After my last week's article A Compass for Europe’s Software Future, my inbox filled up with variations of the same question:
“Do we have a service kill switch?”
Not a literal red button, of course. More like a fear that critical services—health, energy, payments—could be throttled, suspended, or price-shocked if a geopolitical or legal chokepoint tightens.
The discomfort is rational. But the response shouldn’t be digital isolationism—or endless dependency doom-scrolling.
What’s changed is that we now have better data about where Europe actually stands, and a clearer picture of why the gap persists.
Two major reports released in 2025 provide complementary lenses:
Harvard Kennedy School’s Belfer Center published the inaugural Critical and Emerging Technologies Index: a quantitative benchmark across 25 countries and five sectors (AI, biotech, semiconductors, space, quantum).
CDTM (Munich) released The Future of Digital Sovereignty, which treats sovereignty as a societal and economic system—not just a technology checklist.
Together, they explain the same feeling from two angles:
We’re not powerless—but we’re constrained.
The constraint isn’t only technical. It’s behavioural, institutional, and cultural.
1) The Belfer Index: Europe is “third”—but with a heavy anchor
The Belfer Center’s index is sobering in the way good metrics often are: it doesn’t insult you, it just removes your excuses.
Their “key judgments” are blunt:
The United States leads across all five sectors, driven by economic resources, human capital, and a decentralised innovation ecosystem.
China is closing the gap, especially in biotech and quantum, using scale and centralised planning (even while facing constraints in semiconductors and advanced AI).
Europe is competitive relative to the U.S.–China duopoly, and ranks third in AI, biotech, and quantum—but falls behind in space and is eclipsed in semiconductors by multiple Asian leaders.
That last part matters more than it first appears, because Belfer’s methodology assigns semiconductors the highest strategic weight: 35% of the overall index (vs 25% AI, 20% biotech, 15% space, 5% quantum).
So Europe’s position isn’t “we’re behind everywhere.” It’s closer to:
We’re credible in several high-value sectors, but our weakest link is the most heavily weighted.
And Belfer makes a second point that often gets lost in public debate: Europe’s aggregate standing depends on integration of governance and capital across the region. In other words—coordination is part of capability.
2) The cloud numbers: dependency isn’t static—it’s compounding
If semiconductors are the “hard floor” of the stack, cloud is the “soft power” layer where dependency quietly becomes operational reality.
Synergy Research data (widely reported in 2025) paints a parallel story:
The big three US providers (AWS, Microsoft, Google) hold about 70% of the European cloud market.
European providers’ market share has fallen from ~29% (2017) to ~15%, stabilising around that level since 2022—while the overall market grew dramatically.
That’s the part that makes people uneasy: even where European providers grew revenues, the relative position barely improved.
This is why “kill switch” language spreads. Not because someone believes a villain will press a button, but because high concentration creates correlated risk:
licensing changes ripple everywhere
compliance conflicts affect whole sectors
geopolitical shocks become supply shocks
“exit” becomes expensive precisely when you need it
And once organisations embed themselves deeply into proprietary identity, data, and observability patterns, “we could migrate” becomes a story people tell themselves to sleep.
3) Why the gap persists: it’s not only a tech deficit
Here’s where the CDTM report is useful—not because it disputes the numbers, but because it asks a different question:
What social and economic dynamics keep Europe dependent even when awareness is rising?
CDTM explicitly frames sovereignty as a multi-domain challenge—technology, legal, economic, and societal—and highlights trends such as an intensifying tech talent war and a widening digital literacy gap, alongside the paradox that Europe can “govern” through regulation while still relying on non-European foundations.
In practice, three patterns show up again and again.
A) The consumer dilemma: values vs behaviour
Europe often expresses strong preferences for privacy, fairness, and trust. Those values show up in regulation and in niche product adoption.
But when teams are under delivery pressure, convenience wins:
the richest ecosystem
the fastest procurement path
the most integrations
the default “reference architecture”
the most available talent
That’s not hypocrisy. It’s constraint.
If your organisation is measured on quarterly delivery, then choosing a “principled” stack that slows you down can look like malpractice—even if it reduces strategic risk long-term.
B) The talent war: training isn’t the same as retaining
Europe’s educational base in AI is strong.
Multiple analyses suggest Europe has a higher per-capita concentration of AI professionals than the US (often cited at ~30% higher), while still facing persistent brain drain.
