Digital sovereignty is often discussed as though it were a cartographic problem. Data are imagined to reside somewhere, and politics then asks whether that somewhere lies inside the national perimeter. By mid-2026, that framing looks too static. The more consequential question is what happens when a minister invokes emergency powers, when a regulator demands logs across jurisdictions, when a software dependency fails upstream, or when a sanctions regime forces a rapid reconfiguration of services. Sovereignty in the digital age is exercised at the point of interruption.
This shifts the analysis away from ownership in the narrow sense and towards operational control. A hospital network, electricity distributor, customs authority or payment processor may keep data domestically, contract under local law and comply with local standards, yet still depend on foreign legal exposure, remote update channels, proprietary management planes, identity services, or incident-response arrangements beyond its control. In such a setting, the relevant border is not the one around the data centre. It is the invisible line where another jurisdiction can compel access, delay restoration, restrict exports, terminate support or shape the conditions of recovery.
From data location to interruption rights
The first generation of digital-sovereignty policy was dominated by localisation. Governments sought assurance that sensitive information would be stored and processed within national or regional territory. That impulse was understandable. The jurisprudence around cross-border data transfer, especially after Schrems II, underlined that legal protections can travel poorly when data move into surveillance environments judged incompatible with domestic rights standards.
But localisation solved less than was promised. A system can be geographically domestic and still be operationally foreign. If critical functions depend on remote administration, imported firmware, external certificate authorities, non-domestic cloud control planes, or external threat intelligence feeds, then the real locus of power sits in the chain of dependencies. The state that can compel a service provider, restrict a patch, subpoena telemetry, or freeze a business relationship may enjoy more practical authority than the state that hosts the racks.
A system can be geographically domestic and still be operationally foreign.
The stack has become a jurisdictional ladder
Modern digital systems are layered so densely that sovereignty disputes now climb the stack. Physical infrastructure matters, but so do virtualisation tools, orchestration software, identity systems, software libraries, logging pipelines and machine-learning components. Each layer introduces a distinct legal and technical dependency, often governed by different contracts and different national laws.
This matters because authority is no longer exercised only through territorial presence. It is exercised through lawful orders served on intermediaries, through export controls on advanced computing components, through cyber-incident reporting duties, and through resilience rules that require substitutability and concentration-risk management. The European Union's DORA framework for finance and the NIS 2 regime for essential sectors reflect a growing recognition that dependency mapping is now a matter of public policy, not just procurement hygiene.
Why resilience policy is becoming sovereignty policy
Sovereignty in the digital age is exercised at the point of interruption.
One of the least noticed developments of the past few years is that resilience regulation has become the practical instrument of sovereignty. Legislators increasingly avoid grand claims about technological independence. Instead, they require entities to know their suppliers, test business continuity, maintain fallback arrangements, report incidents and assess concentration risk. This sounds managerial. It is in fact constitutional in effect, because it determines whether a polity can continue to function when cross-border services fail or become politically unavailable.
The most mature public authorities now ask a different set of questions. Not merely: where are the data processed. But also: who holds privileged access; who can revoke keys; where are updates signed; what services are single points of failure; what rights survive insolvency, sanctions or diplomatic rupture; and how quickly can the system be restored without external discretionary approval. Those questions are harder, and vastly more important.
The emergency reveals the sovereign
Political theory has long held that sovereignty becomes clearest in the exception. Digital systems offer a contemporary version of that insight. During routine operations, cloud dashboards and service-level agreements create an appearance of seamless functionality. In emergencies, however, latent hierarchies appear. Which authority can compel disclosure. Which supplier can unilaterally suspend service. Which external team must be invited in to diagnose the fault. Which jurisdiction's export rules decide whether spare components or high-end chips may be delivered.
For critical sectors, these are not abstract concerns. Financial supervision, public health administration, border management and energy balancing all rely on complex, often opaque chains of digital services. The WHO's work on health-data governance and the UN's Global Digital Compact both point towards a world in which trust, continuity and accountable stewardship matter at least as much as formal ownership. In practice, emergency competence has become a test of digital self-determination.
Sovereignty in the digital age is exercised at the point of interruption.
Local copies are not local control
The policy mistake of the localisation era was to confuse possession with command. A domestic copy of data can be useful for continuity, legal protection and public trust. Yet local copies do not guarantee autonomous operation. If the analytics environment, authentication service, security tooling or specialist hardware support remain externally controlled, domestic possession offers only partial insulation. This is especially true where systems rely on continuous synchronisation with external services to remain secure or compliant.
The distinction is clearest in sectors with heavy uptime requirements. A public body may possess mirrored datasets in-country and still be unable to recover service without vendor approval, cryptographic material managed elsewhere, or specialist expertise lodged abroad. That is not dependency in the conventional trade sense. It is dependency under time pressure, which is what gives it geopolitical significance.
The algorithm question is really a governance question
A system can be geographically domestic and still be operationally foreign.
