“We must view digital sovereignty more as a capability”
There is intense debate in Europe about how to reduce technological dependencies. The discussion often centres on the question of which technologies, platforms and infrastructures should be developed and operated more extensively in Europe in future.
For Toon Kockx, however, this perspective alone falls short. A recent academic paper by Blair Wang, Raffaele Fabio Ciriello and Alexander Richter on digital sovereignty provides an interesting point of reference in this regard: It views digital sovereignty not as complete independence, but as the ability to retain control over one’s own digital sphere of action. Toon draws on concepts such as reversibility, ‘exit by design’ and ‘exit literacy’ from this paper and applies them to the question of how organisations should deal with technological dependencies.
Toon, is the goal of complete digital independence even realistic?
Toon Kockx: In my view, no. Modern digital ecosystems are based on mutual dependencies. This applies just as much to cloud infrastructures as it does to software platforms, hardware, open-source components or global supply chains.
Of course, it is important to build up our own European technological capabilities. But complete independence should not be the benchmark for digital sovereignty. A different question is far more important: do we retain control over our dependencies?
Organisations should know which technologies and providers they rely on, what risks this entails, and whether they would actually be able to respond if the framework conditions were to change.
What does this control mean in concrete terms?
Toon Kockx: First and foremost, transparency. An organisation must understand where its critical dependencies lie. This is not just about which provider delivers a particular service. Dependencies can also arise, for example, from proprietary data formats, interfaces, technologies or a lack of in-house expertise.
The crucial point is whether an organisation remains capable of acting despite these dependencies. If conditions change, a technology is no longer available or new regulatory or security-related requirements arise, there must be genuine alternatives.
Interoperability as a prerequisite for genuine choice
The extent of an organisation’s freedom of action is therefore determined long before a specific change of provider is on the cards. Architectural decisions can either keep options open or restrict them for years to come.
What role do interoperability and portability play in this?
Toon Kockx: A very significant one. Interoperability reduces the risk of systems becoming so tightly interlinked that a switch becomes practically impossible.
Open interfaces, documented standards and clearly defined data models create flexibility. The situation is similar with portability: organisations should not only be able to export their data and applications in theory. They must also know in which format this works, which technical dependencies remain, how long a migration would take and what impact it would have on day-to-day operations.
Digital sovereignty must therefore be taken into account right from the outset when making decisions on architecture, technology and procurement.
Does that mean systems should be designed from the outset with a possible change in mind?
Toon Kockx: Exactly. I find the term ‘Exit by Design’, which is also used in the paper, very apt here.
Organisations usually give a great deal of thought to how they introduce a new technology. However, the question of how they might later move away from it is at least as important.
Closely linked to this is the concept of reversibility: where possible, technological decisions should not be made in such a way that they later become effectively irreversible. This does not mean that providers should be changed constantly. But systems and contracts should be designed in such a way that a decision remains reversible. Only then is there genuine freedom of choice.
Why an exit plan alone is not enough
Many contracts now contain provisions for withdrawing from a service or migrating to another provider. Whether an organisation could actually carry out such a switch, however, is another matter entirely.
In this context, the term ‘exit literacy’ also comes up. What does it mean?
Toon Kockx: This term also comes from the paper and, for me, describes a particularly important point. Many organisations today have contractual exit clauses. However, far fewer have actually tested what such an exit would entail in practice.
Can we actually transfer our data? Do we have the necessary expertise? How does the transfer of knowledge work? Which systems are interconnected? How much effort and what costs would be involved? And can a switch be carried out without jeopardising day-to-day operations?
An exit strategy only has real value if an organisation is actually able to implement it. This is precisely what ‘exit literacy’ describes: not just knowing that a switch is possible, but understanding how such a switch works and what consequences it would have.
What does this mean for the European public sector?
Public administrations and European institutions, in particular, operate many digital systems over long periods of time. At the same time, new requirements are coming up against existing IT landscapes, complex procurement structures and limited resources.
What are the implications of this for public organisations?
Toon Kockx: Digital sovereignty must not remain merely a strategic or political goal in this context. It must be reflected in very specific decisions.
For example: What dependencies are acceptable for a particular service? Which of these would be critical in the event of a crisis? What interfaces do we need? How do we ensure the portability of data? What capabilities do we want and need to maintain ourselves? And one particularly important question is: Have we actually ever realistically simulated a potential switch?
These are operational questions. But it is precisely these details that determine whether an organisation remains capable of acting in an emergency.
So is it not enough simply to develop more European alternatives?
Toon Kockx: Developing European technologies and our own capabilities is important. But developing an alternative is not the same as actually being able to use that alternative. If an organisation has, over many years, built up structures that are very heavily tied to a particular solution – whether for technical or organisational reasons, or due to a lack of expertise – the mere existence of a new option does not in itself create autonomy.
That is why Europe should consider both aspects together: building its own technological capabilities and ensuring organisations have the ability to switch between, combine and replace technologies.
If an organisation wishes to assess its own digital sovereignty, what question should it ask itself?
Toon Kockx: Not: ‘Are we dependent on anyone?’
But rather: ‘Do we know what we are dependent on, do we understand the associated risks, and could we make a different decision if it becomes necessary?’
To me, a sovereign organisation is not necessarily one without dependencies. It is an organisation that consciously manages its dependencies whilst retaining its ability to act.
