European Digital Dependencies

This report examines the structural digital dependencies of European public institutions (in cloud infrastructure, software, semiconductors, and connectivity) and assesses their implications for operational sovereignty and strategic autonomy. Drawing on open sources and policy documents, it provides a diagnostic framework and a set of prioritized recommendations aimed at senior public sector decision-makers, including CIOs, digital strategy leads, and policy advisors. The report situates European dependencies within the broader geopolitical context of technology competition and identifies concrete leverage points for reducing exposure at national and EU level. Published under CC BY 4.0. _______________________ Changelog v1.0 → v1.1 European Digital Dependencies: Diagnosis and Priorities for Public Sector Decision-Makers Version 1.1 is a rigorous revision of v1.0 published on Zenodo (DOI 10.5281/zenodo.19358628). The strategic conclusion of the report and its argumentative architecture remain unchanged. The revision involved systematic fact-checking against primary sources (EUR-Lex, Federal Register, Bundestag, Conseil d'État, Cour des comptes, corporate communications), integration of external feedback, and methodological consolidation. Structural revisions Annex F - Asterès figure. The €264 billion annual figure mentioned in v1.0 has been corrected: it represents purchases by European enterprises (private sector) from American cloud and software providers, not European public sector expenditure. The primary source is now correctly cited (Asterès study commissioned by Cigref and Numeum, April 2025). The structure of Annex F has been recalibrated to distinguish aggregated public expenditure from broader European economic exposure indicators. Annex C - Criterion 1 on extraterritorial exposure. Version 1.0 primarily addressed the CLOUD Act as the vector of American legal exposure. Version 1.1 names and sources distinctly the four relevant instruments (CLOUD Act, FISA Section 702, Executive Orders under IEEPA, Foreign-Produced Direct Product Rule), with consolidated primary references. This revision strengthens the operational test proposed to public sector procurement officers and clarifies the scope of the strict posture toward any material American nexus. Annex D - UK post-Brexit rule. Systematic application of the "UK participation = non-EU flag" rule in the European alternatives table, with corresponding adjustments to affected entries (Bitdefender, Collabora, Element/Matrix). Addition of 3DS OUTSCALE among SecNumCloud-qualified IaaS providers. Revision of the European managed inference entry to reflect existing market offerings. Section 6.3 removed and lightly integrated into 6.4. Reorganisation to remove a documentary redundancy identified during review. Section 1.6 - recalibration of false equivalence objections. The three main objections (AI innovation speed, defence dependency, migration costs) have been reformulated with responses calibrated to what the report can demonstrate, with an explicit distinction between legitimate objections and their use as justifications for inaction. Factual corrections Microsoft / German federal administration: €481.4 million for fiscal year 2025 (source: response to written inquiry by Rebecca Lenhard MdB, Bundestag). IAB Europe: €118.9 billion for the European digital advertising market in 2024. ICC sanctions: dates clarified (Khan in February 2025, other judges and officials over the course of 2025). Visa bans of 23 December 2025: only Breton linked to DSA enforcement; other cases addressed as distinct. Roland Busch quote (Siemens, FT March 2026): reformulated to avoid overstating his position. Section 3.3: removal of the paragraph on China's semiconductor trajectory (10-year predictive claims not properly supportable). Inteca: Poland. Stormshield: subsidiary of Airbus Defence and Space. Pleias and LightOn: distinct entities. Claims removed or corrected: EV foreign subsidies instrument, TikTok DMA interim measure, Microsoft DMA non-compliance, EuroHPC supercomputer count, ICC migration timeline.