The Hidden Cost of Reactive Inaction on Corporate Technological Sovereignty

On June 3, 2026, the European Commission unveiled its much-anticipated European Technological Sovereignty Package at its Brussels headquarters. Commission President Ursula von der Leyen pulled no punches when introducing the new policy bundle. “We cannot afford to rely on outside parties for the technologies that keep our hospitals running, our energy grids stable, and our public services secure,” she said. “This work is about protecting our people, defending our shared interests, and retaining the right to make our own independent choices.”

Her blunt rhetoric matched the unvarnished data behind the proposal: today, the EU depends on non-bloc suppliers for more than 80% of its critical digital products, services, infrastructure, and intellectual property. The package marks a meaningful break from past approaches, both in the new rules it introduces—including an updated Chips Act, a Cloud and AI Development Act, and a comprehensive cross-continental Open Source Strategy—and how it frames the core issue. For the first time, digital dependence is treated as a question of strategic security and collective self-determination, rather than a routine operational concern to be delegated entirely to internal procurement teams.

But this logic of vulnerability does not stop at national or bloc borders. The same risk plays out at every scale, for any organization that relies on technology it does not own and cannot easily exit. A company built on third-party infrastructure, proprietary models, and external platforms it cannot leave is in the exact same position as a continent dependent on foreign suppliers—just operating at a smaller scale.

This leads to a critical, underexplored question: If this form of dependence poses a strategic risk severe enough to threaten an entire continental political union, why are so many private companies still doing so little to secure their own technological sovereignty? A recent survey from enterprise software firm SUSE highlights this gap: 98% of participating organizations’ IT leaders name digital sovereignty as a top organizational priority, yet only 52% have implemented any concrete action to advance it. Even more revealing, when companies do finally move on the issue, they are rarely driven by a proactive commitment to the principle of sovereignty. Instead, most organizations only address dependence gaps reactively, when external circumstances leave them no other choice.

This reactive pattern typically takes one of two forms. Sometimes, the cost of ignoring sovereignty becomes unavoidable from within. The global financial services sector, for example, became a major investor in open source technologies after years of steadily climbing IT bills, driven by firms being locked into restrictive vendor contracts with no easy path to switch providers. Far more often, though, pressure to change comes from outside: while regulatory rules occasionally trigger action, the most common driver is that key customers have their own strict sovereignty requirements, and those mandates ripple downstream across entire supply chains and markets.

Addressing any problem when forced to act under urgent time pressure is almost always the least effective, and most expensive, approach—both in direct spending and widespread organizational disruption. Companies that act early get to set their own timeline, survey the full range of available options, and select the solutions that fit their unique long-term goals best. Companies forced to transition on someone else’s schedule, by contrast, have far less negotiating leverage, fewer alternatives to choose from, and end up shouldering much higher costs to complete the shift.

This kind of strategic freedom is never free. But it is far cheaper to invest in proactively today, than it is to pay the steep price of inaction under duress later.