Two years ago, the mere mention of digital sovereignty in the IT department could be seen as some kind of ideological battle rather than a technological one. It was a debate heard at political conferences, not in tech circles. Open source was often tested in a small corner of the IT environment, either out of curiosity or just to tick the innovation box.
But by summer 2026, the mood had shifted dramatically.
Following our double marathon of events in June – EuroCommons Day, alongside Groupe Caisse des Dépôts, and the Digital Sovereignty Conference – our teams reached a clear conclusion: IT decision-makers are no longer asking questions about digital sovereignty in theory. They’re looking for pragmatic ways to assess and reduce their organisation’s exposure to technologies from outside Europe.
For IT departments, digital sovereignty is not about nationalism or isolationism. It’s a matter of risk management and operational resilience.
IT dependency: beyond cloud and data
When organisations look to reduce their dependency on US technology providers, the focus usually falls on the upper layers of the stack: data location, cloud hosting (e.g. AWS, Azure and GCP) and collaboration suites.
While CISOs are becoming increasingly conscious of their exposure to the US CLOUD Act and other foreign legislation affecting SaaS platforms, the reality is that IT dependency is multi-layered:
- Application and collaboration layer: Emails and strategic documents through platforms such as Office 365 may be accessed through disclosure requests from foreign authorities, even without prior notification to the organisation concerned.
- Geopolitical and service continuity risks: Critical services – such as payments, authentication or connectivity – could be restricted with little notice in response to diplomatic or geopolitical tensions.
- Restricted access to innovation: Organisations can also become dependent on emerging technologies that are unilaterally controlled. When the Fable 5 AI model was released, foreign nationals were formally restricted from accessing it for three weeks, even those working at Anthropic or residing in the United States.
- IT infrastructure administration and management layer: This is the link that is most often overlooked. Relying on proprietary tools or US-based vendors to orchestrate, automate and secure servers and workstations creates a critical vulnerability. If the management layer weakens or its licensing model changes, the impact can affect the entire IT environment.
Digital sovereignty for IT infrastructure therefore requires a holistic approach. Protecting data and controlling where it is hosted is essential, but making sure you are not dependent on the tools used to manage and orchestrate infrastructure is just as vital.
Faced with these challenges, the European ecosystem is finally aligning around the issue. Twenty years of development are now converging into more structured initiatives, including the €18 billion Digital Horizon 2030 plan supported by Caisse des Dépôts – the investment arm of the French government – and the European Competitiveness Fund. As speakers at EuroCommons repeatedly stressed: ‘Now is the time, even if we aren’t ready’.
The key question for IT teams remains: how can organisations transition towards sovereign alternatives, without disrupting existing systems or sacrificing productivity?
Achieving digital sovereignty for your IT infrastructure
So, you want to reduce your long-term technology dependency without making architectures more complex. Yet, the ecosystem in Europe mustn’t fall into the trap of fragmentation. And rebuilding existing capabilities using internal scripts or custom components simply creates another layer of technical debt. The answer instead lies in standardised, open-source solutions that have been proven at scale.
The path towards greater technological independence can be built around three priority areas:
1. The desktop: manage Linux and move beyond Active Directory
For many public-sector organisations as well as businesses, the desktop is a good place to start reducing technology dependency to escape the dominance of Windows. But replacing the operating system is only part of the challenge. The wider issue is asset management.
How can you implement a functional equivalent of Group Policy Objects (GPOs) at scale across a Linux environment, without making life harder for your IT team? Rudder provides the orchestration and configuration management layer needed to centrally manage heterogeneous IT estates. It delivers the level of control and security you’d expect from proprietary ecosystems, while giving you greater technological independence.
2. Automation: regain control of configuration management
For years, server automation was entrusted to US-based solutions. Recent strategic shifts – including Puppet’s discontinuation of its open-source distribution – have highlighted the risks of relying on licensing models that vendors can change on their own.
Recent events, particularly the discontinuation of Puppet Open Source, are a major opportunity for European tech to reclaim its place as an innovation leader. Choosing a European tool isn't about pride; it’s just common sense to boost resilience.