This isn’t just about individuals leaving. It’s about losing the cohesive team dynamics that turn expertise into compounding advantage:
research groups that stay intact long enough to build platforms
startups that can hire at scale without losing to US compensation bands
industrial labs that can keep senior talent through the “boring middle” years
A region can “produce talent” and still fail to build durable capability if the winners are elsewhere.
CDTM flags this directly as part of the sovereignty problem: human capital isn’t only a pipeline issue—it’s a retention and ecosystem issue.
C) The digital literacy gap: adoption is moving faster than understanding
CDTM also points to a widening digital literacy gap.
At the basic level, it makes societies more vulnerable to manipulation and misinformation. At the advanced level, it shrinks the pool of people who can:
audit systems
critique model outputs
understand security tradeoffs
build with emerging tech responsibly
When a society can’t confidently use, critique, and create with new technologies, sovereignty becomes aspirational rather than operational.
4) The uncomfortable convergence: regulation and market fatalism can lead to the same place
This is where the public debate gets weird.
On one side, Europe regulates aggressively and projects values globally. On the other, dependency deepens.
And here’s the uncomfortable possibility:
Regulatory maximalism without capability investment can increase dependency—because compliance overhead is easier to absorb for incumbents with scale.
Meanwhile, the opposite extreme—pure market liberalism (“just buy the best product globally, always”)—also tends to produce dependency, because ecosystems and switching costs compound.
Different ideologies. Same outcome:
European organisations build on non-European foundations, exposed to risks regulation alone can’t mitigate.
This is why the “kill switch” narrative is seductive: it compresses a slow systemic dynamic into a vivid threat.
But we don’t need better slogans. We need better engineering governance.
5) A pragmatic stack model: where autonomy is realistic (and where it isn’t)
I like a four-layer model because it forces teams to stop treating “sovereignty” as a monolith.
1) Physical & compute (hardest to shift quickly)
Chips and fabrication are where Europe’s deficit is most constraining—and where Belfer assigns the highest weight.
Full parity here is a long-cycle project. Pretending otherwise is how you burn money and trust.
2) Software foundations (highest leverage through open ecosystems)
Operating systems, middleware, runtime stacks, and the software supply chain.
This is where Europe can build real optionality by:
standardising interfaces
funding upstream maintenance
strengthening secure-by-design practices
treating portability as a first-class architectural property
It’s unsexy—and strategically decisive.
3) Data & AI (where “trust” and “authenticity” become technical)
AI changes the sovereignty discussion because capability isn’t only in infrastructure—it’s also in:
model governance
dataset provenance
evaluation pipelines
auditability of decision support
This is where organisational “faith” shows up: if your roadmap assumes vendors will remain neutral and available forever, you’re outsourcing your future options.
4) Application domains (where Europe can win fastest)
Energy, health, public administration, regulated finance.
Not by building generic clones of US products, but by building domain-specific systems aligned with European legal and cultural standards.
This is where sovereignty stops being politics and becomes product.
6) Practical steps for engineering leaders: move from slogans to systems
If you’re leading a platform, security, or product organisation, you don’t need to wait for a perfect “sovereign cloud” to arrive.
Start with actions that create governability.
Step 1: Run a “sovereignty trace”
List your top 20 dependencies (not vendors—dependencies), including:
identity and access
key management
CI/CD and artifact storage
observability
core data stores
model APIs (if relevant)
Then ask:
If this dependency is constrained for 30 days—what breaks first? What becomes unsafe?
This is not paranoia. It’s architecture.
Step 2: Measure lock-in where it actually lives
Lock-in is rarely “we use Kubernetes.”
Lock-in is:
proprietary IAM patterns
data egress economics
platform-specific logging and tracing
managed services that leak into domain logic
contractual switching constraints
If you can’t name your lock-in points, you can’t manage them.
Step 3: Build credible exit paths (even if you never use them)
Most organisations don’t need multi-cloud heroics.
They need:
open interfaces
portable deployment patterns
documented runbooks for “provider degradation” scenarios
tested restore and migration procedures for critical data
Exit paths are like incident response plans: you hope you don’t need them, and you regret it if you never practiced.
Step 4: Invest upstream as a strategic move
If your stack depends on open source, fund the parts that keep you alive.
That’s not charity. It’s:
patch velocity
roadmap influence
supply-chain security
ecosystem stability
Sovereignty is collaborative—or it’s imaginary.
7) Europe’s tech renaissance: not decoupling, but tech citizenship
If you take Belfer seriously, the message isn’t “Europe is doomed.” It’s “Europe is positioned—if it integrates and invests where it matters.”
