Digital sovereignty: Do hidden dependencies present risks to the continuity of Europe’s digital public services?
Capgemini ·
Digital sovereignty becomes an increasingly important consideration in the context of growing geopolitical uncertainty and shifting international relationships. The post Digital sovereignty: Do hidden dependencies present risks to the continuity of Europe’s digital public services? appeared first on Capgemini .
At a glance:
The digital transformation of government has fundamentally changed how public administrations deliver services to citizens and entrepreneurs.
The latest eGovernment Benchmark , a European Commission study monitoring the digitalization of public services, shows that the availability and accessibility of digital public services have increased considerably over the past four years. Compared with just three years ago, on average across the 27 EU Member States (EU27), 15 additional services are fully accessible online, eight additional services allow access using an official electronic identification solution, such as a national eID, and 24 additional services are adapted for smartphone use.
Making these public services available and easy to access digitally, however, depends on digital infrastructure that is technically demanding to develop, operate and maintain. When it comes to the digital infrastructure that hosts government websites and stores their data, governments have managed technical demands by increasingly relying on external technology providers for cloud platforms, hosting environments and globally distributed communications infrastructure.
While this model has accelerated the digitalization of public services, it has also raised questions about how much control public administrations retain over the infrastructure underpinning them. Digital sovereignty, then, becomes an increasingly important consideration for policymakers and public-sector organizations in the context of growing geopolitical uncertainty and shifting international relationships.
There is no denying the significant role of external tech companies in the evolving eGovernment landscape. At the same time, over-dependence is a concern. As we discuss in the following, by adopting a strategic approach that balances potential risks with alternative options, public sector leaders can ensure resilience.
To better understand the digital dependencies, the European Commission’s eGovernment Benchmark , produced by Capgemini, Sogeti, and IDC, introduced a set of pilot digital sovereignty indicators in 2026, focusing on the network and routing infrastructure that supports government websites and email systems.
The findings reveal a significant reliance on non-EU providers. Across the EU, 37.2% of government websites were found to be hosted on network infrastructure ultimately controlled by organizations headquartered outside the European Union. The United States was by far the most prominent non-EU jurisdiction, accounting for infrastructure through which approximately one-third of assessed government websites were routed.
Dependence on non-EU providers is even more pronounced in government email systems. The assessment found that 60.4% of incoming government email services and 50.3% of outgoing government email services rely on infrastructure operated by organizations whose ultimate ownership lies outside the EU.
The United States emerges as the dominant non-EU jurisdiction across the routing and communication layer. U.S.-owned operators provide the network infrastructure through which 32% of assessed government websites, 35.2% of incoming government email services, and 45.5% of outgoing government email services are routed. This reliance is driven by a small number of globally dominant providers, including Microsoft, Cloudflare, Google and Amazon.
When digital public services and government communication channels rely on infrastructure operated by non-EU organizations, they may become subject to foreign legal frameworks, regulatory obligations, and broader geopolitical developments. Such dependencies can have implications for how data is governed, retained, and accessed, while also increasing reliance on external providers for the continuity and availability of essential services.
As governments continue to digitize critical services relating to healthcare, taxation, business operations, and citizen records, maintaining oversight and control of the infrastructure that underpins these services becomes increasingly important.
While the findings of the 2026 eGovernment Benchmark report shed light on an important dimension of digital sovereignty, this is only one part of the story. Digital sovereignty ultimately depends on the degree of control governments retain across the full technology stack, from infrastructure and software to data and emerging technologies.
Public administrations, for example, handle large amounts of (sensitive) data in order to carry out their responsibilities. This concerns citizen records, healthcare data, business data, and tax information. Questions about where this data is stored, who can access it, and under which legal frameworks it is governed have therefore become an increasingly important dimension of the digital sovereignty debate.
The answers to these questions increasingly influence organizational resilience, legal compliance, and the ability of governments to align digital operations with their own policy objectives. At the same time, much of the technology used to store, manage, and analyze this information is developed and operated outside Europe, extending sovereignty concerns beyond data governance alone.
