This article is authored by Ansgar Baums, Author of ‘Tech Cold War’ and ‘Die Stunde der Nashörner’, and Manuel Kilian, Managing Director, Global Government Technology Centre Berlin.

Europe's digital future must not get caught up in endless definitional loops. The following ten bold theses aim to cut through the current rhetoric and chart a pragmatic path involving strategic bets, smart interdependence and grounded risk assessment.

Debates around the two terms of 'digital sovereignty' and 'Euro Stack' dominate European policy circles, yet they have become increasingly trapped in endless semantic sparring matches. Each new paper offers its own interpretation of these contested terms, and in the meantime, Europe is losing precious time in a rapidly evolving digital landscape. The result is frustrating: shallow terminology, circular arguments and, critically, a lack of meaningful progress.

This article takes a different approach. Rather than adding to definitional chaos, it presents ten substantive theses that address the core of Europe's digital challenge. These theses focus on three key areas: fundamental questions about the nature of sovereignty itself; strategic priorities and resource allocation; and a realistic assessment of the specific risks dominating policy discussions. Several of the theses draw on valuable contributions from others already engaged in this debate, which we greatly appreciate.

Together, the ten theses invite all those engaged in these debates to join a more structured and focused discussion — disagreement with and critique explicitly welcome. In this sense, please consider this an initial version that we hope to complement with future work on more specific policy recommendations. If you would like to contribute or get involved otherwise, please get in touch with us.

Intelligent Dependence Is the Goal

1. Digital Sovereignty Means Intelligent (Inter-)Dependence, Not Digital Independence

Digital sovereignty is the agency and capacity of any organisation to make intelligent, informed choices to shape its digital future by design (as argued here by Mike Bracken CBE). If sovereignty is defined as owning every layer of a technological stack, it can quickly become counterproductive. This leads to fragmented systems, limited interoperability and a retreat from global cooperation. Instead, the goal is intelligent dependence and interdependence (cf. thesis number 3). This involves making better decisions about what to depend on, under what conditions and for how long.

2. There Is No Viable Alternative for Europe to the Transatlantic Digital Hemisphere

Europe depends on an accessible and growth-focused transatlantic digital hemisphere. There is no economically viable alternative — regardless of shifting political currents on either side of the Atlantic. Europe is dependent on access to the US market, particularly at a time when the future of market access in China is uncertain. Furthermore, the establishment of a separate European digital hemisphere would not be in the interest of European-based global companies. Access to best-in-class digital technologies is absolutely crucial for European companies to grow globally. Making the employment of such technologies more difficult is the opposite of smart industrial policy-making.

In the Euro Stack debate, some voices seem to neglect the significant cost of achieving complete digital self-reliance. Creating a separate European IT stack would be extremely costly — estimates go in the trillions of euros. For example, establishing a European operating system for mobile devices could, according to our own rough estimates, cost EUR 15 billion, while global investments in data centre expansion could reach USD 3 trillion by 2028. These investments would necessarily divert capital from other strategic priorities — making this fundamentally a question of optimal capital allocation. Europe would struggle to fund such investments, and even if this were possible, the opportunity cost of foregoing alternative investments would be substantial.

Irreplaceability Instead of Going It Alone

3. Europe Must Achieve Irreplaceability within the Western IT Stack

While Europe should deepen its integration with the transatlantic digital sphere, it needs to actively manage the strategic risks that come with it — this is the core policy conundrum that needs solving that many policy papers miss. In reality, managing the strategic risks will mean optimising for mutual interdependence, where both sides of the Atlantic have strong incentives to cooperate, and the cost of decoupling is too high for either to bear. Such Interdependence is achieved by making Europe irreplaceable within the Western IT stack. The more technologies Europe builds that US companies and administrations rely on, the stronger Europe's leverage.

4. Irreplaceability Will be Achieved by Making Big Bets on Next-Generation Technologies, Not Replicating Existing Ones

For Europe to become irreplaceable in the Western IT stack, it must make bold, strategic investments in next-generation technologies offering long-term leverage. Duplicating existing commercialised technologies, particularly in areas where others already dominate, dilutes focus and resources, and undermines Europe’s ability to lead where it can.

Furthermore, a broader view of the tech stack is needed. Current debates fixate almost entirely on the cloud layer, overlooking where Europe is strongest: At the edge and the operational technology stack. This is where AI is set to transform industrial verticals such as manufacturing and automotive, as well as industrial automation — verticals in which Europe has a real advantage. A forward-looking strategy should build on these strengths rather than chasing yesterday's successes.

Demand-Driven Innovation, Not Supply-Side Fantasies

5. Stacks Are Not Built in Isolation; They Emerge from Successful Services

Digital ecosystems do not emerge from top-down engineering or pristine stack diagrams. They evolve from real-world, user-driven needs: a messy, iterative process grounded in solving specific problems. Services come first. Platforms follow. Infrastructure is successful when it is the by-product of providing something that people actually want (as rightfully argued here by Mike Bracken, David Eaves and Michelle Wronski).

