The idea before the phrase
Digital sovereignty is now a staple of policy language, but the instinct behind it is older than the term itself. From the early commercial internet onwards, governments understood that networks carried strategic weight. Telecommunications had long been treated as critical infrastructure; the internet gradually joined the same category as public administration, finance, logistics and defence migrated online. What changed over time was the degree of dependency. As software, cloud computing, semiconductors and data-intensive services became foundational to economic life, exposure to decisions made elsewhere became harder to ignore.
In the 1990s and early 2000s, the dominant policy mood in many advanced economies favoured liberalisation. Open networks, cross-border investment and global supply chains were presented as engines of innovation and growth. Yet even in that period, two competing logics were visible. One treated the internet primarily as a border-light commercial and social space. The other saw it as a layer of strategic infrastructure whose ownership, governance and standards would shape national autonomy. Digital sovereignty emerged from the tension between those views.
Digital sovereignty is less about building a sealed national internet than about reducing one-sided dependence on external infrastructures and rules.
The term now covers several related ambitions: control over public-sector data; legal authority over digital activity within a territory; resilience in communications and cloud infrastructure; influence over technical standards; and domestic capacity in critical technologies such as semiconductors and cyber security. Different countries prioritise different elements, but the underlying question is similar: who sets the terms on which a society digitises?
1998–2005: internet governance enters statecraft
A formative moment came in 1998, when the United States government backed the creation of the Internet Corporation for Assigned Names and Numbers, or ICANN, to coordinate the domain name system. The arrangement was designed to preserve the internet’s technical stability while moving from direct governmental oversight towards a multi-stakeholder model. For many policymakers outside America, however, the settlement also highlighted the asymmetry of power in internet governance. Even when technical management became more distributed, the political and institutional centre of gravity remained concentrated.
The issue became more explicit at the World Summit on the Information Society in 2003 and 2005. Debates over who should govern critical internet resources exposed divergent views between advocates of the multi-stakeholder model and states seeking a larger intergovernmental role. The summit did not resolve the matter so much as codify it as a durable geopolitical argument. The internet was no longer just a technical system or a business environment; it had become an object of diplomacy.
That shift mattered because governance questions increasingly touched practical policy. Domain names, routing, standards-setting and cross-border data handling were not abstract matters. They affected speech, commerce, cyber security and the balance between public authority and private power. By the mid-2000s, digital sovereignty was still not a mainstream phrase, but the architecture of the debate was in place.
2006–2012: data, platforms and strategic dependence
The next phase was shaped by scale. Smartphones, platform-based business models and cloud services changed the economics of the internet. Vast quantities of personal and commercial data were concentrated in a relatively small number of firms, many headquartered in a few jurisdictions. Governments initially welcomed digitalisation’s gains in convenience and productivity. Over time, they also confronted a subtler reality: states were outsourcing parts of their informational environment to privately governed transnational systems.
Europe began to frame this issue through market power, privacy and legal rights. The OECD’s internet policy work and the European Commission’s digital agenda reflected a growing desire to preserve openness while ensuring that rules applicable offline also held online. At the same time, several governments started to revisit procurement, security certification and domestic capability in communications infrastructure. Digital policy was becoming entangled with industrial policy.
Digital sovereignty is less about building a sealed national internet than about reducing one-sided dependence on external infrastructures and rules.
Elsewhere, concerns took different forms. Some states focused on information control and regime stability; others emphasised economic catch-up or security vulnerabilities. But a common pattern emerged: as more essential services moved onto platforms and cloud-based architectures, dependency became less visible to users and more important to governments. The politics of sovereignty moved from the physical border to the software stack.
2013: surveillance disclosures turn concern into doctrine
If one date marks the acceleration of digital sovereignty as a formal policy agenda, it is 2013. The disclosures made that year about surveillance programmes transformed a diffuse unease into a concrete problem of jurisdiction, trust and strategic exposure. For many governments and regulators, the lesson was not merely that intelligence gathering was extensive. It was that data stored, transmitted or processed through infrastructures linked to foreign legal regimes could be subject to access beyond the expectations of users and even governments.
The political effect was profound, particularly in Europe and parts of Latin America. Demands for stronger data protection, encryption, localisation in some cases, and greater autonomy in network and cloud infrastructure all gained force. Trust was reframed as an institutional matter, not just a technical one. Who controlled the infrastructure, and under which laws, became central questions.
