In the space of a few months, three things happened that I could not of imagined just a few years ago.
France announced it is migrating government computers from Windows to Linux. Bavaria, Germany's largest state, cancelled a nearly €1 billion Microsoft contract to build a "sovereign basic workspace" on open-source software instead. And the European Commission published a formal Open Source Strategy, placing open source at the centre of EU policy for the first time.
Looking at how these organisations are changing tactics, you have to wonder if your business putting too much trust in another company's tech?
We explored the foundations of this shift earlier this year in Europe's Sovereign Stack: digital sovereignty and open-source strategy, where we argued that legal, technical, and data sovereignty were converging into a new competitive model for European organisations. What's happened since then suggests that convergence is accelerating faster than most expected.
What's Actually Driving This
The headlines would suggest that this as a political story, but I believe that the underlying drivers are more straightforward,they are a business risk.
Data sovereignty. The CLOUD Act (Clarifying Lawful Overseas Use of Data Act, 2018) requires US-based companies to disclose stored data to US authorities on request, regardless of where that data is physically stored. This legal reach extends to data belonging to European citizens stored on US-company servers anywhere in the world. When Bavaria's Digital Minister explained the decision to exit Microsoft, data privacy was top of the list. When France's minister said the government needed to "regain control of our digital destiny," this is what he meant concretely: their data, on infrastructure they control, subject to laws they write.
Vendor pricing power. Bavaria's Finance Ministry originally wanted to stay with Microsoft and negotiate a discount. The Digital Ministry won the argument: once you're locked in, you negotiate from weakness. A billion-euro dependency is a billion-euro lever in your supplier's hands.
The idea of a tech "kill switch" sounds extreme, but it's a real risk. Right now, most European defense agencies rely on US cloud providers. If a major geopolitical crisis hits, the US government could easily order those tech companies to cut off overseas access. It has happened before. Past sanctions have cut international judges off from their software subscriptions overnight. The real question is: what happens to your business if someone pulls the plug on your tech?
This Isn’t Just a Government Problem
You're not running a German state administration, but the underlying vulnerability is the same.
What happens to your business if a key vendor doubles its pricing at renewal, and migrating away would take 18 months? What's your exposure if a cloud provider changes its data processing terms, and you're already reliant on it for critical workloads? What's your plan if a SaaS tool you depend on gets acquired, sun-setted, or simply becomes unaffordable?
Some SMEs may not have audited their vendor dependencies in a while. Especially their hyperscaler exposure. Various tools get picked up organically, contracts renew on autopilot, processes get built around whatever was easiest. What started as convenience has quietly become a liability.
European governments moving to open source aren't doing it because open source is ideologically superior. They're doing it because open standards create options. Options to switch suppliers. Options to negotiate from strength. Options to survive a disruption without your business going dark.
What "Open Standards" Actually Means in Practice
This is not a pitch to rip out your Microsoft licences and install Linux on every desktop by Friday.
Open standards in practice means making deliberate choices about portability and interoperability when you build or buy. It means:
None of this requires you to become an open-source evangelist. It requires you to think about your technology the way you'd think about any other supplier relationship: what's my exit if this goes wrong?
Where to Start: A Simple Dependency Audit
If you've never mapped your technology dependencies, here's a starting point:
The Bottom Line
The European governments making headlines right now aren't anti-American or anti-technology. They're pro-control. They've looked at their dependency profile and decided the risk is no longer acceptable.
That's a reasonable conclusion for a business to reach too, not as a political statement, but as a practical one.
At Digitalis.io, we help organisations understand their technology dependencies, reduce unnecessary vendor lock-in, and build infrastructure that's resilient by design. It's work we've been doing quietly for years. The rest of Europe is just starting to ask the same questions.
If you'd like to talk through what a dependency review looks like for your organisation, get in touch.
Digitalis is a services provider specialising in open-source data infrastructure. We help businesses run reliable, secure, and vendor-neutral technology at scale. digitalis.io