Achieving digital sovereignty for IT infrastructure means choosing open, declarative automation tools that keep organisations in control of their technical foundations at all times.
3. SecOps and cyber hygiene: from point-in-time audits to continuous security
When compliance rests on occasional audits, IT environments become susceptible to configuration drift. Infrastructure may be compliant on the day it is assessed, but then slowly but surely deviate from security standards as day-to-day operations go on.
A sovereign approach to SecOps means a seamless process of continuous auditing and remediation.
- Integrated auditing and remediation: Simply identifying vulnerabilities can result in complex reports without any immediate action. Organisations need the ability to audit and remediate issues – including patches, CVEs and CIS Benchmarks – from a single interface.
- Granular operational control: Being able to deploy each control individually, either in audit mode or automatic remediation mode, allows security teams to improve their security posture progressively, without needlessly disrupting the business.
- Continuous cyber hygiene: This combination allows you to continuously align your environments with security frameworks such as CIS Benchmarks over time, providing sustained compliance and true ongoing control over your IT environment.
Rudder brings these requirements together in one intuitive interface. Organisations can apply their own security policies or deploy ready-to-use frameworks such as CIS Benchmarks.
Controls can be operated in Audit mode to assess compliance or Enforce mode to automate remediation, hardening your systems while maintaining a clear, consolidated view through central monitoring dashboards.
A sustainable open-source model for IT resilience
The quest for technological independence is not some knee-jerk response to the latest trends. It is built on proven, sustainable software design and architecture approaches.
For 15 years, Rudder has developed a self-funded, open-source infrastructure security automation platform that is developed in Europe. Offering legal and financial independence, the tool runs on a transparent, auditable and fully interoperable platform, reducing the risk of proprietary vendor lock-in.
That continuity has led to Rudder becoming a trusted technology to secure the critical infrastructures of organisations including BMW Group, Banque de France and Eutelsat.
Choosing an on-premises deployment model can also protect organisations from unexpected changes to SaaS pricing structures, such as additional charges for AI features that were previously included as standard. So, IT departments can now control both their technology and their budgets.
Reducing an organisation’s dependency on non-European technology providers is no longer a nice-to-have. It is essential to building agile, secure, resilient and sustainable IT infrastructure.
Looking to take stock of your infrastructure dependencies? Want to set out a migration roadmap towards more sovereign technology solutions?
Frequently asked questions
Should on-premise deployment be prioritized to control the infrastructure budget?
Choosing an IT architecture deployable on-premise allows IT departments to maintain control over their budgets by avoiding unexpected price increases imposed by Cloud SaaS subscription models. These sudden cost hikes occur notably when paid options based on artificial intelligence are automatically integrated. On-site hosting thus guarantees dual technical and financial control over critical infrastructure.
What risks does the end of Puppet's open-source version illustrate?
The decision by Puppet to discontinue the open-source distribution of its product highlights the major strategic risk of relying on licensing models that can be unilaterally modified for server automation. Long delegated to American vendors, infrastructure becomes vulnerable if usage terms change. To ensure resilience, choosing open and declarative European automation tools ensures that companies remain in control of their technical foundation.
What is the difference between Audit mode and Enforce mode in SecOps?
Audit mode evaluates infrastructure compliance against security frameworks, while Enforce mode applies automated remediation to immediately fix vulnerabilities and harden systems. Individually enabling each control in the Rudder tool allows organizations to integrate CIS benchmarks or an information security policy at their own pace. This granular management prevents configuration drift without risking disruption to business-critical services.
What risk does the restriction of access to the Fable 5 model illustrate?
The access prohibition to the Fable 5 artificial intelligence model illustrates the unilateral control exercised by foreign actors over emerging technologies and restricted access to strategic innovation. Upon its release, the Anthropic laboratory formally prohibited access to foreign nationals for three weeks, including employees residing in the United States. This episode demonstrates that technological dependency extends far beyond simple data storage.
Robinson Maigné
Passionate about cybersecurity, Robinson Maigné helps organizations turn their constraints into strategic advantages.
A generalist engineer by training, he now works as a Solutions Engineer at Rudder. His approach? Listening closely to operational needs to design tailored compliance automation strategies.