Recognizing these challenges, the European Commission has placed digital sovereignty at the heart of its digital agenda through the Tech Sovereignty Package . Initiatives such as the Chips Act 2.0 and the Cloud and AI Development Act aim to strengthen Europe’s capacity to develop, deploy, and govern critical digital technologies, while reducing reliance on non-European providers. In practice, this means creating stronger European alternatives in areas where strategic dependencies are the greatest, from semiconductor production and cloud infrastructure to artificial intelligence systems, and the storage and processing of European data.
The path towards digital sovereignty should not simply be about replacing non-European technologies with European alternatives. Rather, there is a balance to be struck, and leaders must become more strategic about their digital dependencies.
With the challenge ultimately being one of strategic leadership, we recommend:
Taking the case of the routing and communication layer of digital public infrastructure, it is important for digital government leaders and policymakers to establish visibility over the organizations that operate government web and email infrastructure, including their jurisdictional exposure.
Once dependencies are understood, leaders should assess whether they create strategic, operational, or governance risks. Namely, identifying which sensitive public services rely on a small number of providers and where ownership structures may expose the flow of data to external influence.
Going forward, resilience can be improved by managing those dependencies that create the greatest exposure through exit strategies, contingency planning, and the adoption of open standards and open-source technologies where appropriate. This can help reduce vendor lock-in and increase the ability to transition critical services between providers as strategic requirements evolve.
Ultimately, sovereignty considerations should be embedded into the governance and procurement of the digital infrastructures that enable public services, ensuring that decisions balance performance, security, and cost, alongside strategic autonomy.
For further insight:
The eGovernment Benchmark 2026 was conducted by Capgemini, Sogeti and IDC on behalf of the European Commission. The annual study monitors the availability and quality of digital public services for businesses and citizens across the EU. It measures progress towards the EU’s Digital Decade target of making 100% of key public services available online by 2030 and provides a comprehensive overview of digital public service delivery across all 27 Member States.
The study uses an EU-wide network of Mystery Shoppers and several automated tools to evaluate 96 key public services across nine life events, such as Studying, Business Start-Up, and Moving. These services are evaluated through a range of 19 indicators and 11 pilot indicators, including online availability, (AI-enabled) user support, transparency, mobile friendliness, cybersecurity, and digital sovereignty.
The eGovernment Benchmark 2026 introduced three pilot indicators on digital sovereignty, covering the routing and communication component of digital public infrastructure through which government web and email traffic is delivered across the internet.
Using a sample of central, regional and local government websites gathered through the eGovernment Benchmark process, the assessment identifies the Autonomous System operator associated with each website’s destination IP address and routing environment. In practical terms, this shows whose network the website is delivered through, whose IP address space it uses and whose routing and operational policies govern that network environment.
For each identified operator, the assessment then traces its ultimate beneficial ownership and identifies the country in which the ultimate owner is headquartered, providing an indication of the jurisdictional framework to which the operator may be exposed. Overall, this indicates whether the network environments through which government web and email traffic is delivered are operationally controlled by EU-owned operators or may be subject to non-EU legal and regulatory frameworks.
Capgemini helps governments better understand and address the growing challenge of digital sovereignty. As a producer of the eGovernment Benchmark, Capgemini contributes to identifying infrastructure dependencies across Member States and translating these insights into recommendations for policymakers. Building on this research, Capgemini Invent helps organizations translate sovereignty ambitions into practical action, from assessing digital dependencies to shaping security and compliance strategies.
Capgemini also translates these ambitions into delivery. It became the first SAP Sovereign Cloud Partner in Europe, covering France, Germany, the Netherlands and the UK, building on a broader Sovereign Technology Partnership with SAP aimed at protecting sensitive data and critical operations. Its sovereign-ready cloud and AI solutions are similarly available on the AWS European Sovereign Cloud , an independent cloud fully located and operated within the EU, alongside comparable sovereign offerings developed with Microsoft and Google Cloud .
The post Digital sovereignty: Do hidden dependencies present risks to the continuity of Europe’s digital public services? appeared first on Capgemini .