After 2013, digital trust ceased to be a purely technical matter; it became inseparable from jurisdiction, law and geopolitical power.
The episode also hardened a broader intuition: digital interdependence had distributional consequences. Some states supplied users and data; others housed the dominant firms, standards bodies and legal authorities. Sovereignty policy was a way of redressing that imbalance, whether through regulation, domestic investment or attempts to shape international norms.
2014–2018: Europe makes sovereignty regulatory
The European Union played a decisive role in translating sovereignty concerns into a structured legal programme. The General Data Protection Regulation, adopted in 2016 and applied from 2018, did not use digital sovereignty as a slogan. Yet in substance it advanced a sovereign logic: data concerning people in Europe would be governed by European rules, regardless of where processing firms were based. Extraterritorial reach became an instrument of digital power.
At the same time, the EU pursued the Digital Single Market to reduce fragmentation within Europe and increase scale for domestic digital activity. This was sovereignty in a distinct register. Rather than constructing national walls, the aim was to pool regulatory authority and market size so that Europe could govern digital activity on terms less dependent on outside actors.
The GDPR’s influence extended well beyond privacy. It signalled that rule-making itself could be a source of strategic capacity. Countries around the world drew on its concepts in their own privacy laws. The EU’s approach suggested that sovereignty in the digital age is not exercised only through infrastructure ownership or border controls. It can also be exercised through the power to set conditions for market access.
2019–2020: the cloud, industrial policy and the pandemic
By the end of the 2010s, digital sovereignty had broadened from privacy and internet governance to include cloud infrastructure, public-sector procurement and technological capacity. Policymakers increasingly argued that reliance on external suppliers for core digital services created operational and political risk. Questions once left to IT departments moved into cabinets and national security councils.
The pandemic intensified this reappraisal. Remote work, online education, telemedicine and digital public services increased reliance on cloud providers, connectivity and secure data sharing. The crisis exposed both the value of digital infrastructure and the fragility of underinvestment. It also demonstrated that digital systems are no longer a support layer for the economy. In many sectors, they are the economy’s operating system.
After 2013, digital trust ceased to be a purely technical matter; it became inseparable from jurisdiction, law and geopolitical power.
That recognition produced a stronger fusion of sovereignty and industrial policy. Recovery funds, national strategies and regional plans increasingly targeted semiconductors, cyber security, 5G and trusted cloud environments. The argument was not that every country should produce every layer of technology at home. Rather, critical bottlenecks should not be left entirely outside public influence.
2020: data transfers and the return of jurisdiction
Another key milestone came in 2020, when the Court of Justice of the European Union invalidated the EU-US Privacy Shield in the Schrems II judgment. The decision turned a long-running debate about transatlantic data transfers into a constitutional question about fundamental rights, state access and the adequacy of foreign legal safeguards. For businesses, it created compliance uncertainty. For policymakers, it underscored a larger point: digital openness depends on legal compatibility, not merely technical connectivity.
The judgment strengthened the hand of those arguing that sovereignty cannot be outsourced through contracts alone. If foreign surveillance laws or weak remedies create legal exposure, then data governance becomes inseparable from geopolitics. This did not lead inevitably to blanket localisation, and many regulators warned against simplistic solutions. But it reinforced a pattern in which cross-border data flows would increasingly be conditioned by trust frameworks, reciprocity and enforceable rights.
Jurisdiction returned to the centre of digital policy. The border had not disappeared; it had become embedded in legal obligations governing data at rest, in transit and in use.
2021–2022: chips and infrastructure become strategic assets
Semiconductor shortages during the pandemic era gave digital sovereignty a tangible industrial edge. Chips had always been strategic, but supply constraints made that reality politically visible. Cars, medical devices, telecoms equipment and consumer electronics all depended on intricate global supply chains with a small number of critical choke points. Governments that had once treated semiconductor policy as a niche industrial concern began to regard it as a matter of resilience and national capability.
The response was broad-based: subsidy programmes, capacity targets, export controls, screening of foreign investment and partnerships with trusted countries. The key lesson was not that self-sufficiency was feasible. It was that overconcentration in any indispensable layer of the digital stack carries systemic risk. Sovereignty therefore came to mean diversification as much as localisation.
In the age of chips and cloud, sovereignty is measured not by isolation but by leverage, resilience and the ability to choose among dependencies.
This logic spread beyond semiconductors. Undersea cables, satellite connectivity, data centres, trusted hardware and cyber incident response all acquired strategic salience. The old distinction between industrial policy and national security became harder to maintain in the digital realm.