If you take CDTM seriously, the message isn’t “sovereignty is a procurement checkbox.” It’s “sovereignty is a socio-technical transition with human capital, literacy, and incentives at the core.”
So the renaissance I’m seeing isn’t about building a wall around Europe.
It’s about moving from being digital subjects of imported platforms to becoming tech citizens who actively govern their tools:
eyes open to dependency
disciplined about standards and exit paths
investing in upstream ecosystems
building domain capability that reflects European norms
treating governance as part of engineering, not paperwork
That’s slower than slogans. But it’s also how durable systems are built.
Final thought: Don’t Treat the “Kill Switch” Fear Like a Story — Treat It Like a System You Can Audit
If there’s one message in this article, it’s this:
The data doesn’t demand panic. It demands engineering discipline.
The Belfer Index and the cloud market numbers aren’t a prophecy of collapse. They’re a signal that Europe’s position is constrained in foundational layers (especially semiconductors) while dependency deepens in operational layers (especially cloud and platform ecosystems).
Europe can’t (and shouldn’t) rebuild the entire global stack inside its borders. But we can stop letting sovereignty happen by accident—through procurement defaults, inherited architectures, and “we’ll migrate later” assumptions that never get tested.
The move now isn’t “buy European” as a reflex. It’s this:
Treat technological sovereignty like a set of measurable, stress-testable capabilities—and audit them like you would audit security.
That means:
mapping your real dependency graph across cloud, software supply chain, data, and governance—not just your vendor list,
distinguishing what’s critical under stress from what’s merely convenient,
and building credible exit paths where the risk is non-negotiable (public administration, critical infrastructure, safety-relevant systems).
Most organisations don’t have a sovereignty problem. They have an observability problem:
they can’t explain which systems fail first under legal, pricing, or geopolitical constraints,
they don’t know which dependencies are “single points of policy failure,”
and they can’t show—inside a board room or a ministry—that their choices are defensible.
So what’s your next move?
If you build and ship (engineer / architect / platform lead)
Pick one system that matters and do a Sovereignty Trace:
List the top 20 external dependencies (cloud services, identity, CI/CD, package registries, model APIs, key OSS libs).
Mark each one as: replaceable in 30 days / 90 days / not realistically replaceable.
For the “not replaceable” group, answer one hard question:
“If this dependency is constrained, what is our minimum viable operating mode?”
Bring that to your next architecture review. If you can’t describe a degraded mode, you don’t have resilience—you have hope.
If you lead people (EM / Head of Engineering / Director)
Run a 90-minute Capability Under Stress workshop with staff engineers and security.
Choose one critical domain (identity, data platform, build pipeline, cloud runtime, or model serving) and map:
the dependency chain (providers, jurisdictions, key components)
the operational choke points (billing, keys, auth, APIs, SLAs, egress constraints)
your time-to-recover assumptions (what you think is replaceable vs what actually is)
End by agreeing on:
the top 3 risks you can realistically mitigate this quarter
one concrete “exit-path” investment (standards, portability, runbooks, drills)
one procurement rule that prevents future lock-in
Write it down. Treat it like an engineering policy—not a slide deck.
If you own the roadmap and budget (CTO / CIO / public-sector lead)
Make sovereignty a gate for major initiatives.
Don’t just ask “Is it compliant?”—ask:
Is it auditable?
Is it portable where it needs to be?
Do we know which external actor can stop this from working—and under what conditions?
Do we have a credible alternative for the systems we cannot afford to lose?
Reserve part of your budget specifically for sovereignty audits and remediation, the same way you reserve budget for pentests and incident response readiness.
Because if you can’t show where you have dependable capability under stress, you don’t have a sovereignty strategy—you have a collection of assumptions.
If this article had one underlying argument, it would be this:
You wouldn’t run critical infrastructure without monitoring, threat modelling, and disaster recovery. Don’t run critical digital dependencies that way either.
That’s where I can help.
I work with engineering organisations to:
audit dependency and sovereignty risk across cloud, software supply chain, data, and governance,
identify where critical systems rely on fragile single points (vendor, jurisdiction, platform policy, maintainer risk),
design pragmatic mitigation plans (portability, open foundations, procurement criteria, secure supply-chain practices),
and build clear evidence leaders can use to make defensible decisions—without turning delivery into bureaucracy.
If you want help turning “we hope our dependencies are fine” into “we’ve audited our exposure, prioritised the risks, and we have credible options,” start here: 👉 https://www.danielrusso.org/evidence-based-organizational-change/ (Öffnet in neuem Fenster)
Datum
30.01.2026
