The Weakest Link and the Final Say¶

Stéfane Fermigier

Download the PDF

Abstract¶

On 17 June 2026 France and Germany published a joint paper proposing a common definition of digital sovereignty, intended to feed the Tech Sovereignty Package the European Commission is preparing. The paper turns that definition into an assessment framework: six dimensions, one of them the ability to change supplier, against which each product or service would be scored, with requirements graded by how critical the use is. This commentary asks what that assessment framework will produce once it is used to score offers, since a supplier that knows what it is scored on chooses what to disclose and what to fix. The paper's main choices are good. Four design choices of the framework would nonetheless work against its purpose; a fifth point, on open source, needs a complement.

First, the paper allows a good score on one dimension to compensate a bad score on another. The dependency of a service on its suppliers does not add up that way. A service rests on a chain of technical building blocks (hardware, hosting, operating system, identity, applications); it takes one block with no alternative being controlled from outside for the whole service to be interruptible, whatever its other qualities. The author's earlier work, on which this commentary draws, verifies this mechanism block by block on the European digital infrastructure. For a given use, it is therefore the weakest dimension that should set the score; compensating only makes sense when arbitrating investments across several uses.

Second, to judge whether a supplier can be trusted, the paper looks first at where its parent company is headquartered. That legal criterion captures one of the ways a supplier can be controlled from outside. Another is economic and depends on no extraterritorial law: 83 percent of European business spending on cloud and software, about EUR 330bn of 400bn a year, goes to US vendors, in figures commissioned by a buyers' association. On contracts already in place, the spending those buyers report grows 8.7 percent a year; how much of that growth is rent is not identified. None of the six dimensions observes the trajectory of the prices paid by customers already equipped.

Third, the paper defines the ability to change supplier as possible "within reasonable time and financial expenditure", which is the right definition; instruments already exist to measure that time and that cost. The paper nonetheless reasons as if the incumbent supplier, the one a customer already depends on, stayed passive. It is the incumbent that sets the cost of leaving, through its contracts more than its technology: fees for taking one's data out (egress fees), discounts conditional on a multi-year commitment, new AI features bundled into existing contracts. The assessment must therefore score contracts as well as architectures.

Fourth, the framework is voluntary and each actor applies it to its own dependencies. Combined with compensation across dimensions, this is the configuration most favourable to offers that declare themselves sovereign without being so: the supplier shows the dimensions where it is strong while the decisive weakness stays out of view. The remedy is in the paper itself. Its transparency requirements on ownership, on third-country dependencies and on software components (the software bill of materials, SBOM) are the makings of a verification infrastructure. That requires the declarations to be checked against independent observation and the overall score to be unable to mask the weakest dimension. The Commission already applies the minimum rule to its own cloud purchases: in its Cloud Sovereignty Framework, an offer below the floor level on any of eight objectives is set aside whatever its overall score; the external check is the addition this commentary proposes.

The paper wants a concept "as operational as possible"; operational means measured. The table in Section 8 gives, for each of the six dimensions, the measurable object that corresponds to it, the instrument that computes it and the state of that computation.

This paper comments on a public policy document and computes no new numbers; every imported quantity cites either a public source or the verification suite of the corpus paper it comes from. A French edition of the same version, « Le maillon faible et le dernier mot » (franco-german-commentary-fr-wp.md), follows the French text of the joint paper where its two language versions differ.

Keywords: digital sovereignty, Franco-German joint paper, dependency networks, switching costs, weakest-link aggregation, open-source software, public procurement, sovereignty-washing.

JEL: F52, L86, O25, D82.

The economic channel of control: most European business spending on cloud and software goes to US vendors, and prices on the locked base keep rising.

About this paper¶

Cite this paper¶

Fermigier, S. (2026). The Weakest Link and the Final Say.
Policy paper, Abilian Econ Lab.
https://econ.lab.abilian.com/papers/franco-german-commentary/