That raises an uncomfortable question. What does it mean for our digital sovereignty if vital infrastructure largely runs on technology that falls under foreign law? Anco Scholte ter Horst, Business Development & PR Officer at The Good Cloud and former CEO of Freedom Internet, explains why it is becoming increasingly important to also consider Dutch and European cloud solutions.

Digital sovereignty or digital autonomy?

The debate about cloud and dependency often includes the term digital sovereignty. However, Anco prefers not to use that term. “Sovereignty sounds like we have to do everything ourselves,” he says. “That is not realistic. Autonomy means you have choices.”

That's why he prefers to talk about digital autonomy. As an organization, can you decide where your data is located? Can you adapt your infrastructure when circumstances change? Can you switch without your entire business getting stuck?

Why digital autonomy is no longer an abstract debate

In practice, digital autonomy touches on a concrete concept: risk management. Organizations are used to identifying risks in the areas of finance, compliance and cybersecurity. However, the dependence on foreign cloud infrastructure is rarely explicitly included in that analysis. “We take cybersecurity very seriously, but cloud dependency is often not even in the risk matrix,” Anco underlines.

When data falls under foreign law, that means that other legal regimes can, in theory, enforce access. The US CLOUD Act is the best-known example of this. Even when data is physically stored in Europe, a US parent company may be required to hand over data under certain circumstances.

For a long time, that scenario was seen as theoretical. But geopolitical relations are less stable than ten years ago, and the risk for vital sectors such as government, healthcare, energy, education and media is real. Digital autonomy thus becomes an administrative responsibility: can you, as an organization, continue to operate independently when political or legal circumstances change?

From logical choices to vendor lock-in

The dependence on American hyperscalers such as Microsoft, Google and Amazon is not the result of ignorance, but of logical choices. For years, these parties offered scale, reliability and integrated ecosystems that were difficult to match. In addition, economic incentives played a role. Education and government received attractive entry-level models and complete suites that worked easily and made costs predictable.

As a result, organizations are increasingly intertwining their infrastructure with one platform. They set up processes, work agreements and training courses on that ecosystem, making switching step by step less logical and less attractive.

Vendor lock-in is not caused by one big decision, but by a series of practical choices that reinforce each other. At the same time, opting for an established market leader feels safe, which further reduces the tendency to seriously consider alternatives.

Persistent misconceptions about European solutions

This gradual dependence also explains why the conversation about alternatives is often difficult. Once an organization is fully set up for one ecosystem, each alternative is automatically measured by the same yardstick. According to Anco, perception plays a major role in this. “Many organizations think they will have to make a huge sacrifice if they opt for a European solution,” he says. “But that image is often no longer true in practice.”

“You're sacrificing usability”

One of the most common objections to European cloud solutions is that they would be less user-friendly, but that assumption is becoming less and less sustainable, Anco explains. There are now mature European alternatives for standard functionalities such as e-mail, document editing, file sharing and video calling. Many of these solutions are browser-based and support common file formats. Collaboration in documents, version control and external sharing options are no longer exceptions, but standard functionalities.

That doesn't mean that every detail is identical to the best-known US platforms. “But for most of the daily activities, users experience hardly any difference in productivity,” says Anco.

'Migrating is too complex'

Another block is the idea that switching should be a comprehensive and risky project. Organizations face the need to replace entire environments at once, resulting in major process disruption.

In practice, this doesn't have to be the case at all, Anco explains. Many organizations opt for a phased approach. They start with specific components, for example sensitive data or internal document storage, while other components will continue to function in a hybrid model for now. “You don't have to go from zero to one hundred. Start with one part.”

'European solutions are more expensive'

On paper, US providers often seem cheaper, especially in bundles or entry-level models. Still, it's important to look beyond the monthly licensing costs, says Anco. This is because the total costs also include data exports, additional compliance requirements, integration complexity and future price developments.

In addition, wider economic demand is at play. When Dutch public and private organizations buy en masse from non-European providers, capital flows out of the European innovation ecosystem. European alternatives are sometimes slightly more expensive per user, but usually work with more transparent cost structures and a different revenue model. That difference also reflects a different vision of data and digital infrastructure. “If we buy everything from US parties, we should not be surprised that European alternatives remain small,” Anco adds.

What does digital autonomy mean in concrete terms for organizations?

Digital autonomy starts with insight, says Anco. That is why organizations would do well to critically analyze their cloud landscape. What applications do we use? Where is data stored? What jurisdiction does it fall under? How easy is it to migrate data or terminate contracts? Is there an exit strategy?

For directors and CISOs, this means that cloud choices must become part of broader governance and risk frameworks. Data classification can be a first step in this regard. Not all data is equally sensitive. For some workloads, an American hyperscaler may remain a logical choice. For others, a European solution is strategically wiser.

Autonomy is not about complete self-sufficiency, but about conscious consideration.

There are situations where choosing a European or Dutch solution is logical. This applies, for example, to privacy-sensitive data, to vital processes or to organizations with a public responsibility.

For sectors where continuity and legal control are crucial, limiting dependency can become an explicit policy choice. This does not mean that all international technology should be excluded, but it does mean that critical components are carefully considered. Anco says: “Not everything has to be European, but at least you know why you choose something.”

From awareness to action

The dependence on American companies is high. But awareness is also growing, both in business and politics in The Hague.

However, awareness alone does not change the infrastructure, says Anco. European suppliers can only further develop when there is actual demand: without adoption, innovation remains limited. Autonomy therefore requires not only analysis, but also a willingness to seriously test alternatives. “The question is not whether it is possible. The question is whether we think it's important enough.”

‍