Digital sovereignty debates often ask who controls the algorithms. The phrase is rhetorically effective but analytically slippery. Control can mean ownership of intellectual property, ability to inspect code, authority to set objectives, access to training data, power to audit outputs, or operational control over deployment. These are different powers, and states frequently possess one while lacking the others.
In critical administration, the central issue is usually not whether a government wrote the model itself. It is whether it can understand system behaviour, contest undesirable outcomes, preserve evidentiary records, and substitute components without collapse. Here the WIPO literature on innovation policy is more helpful than the usual sovereignty slogans. Technological capability is cumulative and institutional. It depends on procurement design, standards participation, research depth, regulatory competence and the ability to integrate heterogeneous components over time.
Standards are the hidden constitution of sovereignty
Because direct ownership is only one source of control, technical standards are becoming a quieter but more durable instrument of power. Standards determine interoperability, certification pathways, security baselines, auditability and switching costs. They shape which forms of dependency are visible, governable and legally legible. NIST's Cybersecurity Framework 2.0, though not a sovereignty text as such, exemplifies how institutionalised risk language can reorganise practice across borders.
For middle powers especially, influence over standards may matter more than symbolic industrial nationalism. A state unable to manufacture every critical component can still improve sovereignty if it helps write the rules that make systems portable, inspectable and replaceable. The same logic underpins much of the EU's data-governance agenda. The central issue is not autarky but credible room for manoeuvre.
The concentration problem is more political than technical
Concentration risk is usually framed as a market-structure concern. It is also a sovereignty concern because concentration creates choke points where private operational decisions can have public constitutional effects. If too many essential services rely on the same digital providers, software environments or identity layers, then an outage, legal dispute or geopolitical confrontation can cascade across sectors that appear unrelated.
Recent regulation acknowledges this obliquely. DORA does so through oversight of critical third-party providers and stronger continuity expectations in finance. NIS 2 does so by broadening obligations across essential and important entities. Yet policy still struggles with a basic tension: the most efficient digital architectures often intensify dependency, while the most sovereign architectures can look duplicative and expensive. Governments therefore face a persistent trade-off between short-term efficiency and long-term freedom of action.
What strategic autonomy actually requires
In practice, strategic autonomy in the digital sphere has less to do with owning every layer than with avoiding irreversible dependence at decisive points. That means preserving exit options, negotiating access rights to logs and interfaces, requiring portability by design, diversifying specialist suppliers, and cultivating in-house capacity to understand, test and if necessary replace external components. The administrative state needs technical memory, not merely legal leverage.
The central issue is not autarky but credible room for manoeuvre.
It also requires better classification of what is truly critical. Not every database, collaboration suite or AI service warrants sovereign treatment. But some functions plainly do: identity, payments, civil registries, emergency communications, health coordination, grid balancing, tax administration, customs and defence-adjacent logistics. Treating all digital assets as equally strategic leads either to paralysis or theatre. The harder task is to identify where interruption would directly impair the state's ability to govern.
The new politics of public procurement
The most underrated theatre of digital sovereignty is procurement. Grand strategy documents may articulate principles, but contract terms determine actual power. Audit rights, source-code escrow, incident-notification speed, data-export formats, key-management arrangements, localisation of support teams, continuity obligations after contract termination, and rights during sanctions or ownership changes all shape operational sovereignty more than speeches do.
This is where many states remain weak. Public agencies often procure sophisticated services through fragmented processes with limited technical depth, then discover too late that legal rights on paper do not translate into operational leverage during crises. The challenge is not simply to spend more, but to buy differently: in modular ways, with escape routes and evidence rights built in from the start.
Digital sovereignty after the localisation decade
By mid-2026, the debate has matured. It is no longer credible to equate sovereignty with fortress-like data storage, nor sensible to imagine that complete technological self-sufficiency is available to all but the largest powers. The more useful concept is governed interdependence: participation in global digital systems on terms that preserve domestic legal standards, continuity under pressure and practical substitutability when relationships fracture.
This approach is less theatrical than data nationalism and more realistic than borderless techno-universalism. It accepts that interconnection is unavoidable, but insists that dependencies be politically intelligible and operationally bounded. A sovereign digital order is not one without foreign inputs. It is one in which foreign inputs cannot quietly determine the conditions under which public authority functions.
The border is now inside the system
The defining geopolitical contest of digital self-determination is therefore not only about who owns data or writes algorithms. It is about who can lawfully and technically intervene in the systems through which societies administer themselves. The border has moved inward, into APIs, key stores, update mechanisms, subcontracting chains and incident-response protocols. That is where control is now asserted, contested and sometimes lost.
For states, firms and citizens alike, this is a more demanding picture of sovereignty than the slogans of the past decade. It requires legal precision, architectural literacy and institutional patience. Yet it is also a clearer one. Once the problem is framed as operational control under stress, the policy agenda becomes less mystical. Map dependencies. Reduce irreplaceable choke points. Build fallback capacity. Reserve decision rights where they matter. The politics of digital sovereignty begins, and may ultimately end, with the ability to continue governing when the network does not behave.
