In our previous article, ‘Digital sovereignty: what’s the fuss about?‘, we covered the basics of digital sovereignty. Three years ago, hardly anyone was talking about it. Today the term is everywhere – and that is not a coincidence or a passing trend. It is the result of geopolitical, legal and technological developments that have gained momentum in recent years.
Why is digital sovereignty suddenly a boardroom topic?
The competitive landscape in cybersecurity is shifting, and with it, the strategic importance of a supplier’s origin.
European vs non-European cybersecurity vendors: what changes
The role of European suppliers in enabling sovereignty
European cybersecurity vendors are uniquely positioned to enable true digital sovereignty. Their role is multifaceted:
- Technological excellence: they must deliver products and services that match or exceed the capabilities of the world’s leading cybersecurity providers.
- Legal compliance within the EU: by keeping data and processes – such as threat intelligence analysis and sandboxing – within EU jurisdiction, they remain outside the reach of foreign laws such as the US CLOUD Act.
- Regional expertise: they often have deep knowledge of the European threat landscape, regulatory environment and industry-specific needs.
- Transparency and trust: by providing full visibility into their technology, development processes and data flows, they can build confidence.
What non-European suppliers would need to do
Non-European suppliers cannot afford to dismiss Europe’s push for digital sovereignty. To remain competitive and trusted in the EU market, they would need to:
- Invest in sovereign clouds: build and operate data centres within the EU, with legal guarantees that all data stored there remains fully under European jurisdiction. Companies such as Microsoft and Google have made progress here, but their initiatives remain incomplete, and true sovereignty has not yet been achieved.
- Demonstrate compliance: full, verifiable adherence to the GDPR, NIS2 and other EU regulations is the absolute baseline for market acceptance.
- Form strategic partnerships: collaborating with trusted European partners can strengthen credibility and local trust.
- Ensure full transparency: clearly disclose data flows and explain how requests from their own governments are handled, including any legal obligations that may conflict with EU law.
Have non-European suppliers built truly sovereign clouds?
Not yet. Despite substantial investment in European infrastructure and aggressive marketing, US tech giants face fundamental, seemingly unbridgeable challenges.
The legal catch-22: GDPR versus the US CLOUD Act
The core problem is not technological – it is legal. An American company, wherever it operates, remains subject to US law. This creates a direct clash between two opposing legal regimes:
- The GDPR requires that data belonging to EU citizens stays protected from access by foreign governments, unless such access meets strict European standards of necessity, proportionality and judicial oversight.
- The US CLOUD Act grants US law enforcement the authority to compel US-based technology companies to hand over data, regardless of where that data is stored.
This creates a legal paradox. If Microsoft receives a lawful request from the US government for data stored in its Dublin data centre, the CLOUD Act obliges compliance – refusal would violate US law. If Microsoft complies, it breaches the GDPR, because the access fails to meet EU legal safeguards.
An American company cannot simultaneously comply with both laws. The conflict is structural, and as long as it exists, full digital sovereignty cannot be achieved through non-European providers.
Why AXS Guard by Approach Cyber supports data sovereignty in Belgium
As a 100% Belgian and fully European technology, AXS Guard – now the sovereign managed security platform of Approach Cyber – embodies the core principles of digital sovereignty. For any organisation committed to safeguarding its data, infrastructure and autonomy, choosing a partner like Approach Cyber, built around the AXS Guard platform, is both a logical and strategic decision.
Choosing Approach Cyber and the AXS Guard platform means:
- Retaining ownership of your data and infrastructure without reliance on non-European jurisdictions.
- Operating within a stable European legal framework, fully compliant with the GDPR and other EU regulations – see our GDPR compliance services.
- Benefiting from local expertise, grounded in the Belgian and wider EU regulatory landscape, including NIS2 compliance.
- Strengthening resilience by working with a vendor that is both regionally rooted and internationally competitive.
Is digital sovereignty still meaningful if you rely on Big Tech?
The benefits of digital sovereignty are clear. But does it make sense to pursue it if your organisation continues to rely on technologies from global tech giants that cannot guarantee full sovereignty?
Yes – not only does it make sense, it is the only realistic and strategically sound approach. The goal is not to eliminate Big Tech; for most organisations, that is neither possible nor practical. The goal is to regain control over the critical points within your digital environment. This is a challenge every CISO and IT manager faces today, and an all-or-nothing approach simply does not work here.
Think of it this way: you may not own the public road (the internet) or the city where your office is located (the tech giant’s cloud), but you can control who is allowed through your front door, which keys they receive, and where your most valuable assets – your data – are stored, ideally in a high-security safe. Our data sovereignty and data security solutions are built around exactly that logic.
It is a ‘one-and-one’ strategy: continue to benefit from the productivity and scale of Big Tech, while adding a robust, sovereign security layer through a trusted European partner like Approach Cyber, powered by the sovereign AXS Guard platform.
FAQ: data sovereignty in Belgium
What is data sovereignty?
Data sovereignty means that data is subject to the laws of the country or region where it is collected or stored, and remains free from unauthorised access by foreign governments or jurisdictions.
Does the GDPR conflict with the US CLOUD Act?
Yes. The GDPR requires strict safeguards before EU citizens’ data can be disclosed to foreign authorities, while the US CLOUD Act can compel US-based companies to hand over data regardless of where it is stored. A US company cannot fully satisfy both laws at once.
Can an organisation be sovereign while still using Microsoft or Google?
Yes, in practice. Full independence from Big Tech is rarely realistic. Most organisations combine global cloud platforms with a sovereign, European security layer – such as the AXS Guard platform – to keep control over their most sensitive data and infrastructure.
Not sure how sovereign your current technology stack really is?
Talk to our GRC and data security experts to assess your exposure to non-European jurisdiction – and where a sovereign layer like AXS Guard by Approach Cyber would make the biggest difference.