2022–2023: war, cyber resilience and public digital capacity
Russia’s invasion of Ukraine deepened the strategic interpretation of digital sovereignty. The conflict illustrated how communications networks, cyber defence, satellite links, digital identity systems and cloud-based backups could affect state continuity under extreme pressure. It also showed the degree to which public and private digital infrastructures are intertwined during crises.
For governments elsewhere, the lesson was not simply to spend more on cyber security. It was to think harder about continuity of government, control over essential data, fallback arrangements and the resilience of digital public infrastructure. Sovereignty, in this frame, is partly the capacity to keep governing when networks are attacked, services are disrupted or external providers change terms.
In the age of chips and cloud, sovereignty is measured not by isolation but by leverage, resilience and the ability to choose among dependencies.
This period also renewed interest in digital public infrastructure: interoperable identity, payments and data-exchange layers built with public goals in mind. Here too the sovereignty dimension is clear. When states possess robust digital rails, they have more room to shape service delivery, competition and inclusion, rather than relying entirely on proprietary intermediaries.
2023–2024: artificial intelligence widens the field
The rapid diffusion of advanced artificial intelligence has expanded digital sovereignty beyond data and infrastructure into compute, models, talent and standards. Governments increasingly worry that dependence in AI may mirror earlier dependence in cloud services or platforms, only with greater consequences for administration, defence, media and productivity. The concentration of high-end chips, large-scale computing resources and specialised expertise raises familiar sovereignty questions in a new register.
Responses have varied. Some jurisdictions emphasise safety and risk management; others focus on access to compute, open research ecosystems and skills. But across approaches, AI has sharpened a core sovereignty dilemma: how can states capture the benefits of globally distributed innovation while retaining enough local capacity and legal authority to govern its effects?
The answer is unlikely to be simple national ownership. AI systems rely on transnational supply chains, research communities and standards. Yet the governance of training data, public-sector deployment, model evaluation and liability is increasingly becoming a matter of statecraft. Sovereignty in AI is therefore likely to be hybrid: part regulation, part capacity-building, part alliance management.
What digital sovereignty now means
Today, digital sovereignty is best seen as a portfolio rather than a doctrine. It includes at least five dimensions. The first is legal sovereignty: the ability to enforce domestic or regional rules over digital activity affecting citizens and firms. The second is infrastructural sovereignty: reliable access to communications, cloud, compute and secure data storage. The third is economic sovereignty: room to compete, innovate and avoid being locked into unfavourable dependencies. The fourth is civic sovereignty: ensuring that rights, accountability and democratic oversight survive digital transformation. The fifth is strategic sovereignty: the capacity to withstand coercion, disruption or exclusion in moments of crisis.
These dimensions do not always align neatly. Rules that strengthen privacy may raise compliance costs. Localisation may improve government control while harming smaller firms. Industrial subsidies may build capacity but also provoke fragmentation. The central policy challenge is therefore not whether to pursue digital sovereignty, but how to do so without sacrificing openness, innovation or rights.
The most sophisticated approaches increasingly aim for selective interdependence. They accept that complete autonomy is unrealistic, yet reject the idea that market efficiency alone should determine the ownership and governance of critical digital systems. In practice this means diversifying suppliers, investing in public capacity, tightening security standards, coordinating with allies and using regulation to shape markets rather than merely respond to them.
The next decade of conditional openness
The trajectory of the past quarter-century suggests that the era of naive digital globalisation is over. Open networks will remain valuable, but they will be filtered through concerns about resilience, jurisdiction, standards and strategic control. More governments will seek trusted cross-border arrangements instead of universal openness on uniform terms. Regional blocs will continue to use regulation as a means of shaping the digital economy beyond their borders. Critical technologies will attract further public investment and scrutiny.
That does not mean the internet will simply splinter into sealed national segments. The more plausible future is one of conditional openness: data flows that depend on legal equivalence, infrastructures that require security assurances, and markets that are formally open but strategically managed. Tensions will persist between efficiency and resilience, innovation and accountability, sovereignty and interoperability.
For policymakers, the task is to distinguish between productive sovereignty and self-defeating protectionism. The former increases resilience, rights and bargaining power while preserving cooperation where possible. The latter mistakes control for capacity and walls for strategy. The difference will matter. In a digitised economy, sovereignty is no longer a question asked only at the border. It is built into the code, contracts, chips and institutions through which modern states govern.
