The Borrowed Sovereignty

I. The Definition as the Deed

This week, at the opening of the Paris technology fair VivaTech — whose guest country this year, for the first time, is Germany — Germany and France published a joint definition of digital sovereignty: the ability to develop, provide, use, adapt and control technologies „independently, self-determinedly and securely." It sounds like a turning point. But look at the genre: a definition with criteria catalogues, a voluntary reference framework, to be „anchored in coming legal acts" and behind which as many member states as possible are to be gathered. It binds no one. It points to later.

And it is not new. Scholz called for digital sovereignty in 2022, Macron made it a central project from 2020, the German Digital Summit defined it in 2018, the „Guardrails of Digital Sovereignty" date from 2015; researchers counted seven competing meanings of the term in Germany alone. A definition presented as if it were the deed — that is the most German of moves: the announcement of a concept, delivered as though it were already the thing. We have elsewhere called it „innovation without invention."

II. What Is Actually Being Built

One must be fair: behind the words there is, this time, real legislation. The EU technology package of 3 June — the Cloud and AI Development Act, the Chips Act 2.0, an Open Source Strategy — is a genuine draft with a four-tier cloud law, and a first contract of 180 million euros has already been awarded under explicit sovereignty criteria. So something is being built. The only question is what.

III. Sovereignty Off the Rack

Here the proclamation collides with reality. The same governments that preach sovereignty build their „sovereign" clouds on the technology of the US firms. Germany's Delos model consists of SAP and Microsoft, France's Bleu of Microsoft, Orange and Capgemini, S3NS of Google and Thales. The label is European, the engine American.

Why this is not sovereignty comes down to an American law. The US CLOUD Act reaches data wherever the server stands, as long as the operator is a US company — an Amazon data centre in Frankfurt is subject to US law, not German. Microsoft itself had to concede before the French Senate that it cannot guarantee the data sovereignty of European customers. That is why, in March, twenty-five European cloud chiefs warned of „sovereignty washing": EU data centres and certificates as a veneer over a control that does not change.

And the law is built to permit it: the lower tiers of the cloud regime, under which roughly ninety percent of state workloads fall, remain reachable for US providers. Even the criteria catalogue of the German BSI drew criticism for legitimising the hyperscalers as subcontractors and excluding the European mid-sized sector — with Delos as the prime example. The watchman is guarding the wrong door.

IV. Inherited, Not Chosen

The decisive distinction was put precisely by an observer at heise: the binding to a hyperscaler is usually „inherited, not chosen," and precisely therein lies the real sovereignty problem, long before a law or a label comes into play. One does not decide on the dependency; one slides into it — and christens it sovereignty afterwards.

With that, the test is simple. Is actual control — source code, keys, jurisdiction — handed into European hands, or is inherited dependency merely relabelled? By that measure Delos fails, and the 180-million contract remains ambiguous. What stands is the harder path: open, shared infrastructure such as the EuroStack, France's „communs numériques," and the real migrations away from proprietary platforms, from Schleswig-Holstein to France — slower and dearer than clicking on an offer labelled sovereign.

The money explains why the convenient path beckons. Amazon alone spent over a hundred billion dollars on infrastructure in 2025; the entire European cloud sector cannot raise that, and even the first Chips Act mobilised fifty-two billion and missed its target. You cannot outspend the dependency. You can only out-think it — choose the coupling instead of inheriting it.

V. The Substrate, Dressed as Author

Strip away the vocabulary and what remains is the question that runs through all our work: is Europe the author of its stack — or its substrate, dressed as author? The Megamachine does not ask whether the label says „sovereign"; it asks who holds the keys. A sovereignty rented from the power one declares independence from is not sovereignty but dependency with better labelling.

And the figure at the lectern says it all. Federal Digital Minister Karsten Wildberger calls the strengthening of sovereignty „the geopolitical imperative of the hour" — and presides over that same Delos, which is built from Microsoft's technology. It is the very move we found in him once before, in »The Two Woodenheads«: he praised self-determination and handed his own authorship to a machine without saying so. Sovereignty proclaimed outward, dependency kept within. The label changes; the substance is borrowed.

Real sovereignty has no launch event. It is built slowly, in the unglamorous places — a federal state migrating its administration, a ministry with a deadline, an open source code that belongs to no one and that anyone may carry on. It is chosen, line by line. Everything that can be unveiled on a stage in an afternoon is, almost by definition, the label and not the thing.