This core truth is often overlooked in the seductive clarity of 'stack thinking'. Amazon did not start by building its cloud service AWS — it began by selling books online. The infrastructure came much later, shaped by real commercial demand. The same logic must apply to Europe. Rather than building abstract infrastructure in search of applications, we should focus on solving real problems for users and businesses. Successful services generate the gravity that makes infrastructure useful — and ultimately, sovereign.

6. Act as One Market, Attractive for Others to Join

No European country has the market size to sustain an independent digital ecosystem. Even collectively, the EU's 450 million users are fewer than those in China or India alone. This reality demands two parallel strategies. Firstly, Europe must finally create a genuine single digital market — eliminating the fragmentation that allows a US startup to access 340 million users immediately while European startups face 27 different regulatory regimes. Second, this unified European market should be open to global partners through the adoption of open standards and interoperability protocols. The goal is not to create a fortress Europe, but rather an open and attractive digital ecosystem that others will want to participate in.

Public Sector Procurement and Open Source: Strategic Instruments, Not Silver Bullets

7. Public Procurement Must Become Outcome-Focused and Stack-Savvy

European governments are facing an increasing legitimacy crisis. Citizens expect better public services, and when digital transformation initiatives fail, this fuels distrust and drives support for populist alternatives. Following the Second World War, liberal democracy was not only about values, but also about delivering better outcomes than authoritarian regimes. This promise now seems increasingly fragile.

Public sector procurement cannot become a playground for digital sovereignty experiments that distract from its core purpose: Securing the best possible solutions at the best possible cost. It must remain relentlessly focused on outcomes. This is all the more important because procurement operations are already under pressure. In recent years, many countries have layered on complex qualitative criteria, yet most procurement offices remain under-resourced, risk-averse and overwhelmed by procedural burdens. In this context, procurement alone cannot — and should not — carry the full weight of a country’s digital strategy.

What must be done by governments, however, is procurement optimisation towards resilient technology architecture. This involves creating tenders that ask for modular, multi-vendor systems in which critical components, such as chips, cloud services and software, are considered replaceable commodities rather than permanent dependencies. The goal is strategic flexibility, not self-sufficiency for its own sake. When switching costs are low and credible alternatives exist, dependency becomes a choice rather than a risk. Equally important is the fact that public sector solutions that prove effective in one country should not be reinvented in another. If a service works, it should be adopted across Europe. 

8. Open Source Is Here to Stay — but We Need to Be Realistic About Its Role

Open source development and public sector interoperability can lay the foundations for a more inclusive digital ecosystem — one that fosters positive network effects rather than excluding potential partners. However, open source is not a silver bullet. In today's geopolitical environment, it faces real vulnerabilities, as demonstrated by the XZ Utils backdoor case. Rather than pretending such risks do not exist, Europe should take the lead in developing robust governance frameworks that ensure security, accountability and trust, rather than relying on the vague promise that 'anyone can inspect the code'.

Unfortunately, the open source debate is often clouded by ideology, which harms its cause. It is common sense that some layers of the technology stack should be open source — this is already standard practice across much of the industry. However, insisting that open source solutions deserve preferential treatment simply because they are open misses the point. Some open source services are driven by the same commercial incentives as proprietary ones and are not necessarily more cost-effective.

What is often lacking is a clear-eyed, comparative view. What is the actual total cost of ownership at feature parity? Which option delivers the best long-term value for the public sector? This is not about being for or against open source. It is about intellectual honesty and focusing on outcomes rather than slogans.

Realistic Risk Assessments Instead of Doomsday Scenarios

9. The ‘Kill Switch’ Scenario is Geopolitical Theatre, Not Policy

The idea that the US political leadership could suddenly force American tech companies to shut down services for European clients — the so-called 'kill switch' — is largely a doomsday scenario used for rhetorical effect. Such an action would represent a severe breakdown in transatlantic relations, bordering on economic warfare. Disabling digital services used by public administrations or critical infrastructure would be considered an act of aggression and would almost certainly provoke retaliation by European governments. Such counter-measures would inflict crippling economic pain on both sides — just imagine European business software would be ‘kill switched’ in the US.

Although the actual ‘kill switch’ scenario itself is bogus, the debate surrounding it should be taken seriously. It is a worrying sign that the transatlantic relations have degraded to a point where such doomsday scenarios are taken seriously by many. 

10. CLOUD Act Risks Are Real but Manageable

The risks associated with the US CLOUD Act are often exaggerated. Some voices in the sovereignty debate frame the fact that US companies are subject to lawful access legislation as a reason to abandon or even outlaw the employment of US technology in Europe. This is disproportionate for two reasons: First, all companies, regardless of where their headquarters are located, are subject to lawful access legislation, and the CLOUD Act is no exception. Second and more specifically, US CLOUD Act legislation applies to any company with business operations in the US, even if the headquarters are in Europe, as the French cloud provider OVH has recently stated. Is it then wise to quit OVH because of it? Absolutely not. The same applies to the services of US headquartered companies.

In practice, lawful access  does not pose an unmanageable risk, as the numbers suggest that these instances are very rare. Rather than fixating on doomsday scenarios, European governments should establish transparent and clear criteria for the use of cloud services within the public sector and critical infrastructure. Sound policy, legal safeguards and contractual controls can help to manage risk. Sovereignty is not about eliminating risk; it is about managing it effectively.