, the underlying problem, reliance on these tech stacks, entrenches further. From a structural economic perspective, the ensuing erosion of market share, funding for European alternatives, and future value creation is worrisome enough on its own. Amid unprecedented transatlantic tension, however, a starker concern has eclipsed it: an increasingly unfriendly ally could deliberately degrade or deny access to the systems that carry government data, critical services, or the backbone of the economy.

The accidental six-hour AWS outage in October 2025 demonstrated how quickly ripple effects cascade across European users. The more deliberate, if temporary, suspensions of some AI LLM models by US export controls therefore pushed policymakers to elevate the file to the level of national security.

Quantifying the depth and breadth of these dependencies is notoriously difficult. The clearest picture yet, for the French system, comes from the National Assembly’s cross-party commission of inquiry into structural digital dependencies and vulnerabilities. Published in July 2026, its report maps out six structural digital vulnerabilities: foreign interference and fake news, cyberattacks, data volumes outpacing storage and protection capacity, the monetization of user data at the expense of individual freedoms, vendor lock-in, and dependence on key infrastructure such as data centers.

Across the subsequent 400 pages, it narrows its focus to France’s significant dependence on US cloud infrastructure, data centers, and platforms’ monopolistic influence by tracing the software deployed inside ministries and the private sector (chapters 1–2), quantifying the costs and risks involved (chapters 3–5), examining why Europe relies so heavily on US hyperscalers (chapters 6–10), diving deep into AI-specific risks (chapters 11–12), and closing with consensus policy recommendations favoring open-source and European alternatives.

Somber findings run through the commission’s report: the French state pays 1.5b EUR a year for non-European, mostly US-designed software and infrastructure. Consequentially: 80 percent of software in the public sphere is American. Compressing the risks into the question who can read our data? the report cites Microsoft’s own disclosure of 5,587 US data-access requests in the second half of 2025.

To the question who can shut off our access altogether? it points to two telling cases: the suspension of ICC judge Nicolas Guillou’s access to US-run digital and payment services following US sanctions, and Anthropic’s temporary export-control suspension of its Mythos and Fable models.

Avant-Garde Initiatives

European Digital Sovereignty

Paris has never hidden its distrust of the US; French leaders have been vocal about sovereignty ideals ever since de Gaulle. While this strategic ideal arose in the national security context, the supply chain dependencies exposed by the Covid-19 pandemic and Europe’s energy dependency on Russia – laid bare by the 2022 invasion of Ukraine – gave Paris new impetus to extend the notion beyond defence into economic, energy, and industrial policy.

The US approach of leveraging dependencies on US tech companies and frontier AI deregulation to the disadvantage of European companies prompted Paris to popularize the notion of digital sovereignty. Following strong advocacy from Paris, the European Commission responded on 3 June 2026 with its European Technological Sovereignty Package, centered on the Cloud and AI Development Act (CADA) and Chips Act 2.0 to rebuild Europe’s semiconductor base, alongside a new Open Source Strategy and an AI-in-energy roadmap.

France’s once-solitary position on sovereignty has found increasing traction among other European member states. Germany was long reluctant to adopt policy discriminating against US companies, given its own economic and strategic ties to both the US and China, and its preference for staying open to reliable international partners.

A turning point in these negotiations was marked by the November 2025 Franco-German Digital Sovereignty Summit in Berlin, followed by a joint paper in June 2026 defining shared sovereignty criteria, intended to jointly steer the package through the legislative process. Nonetheless, beneath the agreement, many differences remain, especially on the European preference.

Souvereign Institutionalization

How Digital Sovereignty begins to institutionalize in France

While the Tech Sovereignty Package is still working through the EU legislative process, France is pushing ahead nationally. The Ministry for the Economy, Finance and Industrial, Energy and Digital Sovereignty, Bercy, is in charge of digital sovereignty.

Within Bercy, policies on digital sovereignty come from several bodies: the Directorate General for Enterprises (DGE, the main policy development unit in Bercy), the Minister Delegate for Digital Affairs and Artificial Intelligence (the political layer), and DINUM (the Interministerial Directorate for Digital Affairs, which is lent to Bercy for digital matters in the public sector but otherwise sits under the Prime Minister, and which has been slated to become the new French authority for digital and AI affairs in the public sector, under the name Ariane).

On Monday 26 January 2026, Bercy held the first Digital Sovereignty Meeting, together with the Ministry for Europe and Foreign Affairs. the Minister Delegate for Digital Affairs and Artificial Intelligence presented the government’s roadmap for digital sovereignty, launching two initiatives aimed at mapping public and private actors’ digital dependencies: the Digital Sovereignty Observatory and the Digital Resilience Index.

Digital Sovereignty Observatory

With the new Digital Sovereignty Observatory, France established a dedicated structure to regularly survey public and private sector organizations and publish comprehensive statistics on critical dependencies across cloud, AI, data infrastructure, and software. Beyond that, the new entity, which sits under the Haut-commissariat à la Stratégie et au Plan, is mandated to provide decision-support tools for public and private procurement and to inform policy direction on digital sovereignty.

