Cloud strategy is now a sovereignty issue for financial institutions

Dependence on global cloud providers is a reality for financial institutions in the foreseeable future. Full independence is not currently achievable—pursuing it as a strategic objective could become so consuming that it slows decision-making rather than enabling it.

Against the backdrop of geopolitical developments, economic considerations, regulations such as DORA, and increasing cyber threats, digital sovereignty is becoming a strategic governance issue, encapsulated by the principle: dependent by default, sovereign by design.

Keeping control of cloud dependency

For banks, insurers, and other financial institutions, cloud dependency was long regarded primarily as an operational reality. As long as services remained available, costs stayed manageable, and innovation was supported, the discussion mainly focused on sourcing, architecture, and procurement.

That approach is no longer adequate. The focus is shifting as critical services, data platforms, security tools, and AI capabilities become concentrated among a small number of providers. The question is no longer whether that dependency exists, but whether it can continue to be effectively managed.

Technology spending can reinforce the dependency

Because cloud, data and AI dependencies grow together, scaling these capabilities concentrates spend on a small number of global providers. That strengthens their revenue, margins and capacity to invest in research and development, and it widens the gap with European alternatives over time. For financial institutions, this means sourcing decisions are no longer only commercial. They shape future switching costs, negotiating power and fallback options. 

Digital sovereignty is therefore best understood as a disciplined way to preserve choice. If Europe could divert a percentage of this spending to European parties, this could be enough to reinvigorate the technology sector and attain productivity benefits.  

Digital sovereignty deserves board-level attention

Four factors are driving this agenda.

1. Technology providers shape strategy
   The first factor relates to geopolitical developments. Relationships that previously appeared to be primarily commercial in nature are increasingly taking on strategic importance. Technology providers operate in a context where sanctions, trade policies, cybersecurity concerns, and extraterritorial legislation are becoming increasingly important. This does not mean that disruption is inevitable, or that existing providers are no longer suitable, but it does mean that access to services, support, and control over critical digital functions cannot be taken for granted under all circumstances.
2. Europe’s digital infrastructure gap
   The second factor is systemic: Europe is lagging behind in digital infrastructure. Although European alternatives are emerging, in many areas they do not yet offer the same scale, functional depth, or access to innovative ecosystem players as the hyperscalers. The question, therefore, is not whether this dependency will disappear entirely in the short term, but where such dependencies are acceptable and where additional safeguards are needed.
3. The regulatory landscape
   The third factor concerns laws and regulations, such as the Digital Operational Resilience Act (DORA). Financial institutions are obliged to be able to demonstrate how they govern technology risks arising from third parties, including where chains of providers and subcontractors are involved. This affects a range of areas, including access management, encryption key control, logging, auditability, exit arrangements, and preparedness for disruptions to digital infrastructure.
4. Cyber threats
   The final factor is cybersecurity. Threats are increasing in intensity, driven in part by hostile attacks on critical infrastructure and technological developments such as AI-assisted offensive capabilities. Advanced security capabilities are often provided by a limited number of largely non-European providers. While they offer scale and innovation capacity, reliance on these providers also increases dependency. Digital sovereignty therefore does not require avoiding these technologies, but rather deliberately managing where data is stored, who has access, and how critical processes remain protected when circumstances change.

Treat digital sovereignty as a series of choices

Even when all four factors are considered, the debate on digital sovereignty often takes an unhelpful direction. Too often, digital sovereignty is presented as an all-or-nothing choice: do we remain on global cloud platforms, or do we move away from them? For most financial institutions, both extremes are unattractive. A wholesale exit would be costly, slow, and potentially constrain innovation. At the same time, it is equally difficult to justify having critical dependencies that are poorly understood, rarely tested, and difficult to control. Rather than viewing digital sovereignty as a single end-state, a more effective approach is to treat it as an ongoing cycle of choices: gaining insight, choosing strategic pathways, stress-testing, and implementing measures.  

Cloud usage remains essential

The approach presented here recognises that cloud dependency is inherent in modern digital business models. However, it also highlights when dependency becomes a strategic weakness: when it is invisible, poorly governed, or unmanageable when circumstances change.

This matters because financial institutions often cannot afford to slow down their digital transformation. Data, data analytics, and artificial intelligence are becoming increasingly central to customer service, operational efficiency, and competitive strength. Innovative players are poised to capture market share from established organisations and are less likely to constrain their cloud usage due to sovereignty concerns.

The more growth the cloud enables, the more important the quality of dependency management becomes. If critical components continue to be concentrated among a small number of external providers, organisations must be clear about where control lies and which options remain available if circumstances change.

Treat digital sovereignty as an ongoing strategic priority

Digital sovereignty affects strategy, resilience, compliance, and freedom of choice in the long term. As a board member, you do not need to launch a major sovereignty programme today based on an abstract ideal of complete independence. But you do need to make the topic an ongoing strategic priority rather than a one-off initiative. This means incorporating sovereignty criteria into sourcing, architecture, and investment decisions, prioritising no-regret measures for the most critical functions, and determining where a fallback option should be kept on standby.

For financial institutions, the core question is not whether they are dependent on global technology providers. For the foreseeable future, that is largely unavoidable. The real question is whether they manage those dependencies effectively.