Policy papers¶
These are filings and briefs addressed to a live policy process. They follow the same evidence discipline as the rest of the programme, and they are written to a deadline and a reader: a consultation, a call for evidence, a funding decision under preparation. Where a draft working paper proves a result, these argue for an instrument, and they say where the argument runs out.
Loi République numérique : dix ans d'« encouragements », pour quels résultats ?¶
In French. Article 16 of the Digital Republic Act of 7 October 2016 told French administrations to preserve the "control, durability and independence" of their information systems and to "encourage" free software and open formats. Ten years on, the note draws the balance sentence by sentence: the obligation had no implementing text until a decree of March 2026 that covers only projects above 15 M€; the incentive got a mission of at most three full-time staff and an interoperability framework frozen at its 2015 version; the decade's big contracts, from the Health Data Hub to the Armed Forces' Microsoft agreement, went to the same vendors, and the State's spending on them rose. It explains why "encourage" could not work, reads the 2021 cloud doctrine as a displacement of the question from software control to hosting jurisdiction, shows with the priorities of 2006, 2012 and 2013 that a written priority without a designated reader fares no better, and proposes five measures, from a yearly published map of software dependencies to a conditioned priority read before the decision by the DINUM's successor, and a French position at the Council on Article 41 of the Cloud and AI Development Act, which reuses the 2016 verb.
"Or Equivalent": Open Source, Product Neutrality, and the Service Contract¶
In March 2026 the Bundestag's research service answered a member's question on whether a public tender may be restricted to open-source software, and the procurement press condensed the answer into one sentence: a blanket, politically motivated restriction is impermissible. The note reads the opinion in full. It says the restriction is lawful when its reason is written down, that a statutory priority for open source is lawful when conditioned, and that after the Court of Justice's January 2025 ruling on self-created exclusivity, choosing open source at first award may be required. The opinion analyses one object, buying software; the debate concerns three. On the one that earns the providers' revenue, services on open-source software already in place, naming the product restricts no bidder, as the Conseil d'État held in 2011 and a German procurement chamber in 2021. A count of TED notices puts a fifth of Germany's software awards outside any prior call for competition. Five asks follow, for the Strategy's tender guidelines, the CADA implementing acts and the Public Procurement Act proposal of 9 September 2026.
Ask Me Something Hard: Why Three Fifths of Europe's Sovereignty Score Cannot Tell Suppliers Apart¶
A sovereignty score exists to tell a public buyer whether a supplier offering a European service is genuinely beyond the reach of a foreign state, or a subsidiary presenting the appearance of one. The note applies one test to every criterion of eighteen deployed instruments: can a foreign-controlled supplier answer this as cheaply as a European one, and can verification reach the difference? Three fifths of the Commission's weighted SEAL score sits on criteria that cannot separate the two, under either of the weight vectors the Commission publishes. The five criteria the field asks most all fail the test; two instruments restricted to their common criteria reorder a third of supplier pairs on grouping alone; the Commission's calculator neutralises the three ownership questions with the most separating power; and eleven of the twenty-two criteria that pass need no declaration from the supplier. On twelve suppliers, two machine probes separate the types with no foreign-controlled supplier cleared. Three recommendations to the co-legislators on the Cloud and AI Development Act.
Measure Twice, Buy Once: the Cloud and AI Development Act's assurance levels against the Commission's own SEAL scale¶
The Commission now maintains two graded measures of cloud sovereignty. The SEAL scale of its own Cloud Sovereignty Framework has already chosen suppliers for one tender; the four Union assurance levels in Annex II of the Cloud and AI Development Act, now before the Council and the Parliament, will decide what every European public body may lawfully buy. A crosswalk of all 48 questions in the Commission's own assessment against Annexes II and III finds that neither scale contains the other. A service at Union assurance level 4, the top of the Regulation's scale, can score SEAL-0; a service at SEAL-4 is not guaranteed to reach level 2. Of the 39 questions that can lower a service's score, 14 are reached by an Annex II criterion and 8 appear only as audit evidence with no criterion behind them. The other 17 are reached nowhere, among them open standards, interoperability, the customer's ability to leave and the origin of hardware. Annex II mentions open source once, to impose on it a tamper-control duty that a European proprietary component escapes. Eight amendments follow, ranked by consequence; the cheapest moves into Annex II text that Annex III already contains.
Measuring the Stack: paths, exit costs and the instruments that reach them¶
The Commission's Tech Sovereignty Package of 3 June 2026 made the technology stack the unit of policy, and industry has followed with stacks of its own. This position answers three questions the word leaves open: what a stack measures, where in it the cost of dependence sits, and which instruments reach that cost. Dependence composes along paths, so a criterion satisfied at every layer can still leave one controller able to stop the whole path; on the lab's measured graph of the European digital stack, a single bloc acting alone can cut every European buyer. The measurements show how the layers differ, from the silicon floor that only capacity investment moves to identity, which has the highest exit friction the lab has measured. The cost of dependence is the cost of leaving: an instrument lowers the price only through the part of that cost it touches. A component bundled at no extra price never comes up for renewal, so subsidy is inert against it, while itemised pricing and an evaluation duty restore the decision. Written for policymakers, with every technical term defined where it first appears.