Digital Resilience Index

On the basis of the new Digital Resilience Index (IRN), a private-sector initiative, companies can be audited on their dependencies across eight dimensions: software, data, infrastructure, tech assets, internal skills, governance, shock resistance, and supply chain/extraterritorial exposure. Methodologically, it combines four quantitative independence metrics (national/European/extra-European scale) with qualitative review of contracts, suppliers, data localization, and vendor diversification.

Promoting European Alternatives

Once dependencies are measured and assessed, they need to be considered in industrial strategy, private and public sector procurement rules. This is where the Interministerial Directorate for Digital Affairs (DINUM) recent initiatives and the Directorate General for Enterprises (DGE) strategy link to.

In April 2026, DINUM launched two consequential moves for the public sector. It enacted a directive requiring all 2.5 million civil servants to migrate from Microsoft Teams and Zoom to the state’s own platform Visio by 2027. By autumn 2026, every ministry must table a plan to reduce its extra-European digital dependencies, spanning operating systems, collaboration tools, cloud infrastructure, and AI.

What drew wider attention was a separate DINUM decree that same month, 2026-272, implementing the 2024 Securing and Regulating the Digital Space Act (SREN). Under this decree state administrations, their operators, and six designated groupements d’intérêt public (public-private bodies handling specific administrative missions, here including the digital health agency ANS) must turn to SecNumCloud-qualified providers for sensitive data.

SecNumCloud is a security qualification issued by ANSSI, France’s cybersecurity agency, certifying cloud providers against extraterritorial legal exposure. In practice, though, some SecNumCloud-qualified providers are joint ventures still licensing US parent technology, leaving the underlying risk of denied availability only partially addressed.

DGE, in turn, approaches disclosed dependencies through a wider industrial lens. The overarching question: how to mitigate the dependencies by promoting French/European alternatives. In a June 2026 essay, Courbe set out his ministerial unit’s strategy across three pillars.

First Pillar: master critical technologies (AI, semiconductors, cybersecurity) by cultivating a future-oriented talent pool, mobilizing public and private R&D investment, and scaling French and EU champions into an increasingly independent industrial infrastructure layer.
Second Pillar: support AI adoption in the private sector through a national platform pooling tools, training, deployment, and financial support, advancing digital maturity and competitiveness on the back of a multicloud strategy designed to preserve relative sovereignty and data protection.
Third Pillar: promote EU regulation favoring a "European preference," so that European procurement gives weight to solutions meeting defined sovereignty standards and complying with EU data rules.

All in all, these first ministerial institutionalizations of digital sovereignty demonstrate a more pragmatic approach to the concept. French policy centers on a feasible approach: identify where dependencies lie, assess their strategic impact, and, on that basis, decide which are tolerable, which need reducing or diversifying, and where credible European alternatives should step in – with regulatory support to accelerate their adoption, procurement, and scaling.

Digital Sovereignty for Operators

Risk analysis of the Digital Architecture

The thorough French stock-taking effort illuminates risks companies should take seriously: European public and private sectors are critically vulnerable to technological dependencies on the US, dependencies that can be exploited.

Against this backdrop, companies, especially those supplying critical services, should consider expanding their cyber security and physical risk management to include technological dependencies to enhance resilience in their digital architectures.

In essence, such risk management leans on business continuity thinking already familiar from NIS2 and the CER all-hazards risk assessment, which stipulate supply chain risk assessment for operational resilience beyond malicious actors to cloud outages, infrastructure failures, and geopolitical disruption.

Several actors in the company should have a role in souvereign dependency risk management:

CISOs and risk owners should integrate dependency mapping into the existing NIS2 supply chain analysis. Suppliers handling critical systems and data should be assessed, using a framework such as the IRN eight dimensions as a checklist.
Compliance should track the regulatory pipeline, since EU CADA will likely reshape what counts as sovereign enough, with follow-on effects on NIS2 and CER regulated entities.
Procurement should be guided by certification, such as SecNumCloud in France or the pending EUCS at EU level, when selecting or renewing suppliers. There also should be audit-ready contractual clauses covering security standards, incident notification, and breach response
Executive management should own dependency and souvereign risks as a strategic business risk. Non-availability of critical services carries regulatory, financial, and continuity implications.

Prospectively, dependencies should be mitigated through diversification, if available with the resort to open European alternatives.

Why does it matter? Mapping and mitigating dependency risks is in companies’ own interest, simply to keep services running. Beyond that, managed dependencies can also become a competitive advantage: companies that can demonstrate their technology is resilient, open, not locked into a single vendor, and insulated from shifting international relations, stand out for it.

French Idealism Meets Reality

France’s 2026 advances show a once-abstract ideological notion becoming concrete, pragmatic, and operational. This turn toward realism has given operators solid frameworks and useful tools, though initiatives remain mainly in a diagnostic phase. Overarching strategies and subsequent measures have yet to unfold, both nationally and at EU level, as they may increasingly intersect with cyber regulation.

Pas si vite. Quelle ironie: Although the self-styled architect of European digital and infrastructural sovereignty, Paris is one of the last countries lagging behind in operationalizing it. As France has not transposed the EU's NIS2 directive into national law via the loi résilience, the European Commission referred it to the Court of Justice of the EU on 8 July 2026.