A race for technological sovereignty is under way across the European Union. More governments are treating digital infrastructure as a matter of national security and using public procurement to support domestic technologies and innovation. The authors of the report “Digital National Interest” argue, however, that Poland is largely absent from this race. In their view, the problem is not a lack of technology, expertise or capital, but a lack of political will. Without an active state policy, Poland’s dependence on foreign technology is likely to deepen.
– Both Poland and the European Union are currently highly dependent on providers of digital services, solutions and products from outside Europe. We do not know the exact scale of this dependence because no one has comprehensively measured it. What we do know is that, as a country, we buy significantly more digital products than we export – Maria Świetlik, Managing Director of the Polish Economic Network and co-author of the report Digital National Interest, tells Newseria.
The report, Digital National Interest. Digital Sovereignty as a Tool for Security, Development and State Industrial Policy, was prepared by the Polish Economic Network at the initiative of Polish Cloud – Employers’ Association.
It shows that Poland’s trade deficit in digital products exceeded PLN 60 billion in 2025. By 2030, expenditure on imported digital technologies is expected to surpass the combined cost of importing all energy commodities.
Data from the Ministry of Digital Affairs cited in the report also show that public administration spent more than PLN 7 billion on the development and maintenance of IT and telecommunications systems in 2024 alone.
However, the state does not analyse what share of this expenditure goes to domestic companies and how much ultimately flows to foreign technology providers.
Assuming that the prices of licences and cloud services increase by 12% annually, expenditure on such purchases could rise by 76% within five years.
– What we know about digital dependence is that it will deepen unless the state pursues an active digital sovereignty policy. The European Commission and many EU member states are already implementing such policies. Over the past two years, countries including France, Denmark and Germany have taken clear steps in this direction by moving parts of their public administrations towards solutions based on free and open-source software. Poland could pursue a similar policy – Maria Świetlik says.
Experts argue that digital dependence represents a risk to the state. Cloud infrastructure, public registers and government IT systems are critical national infrastructure, just as important as the energy grid, because the functioning of public administration, healthcare, finance and public services depends on them.
A major failure or extraterritorial access to these systems could impair the state’s ability to perform essential functions. Yet investment in this area in Poland is still largely assessed under standard public procurement rules.
Prime Minister Donald Tusk announced in June that Poland would introduce a so-called sovereignty test for government technology purchases. The test would be mandatory for investments above specified thresholds: PLN 5 million for technology purchases and PLN 15 million for infrastructure projects.
Experts from Polish Cloud argue, however, that the decisive factor should not be the monetary value of a contract but the critical importance of the system concerned. The more essential a piece of infrastructure is to the functioning of the state, the stricter the scrutiny should be.
The report’s authors propose that the sovereignty test should assess the operational impact of infrastructure on state functions, the jurisdiction to which a provider is subject, its economic impact, cognitive and democratic considerations, and environmental conditions.
– Poland does not lack outstanding IT specialists, excellent system administrators, experts capable of deploying new infrastructure or skilled trainers. Nor do we lack domestic capital that could be invested in developing these kinds of services and products. We have excellent Polish companies. Poland is known for innovations such as BLIK, and we have demonstrated that we can introduce entirely new solutions that are adopted quickly and are secure. So what are we missing? Our answer is simple: political will – Maria Świetlik says.
Expanding the sovereignty test could affect not only national security but also the development of Poland’s domestic technological capabilities.
The choice of supplier for strategic digital systems can determine where expertise is developed, where jobs are created and where economic value added remains.
European governments are increasingly using public procurement as an instrument to strengthen their own technology sectors.
In April 2026, France announced plans for a broad migration of public administration away from US-based solutions towards open-source software, including Linux. The transition is ultimately intended to cover 2.5 million workstations.
A year earlier, Denmark’s largest cities and its Ministry of Foreign Affairs announced plans to migrate away from the Microsoft ecosystem towards open-source software. The government of the German state of Schleswig-Holstein has also opted for open-source solutions in public administration.
– The sovereignty race is already under way. EU countries are competing not only with suppliers from outside the Union but also with one another. When countries such as France provide their domestic market with a major procurement stimulus by ordering software for millions of office workstations, they create stronger French technology companies. If Poland wants to move towards digital sovereignty, it must also invest in developing these capabilities at home – the Managing Director of the Polish Economic Network explains.
The European Commission has developed the Cloud Sovereignty Framework, a set of principles defining sovereignty requirements for public procurement of cloud services.
The framework includes criteria such as the jurisdiction governing the provider, supply-chain security, the ability to migrate to another solution and the use of open standards. The first procurement procedure based on the framework has already been conducted.
The report’s authors indicate that the next step is expected to be the Cloud and AI Development Act, or CADA, which is intended to establish a common EU framework for assessing the sovereignty of cloud and artificial intelligence services. The European Commission presented the proposal in early June 2026.
– The proposed CADA regulation treats digital infrastructure as critical state infrastructure. This means that solutions should also be assessed from a geopolitical perspective. It provides a more concrete framework for defining digital sovereignty and determining how it should be built. Among other things, it highlights the importance of assessing extraterritorial jurisdiction – in other words, whether a company and the services it provides are subject to laws outside Europe – Maria Świetlik says.
The proposed CADA regulation moves away from the previous approach, in which the security of digital services was assessed primarily according to the physical location of the data centre.
– It is not enough for a data centre to be located within the European Union. We must also examine who owns it, what kind of software is being used and who has the right to update that software. In economic terms, this means examining the entire supply chain. Until now, the European Union largely operated under the assumption that the location of the data centre was the decisive factor. Today we know, and have numerous examples demonstrating this, that simply locating the physical infrastructure within Europe is not enough – the Managing Director of the Polish Economic Network explains.
Experts from Polish Cloud add that if a provider is subject to the laws of a third country, it may be legally required to hand over data without the knowledge of the data controller, and encryption or technical isolation may not necessarily prevent such access.
