More capability.
Enough control?

WHY THE POLICY DEBATE MATTERS

Public decisions make private dependencies easier to see.

France’s April 2026 interministerial announcement described work to reduce extra-European digital dependencies. DINUM announced a move away from Windows towards Linux for its own workstations, alongside wider departmental planning. This was a programme of change, not evidence that the whole French state had already migrated successfully.

The Open Rights Group’s April 2026 report argues for digital commons and reduced dependence on dominant technology suppliers. EuroStack’s 2025 policy proposal examines a wider European technology stack. These are policy arguments and proposed approaches; they are not certification that every European service is independent or that every open-source migration saves money.

Public concern over foreign technology in health services has brought these questions into procurement discussions. A particular contract, governance dispute, or political controversy needs evidence on its own terms. It should not stand in for a general finding that a foreign provider necessarily misuses data.

An SME can take the practical question from this debate without copying a government procurement programme: what decision could an important supplier make that would leave the business with no usable alternative?

FOUR DIMENSIONS OF CONTROL

The invoice does not show the whole dependency.

A platform can be highly secure against intrusion while creating a difficult exit. A locally headquartered supplier can still rely on upstream infrastructure outside the jurisdiction. Conversely, a global platform can provide useful contractual controls, resilience, and functionality. The review needs evidence of the actual service, rather than a conclusion based on its flag.

JURISDICTION

Location is one fact in the legal analysis.

The US Department of Justice’s CLOUD Act explanation describes lawful demands involving providers subject to US jurisdiction and information within their possession, custody, or control. It does not describe unrestricted access to all data everywhere. Physical storage location alone is therefore not a complete answer to the access question.

The 2018 Microsoft litigation became moot after the CLOUD Act changed the relevant framework and a new warrant was issued. It should not be described as a final ruling that established a general right of access to data in Ireland. Examine the law and the particular service.

Ask who contracts with the business, who operates and supports the service, who controls encryption keys, and how legal demands are handled. Document notification arrangements and their limits. Obtain advice for regulated or sensitive information; neither a marketing label nor a residency selection is a substitute.

A useful scenario to test is: if support or identity depends on another region or entity, what happens when that dependency is unavailable or its permissions change?

LOCK-IN / THE COST OF LEAVING

An export button is only the beginning.

A usable exit needs more than a download. The business may depend on application logic, identity, permissions, integrations, retention rules, staff knowledge, and suppliers that expect a particular platform. Rebuilding those relationships can be more demanding than moving the files.

Consider a clearly illustrative small business moving a case-management service. It can export client records, but must also preserve access restrictions, reconcile documents, reconnect billing, train staff, and prove that the new service supports live work. The risk is not that the export failed; it is that the operating process was never portable.

Build portability into procurement while there is still a choice. Ask for supported formats, migration assistance, deletion evidence, limits on access during transition, and the cost of parallel operation. Assign a business owner to decide what a successful move would look like.

Interoperability can reduce dependence, but it does not remove all transition effort. Open-source software still needs maintenance, security expertise, hosting, and support. Those responsibilities should be costed rather than assumed to disappear with the licence fee.

ALTERNATIVES / A REALISTIC SME RESPONSE

Create choices without a wholesale replacement programme.

Procurement shapes the market as well as the buyer’s capabilities. Broad import-share and open-source-return estimates concern particular research contexts; they cannot establish a guaranteed return on an individual SME’s switch.

The EuroStack catalogue can help discover candidates. Its size is dynamic, and inclusion alone does not establish jurisdiction, technical suitability, upstream independence, or support quality. Assess the shortlisted service against the work it must do.

SMEs may be able to make a focused change quickly, but limited staff and specialist skills can constrain the options. Start where the exposure and the achievable improvement are both clear. Retaining a supplier can be a sound decision if its dependencies and exit limits are understood and accepted.

SOVEREIGNTY IN SERVICE DELIVERY

Make the proposition specific enough to check.

CyberSolace’s digital brand protection proposition emphasises UK/EU delivery, defined data jurisdictions, transparency, tailoring, and client visibility. These are meaningful questions for a service conversation. They should be confirmed in the actual scope, supplier arrangements, and contract for the service being proposed.

Ask what data the service needs, where it is processed, which parties handle it, and how the client can inspect decisions and leave. Brand monitoring, investigation, and takedown work may interact with registrars, hosts, platforms, and legal processes in several jurisdictions; the delivery location does not control every external party.

Sovereignty becomes useful when a client can distinguish a contractual commitment, an operational design choice, and a dependency outside the provider’s control. It is less useful as an absolute claim that no cross-border exposure can exist.

THE MANAGEMENT DECISION

Know which choice you are preserving.

Place the dependency alongside other business risks. Record the service owner, relevant authority, credible interruption, exit constraints, and the evidence supporting the current decision. Review it when integrations, support arrangements, data sensitivity, or contracts change.

The objective is informed control: using good technology while retaining enough understanding, contractual clarity, and practical capability to respond when conditions change. A tested option can improve negotiating and recovery choices even if the business never exercises it.