The Right to LeaveDigital sovereignty, Europe and open source
Everyone, raise your hand.
Lower it if…
- your email or shared documents are on Microsoft 365 or Google Workspace
- your meetings run on Teams, Zoom or Google Meet
- you reach your members or supporters mainly through Facebook, Instagram, LinkedIn or WhatsApp
- your organisation’s computers run Windows or macOS
I am not neutral: here are my hats



Five steps
- What the word means, and where it comes from
- What dependence costs
- What open source changes
- What Europe is deciding this year
- What you can do
What the word means, and where it comes from
“Digital sovereignty”: one word, three uses
Each lowered hand was a dependence. When people speak of managing them, they mean one of three things:
- Autarky: making everything at home
- Protectionism: keeping foreign suppliers out
- Location: data kept in Europe
- Labels: a “trusted cloud” certificate
- Nationality: buying from European suppliers
Keeping control of your own choices, at every link of the chain
Not a new idea: ten years of reports in France and Germany
2016: French law already said it
« Les administrations […] veillent à préserver la maîtrise, la pérennité et l’indépendance de leurs systèmes d’information. Elles encouragent l’utilisation des logiciels libres et des formats ouverts […] »
The first sentence is an obligation, but who enforces it? The second is an encouragement. 7 October 2026: ten years.
Three official definitions, one idea

France’s capacity “to act sovereignly in the digital space, keeping an autonomous capacity of assessment, decision and action”; not doing everything nationally, but keeping “autonomy and freedom of choice”.

“The abilities and possibilities of individuals and institutions to exercise their roles in the digital world independently, self-determined and securely.”

“The capability and capacity to develop, provide, use, adapt and control digital technologies […] in an independent, self-determined and secure manner”, with systems that enable “a change of provider … within reasonable time and financial expenditure.”
It comes in degrees; the right degree depends on the use
Raise your hand if you think digital sovereignty is exclusively a matter for States.
Every scale has a position, and levers of its own
The levels are linked: one actor’s choice sets the next one’s constraints. Europe’s position is the sum of all these decisions.
An objection: “sovereignty belongs to the State”
- The substance is shared. Cigref’s own criteria include “control of users’ dependence on their suppliers”.
- The texts cover private actors. France and Germany, 2026: sovereignty strengthens “the EU, a state, an administration, or a private organisation”.
- The bill falls on each buyer. Next part.
Prefer “maîtrise”, “independence” or “strategic autonomy” for an organisation? Different names, but the levers are the same.
A chain breaks at its weakest link
One condition was enough to lower a hand. An average of scores hides the weak link.
For each link: who controls it, and is there an alternative?
What dependence costs
Four ways a dependence costs you; three of them every year
What you pay rises with what leaving would cost you
What leaving would cost you
Someone else decides what the product becomes
Who else can read it, or switch it off
Raise your hand if your organisation uses software that a large vendor gives free, or at a discount, to nonprofits.
Price: your supplier’s margin is bounded by your cost of leaving
A larger case: VMware after its purchase by Broadcom
Exit: what leaving actually costs
- Moving the data out: the smallest part
- Re-integrating with everything else: the largest
- Retraining people
- Downtime
- Contract timing: notice periods, commitment discounts
Control: the supplier decides the roadmap, and open source leaves a way out
| Licence closed | Fork that continued the open version | |
|---|---|---|
| Elastic · 2021 | → | OpenSearch |
| HashiCorp Terraform · 2023 | → | OpenTofu |
| Redis · 2024 | → | Valkey |
Law: who else can read it, or switch it off?
- Extraterritorial law: US CLOUD Act, FISA section 702
- Sanctions: the International Criminal Court’s email, 2025 (Microsoft’s account differs)
A new transatlantic data deal would settle this channel on paper, and leave the other three untouched.
Pay every year, or pay once in a crisis
Open interfaces and code anyone may fork pay off in both: lower rents in normal times, a smaller loss in a crisis.
What open source changes
Raise your hand if you have changed integrator or hosting provider while keeping the same software.
That is the right to leave, already used.
The official texts already make open source a strategy

“An industrial strategy based on open source, provided it is part of a well-thought-out commercial approach, can enable French or European manufacturers to gain market share where they are absent today, and thereby France and the European Union to regain sovereignty.”

Systems should “enable a change of provider and technology within reasonable time and financial expenditure. Open source solutions can and should play an important role in this regard.”
What open source does not give automatically
Someone has to fix the bugs and the security holes
In your organisation, or at a provider you trust
Open code can still run on a closed chain
A project one company controls can change its licence
Open Source code is a public good; support and hosting are sold
Libraries, protocols, frameworks. Anyone can use them, so each user is tempted to let others pay: pooled funding, foundations and public programmes fit.
A CRM, an office suite. The code is shared; support, hosting and accountability are sold, usually by a company.
Everyone benefits from maintained code; someone has to pay for it
Of the project or its association
Those who sell services on the code
For a feature they all need: a buyers’ club
Germany’s Sovereign Tech Agency, for example
What Europe is deciding this year
2026: after ten years of reports, legal texts




The Open Source Strategy makes open source industrial policy
- Open source named an instrument of European industrial policy
- A definition anchored on the Open Source Initiative, with a list of recognised licences
- A maintenance instrument, able to back a fork
- A network of public Open Source programme offices
The Cloud and AI Development Act: two steps back on open source, and no European preference
- “Open source by default” in the May draft became “encourage” (art. 41): cloud and AI only, wide exemptions, no audit
- “Public money, public code” became a catalogue, if the code is published at all (art. 42)
- No European preference; non-price criteria stay “ancillary and not decisive” (art. 32); implementation left to Member States, years away
Rules that already apply, or soon will
| Data Act | Switching charges, egress fees included, banned from 12 January 2027 |
| Cyber Resilience Act | Vulnerability reporting from September 2026, full application December 2027; a lighter regime for Open Source stewards |
| NIS2 | Cybersecurity duties for essential and important entities, public and private |
| GDPR | The one associations already know |
France tried “encourage” for ten years
No workstation migration to free software completed since the Gendarmerie’s, finished before the 2016 law.

July 2026: the National Assembly’s inquiry proposes moving “from a logic of encouragement to a binding logic”.
Who is pushing, and for what


A text sets a ceiling; buyers deliver
- 2019–2020: hosted on Azure
- November 2020: the government commits to leave
- April 2026: move to Scaleway announced
- Not done yet; no timeline announced
- ~80% of workstations on LibreOffice
- ~44,000 mailboxes on Open-Xchange
- >€15m a year in licence savings, against €9m invested in 2026
What you can do
What can you do?
As an end user
- Know where your data live, and which services touch them
- Export everything once a year, and check you can open it
- Prefer open formats
- Report bugs, write documentation, translate
As an organisation, and its board
- Put leaving in the plan and the budget, starting with the link that lowered your hand
- Write reversibility into contracts: formats, notice, exit terms
- Fund what you depend on
- Join peers to buy and to fund together
As an integrator or service provider
- Contribute upstream
- Document each client’s chain
- Offer a European or self-hosted option for every link
- Make leaving easy: a client who could go and stays is won on merit
As a public buyer, or a citizen
- The texts are being written now: “encourage” or “require” is decided this year
- Public buyers decide what the texts become
- Support those who push: join, sign, answer the consultations
Going further
Who controls your tools?Could you leave them?
Papers, notes and sources: econ.lab.abilian.com