“Is this sovereign?” It is an appealing question because it invites a yes or no. Technology companies increasingly use sovereign branding to make a complicated question look like a box to tick.
But digital sovereignty is not binary. It is a matter of agency, choice, and control. What are we choosing to depend on? And if circumstances change, can we move in a different direction? Every technology contract answers those questions, whether or not anyone asks them.
An instinctive response is to buy British. Domestic suppliers support UK jobs, skills and tax revenues, but a British invoice does not guarantee resilience. A domestic supplier can still lock customers in, raise prices once they cannot leave, and create a talent moat around its products. Nationality does not determine where services are hosted, where data is processed or where ownership resides, especially as successful British firms can be acquired by international buyers.
A British lock is still a lock. You may have changed the supplier without changing the dependency.
Canada has met the same problem. Its sovereignty framework is distinct from its Buy Canadian rules, which do not assess jurisdiction, so a product can pass every procurement test and still carry foreign legal exposure.
Contracts do not close the gap either. A clause cannot keep a service running if a supplier is compelled by a foreign government to stop providing it. The International Criminal Court’s chief prosecutor was reportedly cut off from his email after US sanctions, and the court has since moved to an open source suite. The Commission’s tech sovereignty chief says the aim is that “nobody has a kill switch” over Europe’s critical systems.
Fewer choices and less room to negotiate
The problem lies as much in how government buys as in what it buys. Procurement scores price, speed, and delivery. It rarely scores optionality. Whether data can be moved, whether software can run elsewhere, whether a supplier could be replaced without rebuilding the service.
Across the industry, commercial incentives such as proprietary interfaces, bundled services, and costly exits can deepen the dependencies that matter most, including those with a kill switch attached. Each purchase is rational. The cumulative result is a state with fewer choices and less room to negotiate.
Artificial intelligence raises the stakes, because government is now buying systems that help make decisions. When model weights, code, tooling, and hosting are fused inside one proprietary service, transparency over vital processes is lost, and so is the ability to leave.
If you liked this content…
Procurement has a second blind spot regarding what everything is built on. Black Duck’s 2026 audit found open source in more than 95 percent of the commercial codebases it examined. Yet only 31 percent of UK CIOs have a complete and consistently updated overview of all the open source components they use, including open source projects that remain chronically underfunded.
On 21 October, two critical flaws in PHP, a language that is estimated to underpin 70 per cent of websites, pulled government services offline across Europe, including the Netherlands’ DigiD login. The PHP Foundation’s executive director shared that it has only one full-time employee and called the project “incredibly under-funded”. Governments depend on this code, but few departments pay for it.
The money that does reach upstream comes largely from subscriptions to enterprise open source, where vendors employ maintainers and contribute fixes back to their communities. It is a thin footprint, but it is a model in which buying software funds the code the state relies on. Procurement should value that.
‘Open source first’
Canada and the EU are both moving starting to enact measurable change. In April the European Commission awarded a €180 million sovereign cloud contract, the first time sovereignty was scored as an award criterion, with technological openness among the factors. In June its tech sovereignty package proposed an “open source first” principle for public bodies. Canadian analysts now urge that procurement enforce control through portability and exit planning, not domestic ownership alone.
None of this means government should go it alone. No modern state can build everything in isolation. The aim is to make dependence a choice. Enterprise open source can reconcile the requirements: a support contract provides accountability, while access to the underlying code preserves options a closed system may deny. If the relationship changes, there is a route to another supplier or to running the software in-house. A supplier that knows its customer can leave has greater reason to compete on partnership rather than dependence.
Open code alone does not guarantee flexibility. Workloads must be movable, systems documented, and people equipped to take ownership, planned from the outset. The Ministry of Defence’s Developer Service (D2S) demonstrates this principle of shared platforms with continuous assurance that teams reuse rather than rebuild effectively for the UK.
Every technology business case should ask whether government can migrate, inspect and exit, what would have to change, how long it would take, and what it would cost. Procurement frameworks should score the answers.
Dependence builds purchase by purchase, and its cost is only counted when change is required. This is sovereign debt in action, and at some point the bill must be paid. If Britain wants to decide what it depends on, under which conditions, and for how long, it must value the freedom to leave, and be willing to pay for it.
