Digital sovereignty is not only about building a strong domestic technology sector. Above all, it is a matter of national security. The report “Digital National Interest”, prepared by the Polish Economic Network at the initiative of the Polish Cloud Employers’ Association, argues that Poland is not devoting sufficient attention to the issue. Dependence on technology providers from third countries is increasing as the economy and public administration become more digitalised. In 2025, Poland’s trade deficit in digital products exceeded PLN 60 billion.
“We are at a turning point. We can still defend our digital sovereignty, but we can also lose it very easily. This is a risk that the Polish Cloud Association identified a long time ago. We have raised the issue repeatedly in public debate. It is finally being discussed seriously, and countries including France and Germany are working on it very intensively,” Wiesław Wilk, Chairman of the Polish Cloud Association, told the Newseria news agency.
In April 2026, France’s Interministerial Directorate for Digital Affairs announced the launch of what it described as the largest migration of public administration in European history from the Windows operating system to Linux. The objective is to reduce the country’s dependence on U.S. technology and strengthen digital sovereignty. The migration is expected to cover 2.5 million workstations across public administration, including 500,000 by the end of 2027.
In 2025, Denmark’s Ministry of Foreign Affairs announced plans to migrate from Microsoft 365 to LibreOffice. At the same time, Copenhagen and Aarhus also announced moves away from the Microsoft ecosystem. The public debate focused, among other things, on growing geopolitical risks and concerns over data security, including in the context of Greenland and fears of potential espionage.
Similar initiatives are also emerging at European Union level. In April 2026, the European Commission awarded a €180 million tender for the provision of sovereign cloud computing services to EU institutions, bodies, offices and agencies. Four European providers were selected.
The tender formed part of the Commission’s efforts to strengthen the digital sovereignty of EU institutions while encouraging the market to develop sovereign digital solutions. According to Synergy Research Group, U.S. companies currently control around 70% of Europe’s cloud infrastructure market, while European providers account for approximately 15%.
“Digital sovereignty is related to cybersecurity, but the two concepts are not identical or interchangeable. Cybersecurity is about protecting systems and can largely be entrusted to specialists, IT teams and system administrators to prevent unauthorised access to data,” Wilk explained. “Digital sovereignty is a much broader issue and can directly affect national security.”
According to the definition presented in the Polish Cloud and Polish Economic Network report, digital sovereignty is the ability of a state and its institutions to enforce their laws and interests, including national security, in relation to digital infrastructure while maintaining a competitive level of products and services.
“Given the current degree of digitalisation of public services and our involvement in the wider information environment, control over where data is stored, who has access to systems and who can shut them down has become a priority issue in the European Union. In Poland, however, the subject is still not receiving the attention it deserves,” the Chairman of the Polish Cloud Association said.
“The state cannot ignore the fact that it is handing over control of systems without being certain who ultimately controls them. That is effectively the situation today, and those of us who depend on public services will become the victims if someone switches those systems off.”
One example cited in the report concerns the International Criminal Court in The Hague. In May 2025, after the administration of Donald Trump imposed sanctions on ICC Chief Prosecutor Karim Khan, he lost access to his official email account hosted by Microsoft.
The Court ultimately decided to move away from the U.S.-based system and adopt an alternative suite of services built around free or open-source software.
“There has also been a widely discussed case in the Netherlands involving the disclosure of data concerning officials responsible for data oversight to authorities that requested it. No offence was committed, at least under the relevant jurisdiction, but for Dutch public officials it raises the question of whether they can really feel protected by a sovereign state in such circumstances. Not entirely,” Wilk said.
“We are calling for examples like these to make policymakers aware of the responsibility they are assuming.”
The authors of the report stress that transferring key digital services to entities operating outside Polish and European jurisdiction creates a number of risks for national security.
The danger stems from the possibility that data and services may be controlled by an entity subject to the jurisdiction of a third country, regardless of where the physical infrastructure is located.
According to the experts, Poland does not currently have sufficient regulations to guarantee the security of critical state digital infrastructure. They point, among other things, to the absence of a dedicated cloud law, the non-binding nature of existing guidelines and gaps in the certification system.
“This is no longer simply a matter of technology, but of regulations enforced by public authorities. Loss of integrity includes access to data by people whom we have not authorised. The very fact that someone without our authorisation gained access to the data is already treated as a loss of integrity, even if the data itself was not altered,” the Chairman of the Polish Cloud Association explained.
“This is precisely the fine line where the entire technology stack needs to remain under control, because the ministry has no supervision over that element. The provider is certainly technically capable of accessing the data. I am not suggesting that it has malicious intentions, but a prudent approach means preventing unauthorised access in the first place.”
According to a special 2026 Eurobarometer survey, 82% of EU citizens believe the European Union should reduce its dependence on technologies from third countries.
An even larger share of respondents believe the EU should prioritise investment in digital services that are developed and controlled in Europe. Nearly six in 10 Europeans say they would be willing to switch to an EU-based digital service provider even if it meant paying slightly more.
Experts from the Polish Cloud Association and the Polish Economic Network argue that Poland needs an ambitious digital sovereignty policy that could also become a driving force behind a new model of economic development, strengthening local content, domestic expertise, employment and competitive advantages in the digital economy.
Among the proposed measures is the introduction of a sovereignty test as a standard element of public procurement. Such a test should include criteria covering the operational impact of infrastructure on state functions, interoperability, jurisdictional exposure, economic and democratic implications, and environmental conditions.
The recommendations also include digital education for children and adults. According to the report, the state should allocate funding for systematic training of public administration employees both before new technologies are implemented and throughout the migration process.
“Digital sovereignty is not an internal issue for an institution’s IT department. It is something that should first and foremost be addressed by senior management, because management bears responsibility for any shortcomings. The Act on the National Cybersecurity System, which came into force a few months ago, makes that very clear, but this awareness is still lacking,” Wilk said.
Public procurement and legislation establishing a national cybersecurity certification system should, according to the report, become key tools for building security. They should create genuine incentives to choose sovereign solutions and exclude suppliers that fail to meet jurisdictional requirements from procurement procedures.
The authors warn that if Poland fails to take steps to strengthen its digital sovereignty and, in turn, the resilience and strategic capacity of the state, it could deepen what they describe as a potentially highly damaging dependence on global technology providers and increase risks to national security.
The economic costs of such dependence are also expected to rise. The report notes that Poland’s trade deficit in digital products exceeded PLN 60 billion in 2025.
Experts estimate that by 2030, spending on imported digital products could exceed the combined cost of importing all energy commodities.
“This is a substantial amount of money flowing out of Poland’s economy, the overwhelming majority of which does not return to the domestic market. We are effectively exchanging atoms for bits. We sell physical products that someone had to manufacture using energy, materials and raw resources, leaving an environmental footprint, in exchange for bits – intangible products,” the Chairman of the Polish Cloud Association said.
In 2024, total annual expenditure on the development and maintenance of IT and telecommunications systems in Poland’s public administration exceeded PLN 7 billion.
However, the Ministry of Digital Affairs did not provide data showing what proportion of that amount was spent on cloud services and software licences.
“With systems organised in this way, we are unable to say how much was spent on core licences, system maintenance, infrastructure, procurement or servicing. These are figures that we, as taxpayers, should know,” Wilk said.
“At present, we suffer from a certain degree of administrative fragmentation. Each ministry has these figures in its own accounts. We pay for all of it, and we know for certain that the money is leaving the country, but we do not know the scale of those flows or how quickly they are changing. Nobody measures it, and that is a somewhat alarming prospect.”
