Beltug digital sovereignty sounding board: pragmatism over ideology

Organisations are making long-term decisions about cloud, Artificial Intelligence (AI), data protection, resilience and supplier strategy while the legislation that will shape their operating environment won’t take effect for several years. Beltug wants to make sure the operational reality of business users is heard early enough to influence how those rules are shaped.

In this first sounding board, the discussion quickly moved beyond policy theory to focus on a central, practical question: how can digital sovereignty strengthen Europe without creating unnecessary complexity, reducing choice or disrupting existing operations? 

For business users, the debate around this challenge should first and foremost be about keeping data secure, available and under sufficient control.

The findings from the sounding board included:

• Support for sovereignty levels in public tendering: The business users reacted positively to the legislation’s intention to use the public sector as a lever to scale sovereign solutions. They welcome CADA’s four sovereignty assurance levels for public tendering of cloud and AI services. If this approach is successful for the public sector, it will also benefit the private sector, especially by making very clear which sovereignty criteria have been met. However, concerns were raised about the additional costs of sovereignty requirements in public tendering.

• Sovereignty is not a yes/no choice: Organisations have different sovereignty needs, depending on business requirements and the sensitivity of their data. They operate in complex environments where workloads, data types, business-critical processes and risk profiles require different levels of assurance. The key question for users is not simply whether a provider is European or non-European, but how secure their data is, who can access it, and how continuity can be guaranteed.
• Questions remain on the four sovereignty assurance levels: Members underlined the need for clear, usable criteria, including:
  • what is possible at each assurance level
  • what non-European providers can or cannot offer
  • how joint ventures or partnerships should be assessed

• Consistency across Europe will be critical to success: Although the four assurance levels are intended to create a common basis across the EU, Member States may still define which level is required for different public sector applications. The risk of fragmentation is thus real. Different national approaches would increase complexity and barriers to scaling across Europe.
• AI is seen as the most difficult area for future sovereignty policy: The investment gap between European players and non-EU players is enormous. At the same time, AI is increasingly embedded in business applications, creating new forms of dependency and potentially even stronger vendor lock-in. Europe needs to choose its AI battles early on, at the same time this market is being built.
• Exit & portability options are essential: However, participants also warned against oversimplifying what portability can achieve in practice. The Data Act has not yet delivered on its promises: switching clauses are not yet included in all contracts, and many users are not aware that egress fees should end as of 1 January 2027. Beltug questions whether regulators will be able to handle enforcement in practice and when.
• Beltug calls for a sharper definition of the scope: As AI capabilities become embedded throughout enterprise software, the distinction between cloud services and business applications is increasingly difficult to maintain.
• Sovereignty should strengthen resilience, not weaken it: Whatever sovereignty framework emerges, business continuity remains the top priority.
• CADA must become a workable European framework: It should be simple enough for organisations to use, clear enough for procurement teams, and strong enough to support a more sovereign European digital economy.
• There may be some legislative contradictions: Participants raised questions about possible interactions or contradictions with other legislation, including the revision of the Cybersecurity Act.
• The conversation is only starting: This first sounding board confirmed that digital sovereignty is no longer an abstract policy concept. It is becoming a practical business issue that affects cloud strategy, procurement, innovation, AI adoption, continuity planning and risk management.

Beltug will continue the sounding board series to ensure the voice of business users remains part of the European digital sovereignty debate.