This article appeared in the November/December 2026 issue of Internationale Politik as part of a medley of essays titled “Power without a mandate.”

When a citizen submits a tax return online, applies for social benefits, renews a passport, or identifies themselves with a digital identity, it appears as if the exchange takes place solely between the citizen and the state. Increasingly, however, private technology companies are behind these processes. They provide cloud infrastructure, software, data, and other technologies upon which public services depend.

This situation raises a fundamental question about state power: What happens when private companies control the capabilities citizens need to interact with the state? A government can gain capabilities by relying on a specialized private provider. But it can also lose freedom of action if it is tied to a provider for which there is no credible alternative.

This distinction is important because European policymakers increasingly view dependency as a sovereignty issue, especially when a provider is based outside the EU. However, dependency on the private sector is hardly new, and foreign ownership does not automatically equate to foreign control.

What Connects Census and Cloud

Governments have long relied on private companies for infrastructure, technology, and expertise that would be costly or impractical to develop in-house.

The U.S. Census Bureau provides an early example of how governments can manage their reliance on specialized private technology. After the 1880 census overwhelmed existing data-processing methods, the Bureau issued a competition in 1888 for a mechanical system to automate the counting process. Herman Hollerith's system won, and the Bureau leased his machines for the 1890 census. The technology significantly sped up the counting: it was completed months ahead of schedule and at a much lower cost than anticipated. When Hollerith later raised his rates, the Census Bureau developed its own competing counting system.

The lesson: private expertise can augment government capabilities, provided the government retains the ability to change course if the relationship becomes too costly.

Cloud computing brings this dynamic into the present day. Hyperscalers can spread enormous fixed costs across millions of customers, operate global networks, continuously invest in cybersecurity, and employ specialists that governments would find difficult to recruit and retain. Purchasing these services can therefore provide governments with capabilities they could not efficiently replicate themselves. However, problems arise when providers are too deeply embedded in the systems on which the state relies and which are virtually irreplaceable.

Who Is Dependent on Whom

Four dimensions determine the nature and extent of a government's dependence on a technology provider.

Technical specialization exists when a provider possesses capabilities that a state could only develop with difficulty or at great expense. Market concentration comes into play when only a few providers can offer these capabilities. Network integration arises when government systems are deeply embedded in a provider's ecosystem of interconnected technologies and services, so that changes to one system depend on others. And legal risks arise when a government relies on a company subject to the laws or geopolitical constraints of another state.

These dimensions can reinforce each other: technical advantages can lead to market concentration, concentration can increase switching costs, and deep network integration can drive these costs even higher. If the provider is subject to foreign law, an additional risk arises. Thus, a government may be legally free to switch providers but still face significant practical obstacles.

None of this implies that a provider behaves badly. Dependence can arise from rational decisions by governments seeking better technology, greater security, lower costs, or capabilities that would be impractical to develop in-house. The political challenge lies in ensuring that dependence does not restrict the state's ability to select, oversee, or change its technology providers.

This is where dependence differs from interdependence. Dependence describes an asymmetric relationship in which one party needs the other and has few alternatives. Interdependence, on the other hand, refers to a relationship in which both parties derive significant benefits from cooperation and would incur substantial costs should it break down.

For example, European governments depend on American technology companies for certain digital capabilities, while these companies, in turn, rely on European customers, labor, suppliers, capital, and markets. While this interdependence does not eliminate the power imbalance, it challenges the assumption that foreign ownership automatically equates to foreign control. The crucial question is how much freedom of action governments retain when the relationship changes.

Resilience Isn't Everything

Governments have good reason to prioritize resilience. A critical public service should continue to function if a provider falls victim to a cyberattack, experiences a prolonged outage, is subject to geopolitical restrictions, or becomes unavailable for other reasons.

However, resilience is only one of several objectives in public procurement. Governments must also consider cost, performance, cybersecurity, reliability, innovation, technical capabilities, scalability, and the quality of services. An exclusive focus on geopolitical resilience carries its own risks: A government might opt ​​for a less innovative, less secure, less efficient, or more expensive system simply because it reduces dependence on foreign entities. This would also negatively impact citizens' satisfaction with their public administration.

The policy objective should therefore be a form of controlled dependency. Governments must identify their truly critical systems, maintain sufficient in-house expertise to monitor providers, ensure data portability and interoperability, test migration and contingency plans, and avoid unnecessary concentrations.

Europe's Cloud Dilemma

Brussels is increasingly considering these issues from the perspective of digital sovereignty. The European Commission defines technological sovereignty, among other things, as the development and control of key technologies, data, and infrastructure while simultaneously reducing dependence on non-EU providers. Its Cloud and AI Development Act envisions a common EU framework for assessing cloud sovereignty, as well as a public sector procurement mechanism designed to strengthen Europe's position in cloud computing.

Reducing certain dependencies can be beneficial. However, European ownership is not a reliable indicator of security or resilience.

Furthermore, this approach contradicts the fundamental principles of public procurement. The WTO Agreement on Government Procurement obliges contracting states to grant national treatment and non-discrimination to suppliers from other contracting states, subject to negotiated scopes and exceptions. The agreement explicitly states that procurement rules should not serve to protect domestic suppliers. EU procurement law also requires equal treatment, non-discrimination, transparency, and proportionality.

These rules exist for good reason. Preferring domestic suppliers regardless of their performance can restrict competition, increase costs, and weaken incentives for innovation. Security exemptions allow governments to impose technical and legal requirements when systems pose genuine security or geopolitical risks. These requirements should directly address the risk, rather than assuming that a European supplier is inherently safer or more resilient than a non-European one.

Europe's own policies reflect this tension. The report on the state of the digital decade 2025 classifies the dependence on non-EU providers for cloud services and other digital infrastructure as a strategic dependency. At the same time, it identifies insufficient investment, fragmented markets, regulatory complexity, and a lack of advanced digital skills as obstacles to Europe's technological development. A protected domestic cloud market would not automatically solve these problems and could even reduce the very competitive pressure that made hyperscalers attractive in the first place.

Towards Practical Autonomy

A better approach targets the mechanisms that transform ordinary dependency into excessive dependency. The EU Data Protection Act provides an example: it requires cloud providers to facilitate vendor switching and data and application portability; switching and data exit fees are to be abolished from January 2027.

Governments should consider the entire lifecycle when procuring: a low initial price can mask high migration costs; a technically excellent platform can become problematic if the state loses the expertise needed to oversee or replace it; and a single vendor can become a systemic weak point. Governments must learn to strategically manage vendor dependency, data rights, lifecycle risks, concentration, and continuity.

The goal should be to keep options open. This might mean choosing a foreign or domestic vendor, using multiple vendors, or operating critical infrastructure themselves. The crucial factor is whether the chosen solution provides the government with the necessary capabilities, security, performance, and resilience at a reasonable cost.

Private companies will remain an integral part of the modern state, especially since significant technological advances continue to originate in the private sector. This aligns with the usual technological specialization and economic organization. The question for democratic governments is whether this dependence strengthens or limits their capacity to act. Sovereignty ultimately depends on practical freedom of action—not just the ability to set rules, monitor critical systems, and change course, but also the capacity to actually solve problems and deliver results for its citizens. A state that ties its own hands in the name of geopolitical independence forfeits this practical autonomy.  Europe should therefore measure digital infrastructure by the operational freedom it provides, rather than by the corporate identity of its providers. Stringent security requirements, interoperable standards, in-house expertise, and performance- based procurement allow governments to combine public capacity with private innovation. In this way, they can fully leverage the potential of the private sector without relinquishing control over their own decisions.