A local trustee is not immunity: why a local partner and a local data centre are no shield from US law¶
In a trustee-model cloud offer, a local operator runs a US vendor's software in a local data centre. That settles where the data sits, and keys held locally raise the bar on silent access. It does not put the systems out of reach of US law, which follows control of the software wherever the servers sit: the CLOUD Act hooks on control, Section 702 of FISA compels providers programmatically, and Executive Order 12333 needs no request at all. The software, the update channel and the vendor's support access stay where they were. A withdrawn licence, an export control or a sanction can stop a service the trustee cannot maintain alone. The certain cost is economic: on the vendor's proprietary interfaces the cost of leaving is unchanged, so the price a buyer can be charged is unchanged whether or not any authority ever asks for anything. The note ends on what to require instead, and on the status of Section 702 and the EU-US Data Privacy Framework as of September 2026.
Interoperability as an instrument: what the EIF review has to change¶
The paper was prepared by the lab for CNLL, the French open-source business association, and the EuroStack Initiative Foundation e.V., and published as their joint response to the European Commission's Call for Evidence on the review of the European Interoperability Framework, submitted in July 2026. The text filed under the two organisations' branding is frozen as submitted; this is the lab's own edition, which records the provenance and may be revised as the file develops. The Call for Evidence calls interoperability "a strategic enabler of Europe's digital sovereignty, competitiveness and innovation capacity", and the response takes that sentence as its organising principle: interoperability buys the goals, through what it does to switching costs. The framework has no shortage of principles and no way to tell a supplier who delivers interoperability from one who declares it. Both face the same commercial payoff, so the market supplies the cheaper of the two, and twenty years of principle have produced apparent compliance and a public sector that can pass a test at every layer while being unable to move. Ten recommendations follow, beginning with the restoration of the EIFv1 (2004) definition of an open standard, formalised, implementation-independent, freely implementable and royalty-free, and extending to verification a buyer can use and consequences a supplier will feel. The paper also documents the record of how the 2010 reversal was lobbied. Status: the underlying response is submitted; this edition is a draft working paper and may be revised.
The Weakest Link and the Final Say: an economic commentary on the Franco-German Joint Paper on Digital Sovereignty¶
Paper page PDF Version française
On 17 June 2026 France and Germany published a joint paper defining digital sovereignty as a graded capability in six dimensions and three categories, with a risk-based application logic intended to feed the EU's Tech Sovereignty Package. A definition with dimensions becomes a mechanism the moment anyone scores against it, so this commentary reads it as one and asks what behaviour each design choice induces. The architecture holds up: sovereignty appears as relative and context-scoped, substitutability is a first-class dimension defined in switching-cost terms, open source is named in two dimensions of six, and the paper states a real measurement ambition. Four choices create economic risk. The aggregation rule is compensatory where dependency is weakest-link, so on a measured 52-category graph a captured category on every path cuts them all and per-layer certification does not compose. The headquarters criterion reads one channel of control while the certain channels are economic, and no dimension prices rent on the installed base. Substitutability is defined correctly and left unmeasured, in a game where exit is priced by the seller. And a voluntary, self-assessed, compensatory framework is the configuration most exposed to sovereignty-washing. A closing section maps each dimension onto measurable objects that existing instruments already compute. Status: draft working paper (v0.1); the commentary computes no new numbers, and every imported quantity cites a public source or the verification suite of the corpus paper it comes from.
The EU's AI money is aimed one layer too low¶
The brief reads two assessments published in the summer of 2026 against each other: Mozilla's State of Open Source AI and the Commission's own AI technology-area annex to the study on critical digital capacities beyond 2027. EU investment for the 2028-2034 period is being planned against a diagnosis of scarce compute, scarce capital and scarce skills, while both documents locate the failure at deployment, where pilots do not become production systems. Between a third and a half of teams stall short of production whichever way they buy, including those buying the best available models, so model quality does not bind. The layer where value is moving has no cell in the eight-segment value chain the annex reproduces: no segment for orchestration, memory, tool access or agent permissions, a gap the annex names twice without turning it into a recommendation. Two further mismatches follow. The instrument works in actions by 2028 and 2036-2040 while the layer vertically integrates now, and European public money backs open supply while Western Europe is one of only two regions where closed-model adoption exceeds open. Status: draft working paper. The Mozilla regional figures are reported without sample sizes and are treated throughout as indicative only.
Shifting to sovereign digital supply: a "how to" approach¶
Written for EuroStack, which published version 1.0 on eurostack.eu in September 2026. Large European companies and the investors behind them ask what it would take to move their cloud and software supply to European providers, and whether it would pay. The brief answers seven questions in the order a board meets them: what to put in scope, how far AI belongs in it, how to build the business case, how to structure the contracts, whether to rent or build, how to put together a consortium, and what an investor should require of the companies it funds. Two questions underlie all seven: who controls the software your business runs on, and what leaving it would cost. The brief recommends no supplier.