Johan Linåker: Europe’s digital reliance on US Big Tech

Roads, power grids, and fibre-optic cables count as critical infrastructure, but they’re easily mistaken as purely physical – in reality, they increasingly depend on digital building elements to function. The physical and digital parts are, however, maintained very differently: a cracked bridge can be inspected and fixed on-site by local contractors, while the digital systems underpinning it are commonly designed and run by a handful of outsourced vendors, with little transparency for customers.

For a long time, this has not been an issue. We have put our trust in those commonly referred to as Big Tech, believing their scale and standing would ensure stability and competitive pricing. The cloud, where most of our software runs and data passes through, is one example: a US Big Tech triad manages 70+ percent of digital Europe, with the Baltic and Nordic states no exception, and only 15 percent is cared for by European industry.

However, this concentration of eggs into one basket carries risks. Several cases show that Big Tech is not immune to accelerating, now AI-empowered cyberattacks. Licensing costs are also reported to be accelerating, with little to say from public buyers because of systemic, long-running lock-in effects. Still, trust remained until European-US relations were recently put to the test.

US vendors and platforms are now drawn into a transatlantic standoff, as threats of kill switches, digital sanctions, trade tariffs and export controls are wielded from across the Atlantic. US surveillance legislation (e.g., CLOUD Act and FISA 702), which enables extraterritorial US government access to data stored or managed by US Information and Communication Technology (ICT) companies, is now seen as a realistic threat to European data sovereignty.

This shift caught Europe off guard, with limited means to respond. Decades of Big Tech-centric public spending have resulted in a continental capability gap, again epitomised by the cloud market. European industry, accordingly, needs to level up its R&D and capacity, from semiconductors, cloud and AI to strategic verticals like automotive, energy and health. However, more investment and VC alone will not fix this.

If European governments are truly concerned about the “necessity to build a new form of European independence” (as put by von der Leyen in Davos), public buyers need to start prioritising European alternatives, and value sovereignty-based evaluation criteria on par with price.

On a positive note, the recently released EU Tech sovereignty package, including the proposed Cloud and AI Development Act, takes a step in this direction, calling for mandatory risk assessments in public acquisition and procurement of cloud and AI-based services.

Tools such as the Cloud Sovereignty Framework guide how to do it in practice. Criteria signal preference to options where legal headquarters and data operations sit inside EU jurisdiction. Transparency over the supply chain and subcontractors, citizenship of operating personnel, and ease of migrating data and technology are other factors emphasised.

Open source software is called out specifically as a strategic tool to gaining transparency and control, while promoting interoperability and increased competition. The “open” signals that the technology is free to study, modify, share and reuse, enabling transparency and control over the technology. The open and collaborative approach extends to other areas, such as AI and hardware, as also highlighted in the EU sovereign Tech package.

While policy frameworks set a clear direction and intent, these still need to be translated into practice, which is where things become difficult. Public buyers are as entrenched in their mindsets as they are in their technological dependencies – a risk-averse, conservative procurement culture where comfort and preference for the status quo inhibit change.

Fortunately, there are forerunners such as Estonia that prove the opposite. The country has in public-private partnership developed a data embassy model where government servers are operated in Luxembourg, keeping critical state data under Estonian jurisdiction even when physically hosted abroad. At the same time, X-Road, its open source data exchange layer now adopted by over 20 countries, provides transparency and interoperability of a key layer in the country’s digital public infrastructure.

Europe must take note, and start growing common institutional capabilities that enable governments and public buyers to evolve their policy, culture and practice. Strategic mindset, procurement reform and open collaboration are not separate agendas – they are the complementary levers by which strategic autonomy actually gets built.

Whether the EU27 can move from fragmentation to genuine sovereignty – not just resilience on paper, but the ability to make its own choices about its own infrastructure – will depend less on the ambition of these frameworks than on the willingness of public buyers to use them.