Digital sovereignty: between ambition and reality

Digital sovereignty is a hot topic today, both within government and among many companies. At Xylos, CEO Patrick Leysen follows that debate closely. In this blog, he shares his view.

02 - 07 - 2026

Recently, Danielle Jacobs, CEO of Beltug, joined us for a conversation on the topic. Ask Belgian CIOs, and digital sovereignty invariably ranks among their strategic priorities. Beltug's Priorities Compass confirms that picture.

Figures shared by Beltug show how deep that concern runs. 87 percent of the organizations surveyed name data security as their biggest concern about data in the cloud, and more than 70 percent worry about sensitive data ending up outside Europe.

The central question is simple, the answer anything but: how can we become more digitally independent without isolating ourselves?

The EU Tech Score for technology

To bring more clarity to this, Europe is working on a framework for cloud and AI sovereignty: the CADA framework (Cloud and AI Development Act). It is still a draft, but the intent is clear. Technology and services are classified according to four assurance levels, depending on how much control stays within the Union. A bit like the Nutri-Score in the supermarket, but for technology.

In practice, it looks like this. Governments choose the appropriate level per situation based on a risk assessment, and providers are recognised per level after an audit.

LEVEL	WHAT IT MEANS
Level 1	Data is processed and stored on infrastructure within the European Union.
Level 2	The provider demonstrates independence from third countries, with transparency about its software supply chain.
Level 3	The provider is in EU hands and is controlled from the EU, with extra criteria such as the nationality of the staff. The Commission can also recognise providers from third countries.
Level 4	The provider has full transparency and control over its software supply chain, without interference from a third country.

*Based on the CADA proposal (European Commission, June 2026).

If you are a vendor wanting to show how European your solution really is, questions like these come up:

where the infrastructure is located
who owns the technology
where the staff are based
who has control over the software
which subcontractors are involved
how cybersecurity and governance are arranged

And of course, this is validated through audits. You can already feel it coming: an entirely new market for certification and auditing around digital sovereignty is likely to emerge.

The risk of sovereign washing

At the same time, a new phenomenon looms: sovereign washing. Just as we know greenwashing today in sustainability, vendors will be eager to position themselves as sovereign.

A European sales office or a local data center doesn't yet guarantee that the technology is actually controlled from Europe. The real question is who ultimately holds control over the technology and the data.

The paradox Europe finds itself in

What strikes me most is the paradox Europe finds itself in today. On the one hand, political and societal pressure is growing to be less dependent on American technology companies. On the other hand, let's be honest: thinking Europe can build and manage everything itself is an illusion.

While we're debating regulation and certification levels, countries like China and India are investing massively in energy infrastructure and AI capacity. They have economies of scale and access to energy that we in Europe simply lack today.

An uncomfortable question presents itself. What if, in twenty years, we're using Chinese AI and cloud infrastructure on a massive scale, because European capacity turns out too expensive or insufficiently available? It reminds me of what's already happening in the car industry. Many European consumers can no longer afford the price of a European electric car and are choosing Chinese alternatives that keep becoming more technologically competitive. Could the same happen with AI and data center capacity? I don't know. But it's a scenario we should at least dare to discuss seriously.

Sovereignty must not become a synonym for isolation

Digital sovereignty therefore remains an important goal — quite the opposite of losing relevance. I'm convinced Europe needs to take more control over critical infrastructure and over strategic data and services. That's where we need to invest and jointly create enough scale.

At the same time, let's not put up new digital borders that only make us more complex and more expensive. If every government and every company builds its own mini sovereign island, we weaken ourselves. My hope, therefore, is for a pragmatic approach:

manage certain strategic infrastructure and critical data ourselves where needed
for the rest, keep collaborating with partners, in the West and in the East
and above all, create enough scale to stay relevant as Europe

Digital sovereignty matters. Real autonomy comes from deliberately choosing where you want to be independent and where collaboration is actually a strength.

Xylos takes this new reality into account. We help our customers make conscious choices today about where their data and workloads belong, so they're prepared for what's coming.

About the author

Patrick Leysen is CEO of Xylos. As a next-gen entrepreneur, he leads the company from Antwerp, with the conviction that technology is, first and foremost, about people. He is an active voice in the debate on AI adoption in business and digital sovereignty, and regularly shares his views with a broad audience.

Connect with Patrick on LinkedIn.