Tech sovereignty: the French state is cutting its non-European dependencies, and it will affect you

On the website of the French state purchasing directorate, a five-paragraph news item dated 16 April 2026 announces an interministerial seminar on “reducing dependencies on non-European products”. The tone is administrative and the page goes unnoticed. Yet if you pull the thread, you find what is probably the most concrete shift in French public-sector IT in ten years: an enforceable circular, an implementing decree, a binding timetable and a numerical target in preparation. Here is what lies behind it, and why it will not stay confined to the ministries.

An administrative news item, a turning point behind it #

On 8 April 2026, the DINUM (the French government's interministerial IT directorate) held an interministerial seminar with ANSSI, the French national cybersecurity agency, the DAE (state purchasing directorate) and the DGE (directorate-general for enterprise). Ministers Anne Le Hénanff (Artificial Intelligence and Technology) and David Amiel (Public Action and Accounts) spoke there. The purpose: to move from acknowledging dependency to an exit plan, ministry by ministry.

The sentence in the press release that sums up the change of tone comes from David Amiel: “The state can no longer simply observe its dependency, it must get out of it.” And above all: “We can no longer accept that our data, our infrastructure and our strategic decisions depend on products whose rules, prices, development and risks we do not control.” That set of four (rules, prices, development, risks) is exactly the grid we use when a client asks us whether their infrastructure is “sovereign”. Its merit is that it does not stop at the question of location.

The figures that make dependency measurable #

In August 2026 the DINUM published a blog post setting out the orders of magnitude, drawing on the work of the European Commission and on the Draghi report. This is useful, because tech sovereignty suffers from a classic flaw: everyone talks about it, nobody puts a figure on it.

• Nearly 80% of European IT infrastructure and technology is imported (Draghi report). That is not a market share, it is a structure.
• €264 billion a year: European spending on IT products and services, mainly American.
• €4.2 billion a year for the French state alone. That is the amount public procurement can act on directly.
• Android, Microsoft and iOS account for almost all operating systems used in Europe, and Google handles 89% of web searches.

The term that has taken hold in the debate is kill switch: the possibility, theoretical or real, that services become unavailable on a third party's decision. This is no longer a seminar scenario. The DINUM cites the case of the French judge Nicolas Guillou, at the International Criminal Court, whose online life was wiped out overnight after an arrest warrant targeting the Israeli Prime Minister. We described a similar episode on the artificial intelligence side, when two models were cut off for the entire planet on a government's orders: the sovereignty lesson every SME should take from it.

The circular of 5 February 2026: sovereignty becomes a purchasing criterion #

This is the founding text, and it went largely unnoticed. The Prime Minister's circular of 5 February 2026 (no. 6519/SG) on public procurement of IT sets a purchasing doctrine for the state and its public bodies. A detail that matters: Légifrance classifies it as an enforceable circular (circulaire opposable), meaning that anyone can rely on its interpretation. This is no longer a statement of intent.

First, it sets a hierarchy for choosing a tool, in this order: first the shared tools that already exist internally (the DINUM's interministerial platform, OSIIC, shared services); then off-the-shelf products from the market; and only as a last resort, bespoke development. It is a common-sense doctrine that we also apply with our clients, and it runs against the reflex of “let's have a custom tool built”: custom software is an excellent choice when the need is genuinely specific, and a very poor one when it duplicates an existing product.

It then defines what “tech sovereignty” means for a buyer, in three components. This is by far the most reusable part of the text:

1. Immunity from non-European regulations with extraterritorial reach. In other words: can your supplier be compelled by foreign law to hand you over, or to cut you off?
2. The ability to substitute. If this component disappears, is there an alternative, and what does it cost to leave? This is the question of reversibility, the one most often forgotten at the moment of signing.
3. Control of essential technologies. Do you understand what you use, can you audit it, modify it and develop it without depending on a vendor's goodwill?

The circular comes with a DINUM guide on data sensitivity, and makes ANSSI's SecNumCloud qualification the instrument that certifies that a cloud offer is adequately protected against non-European rules. For the DAE, implementing this text is presented as one of the major issues in its 2026 work programme.

The decree of 14 April: when doctrine becomes obligation #

Two months later, decree no. 2026-272 of 14 April 2026 made Article 31 of the SREN law of 21 May 2024 enforceable. Where the circular guides, the decree compels. It covers data described as of particular sensitivity: data whose compromise could affect public order, security, the health or life of individuals, or the intellectual property of the administration.

• Who is covered: state administrations, their operators, and six public interest groupings named individually (including the Agence du numérique en santé, the French health IT agency, and the Centre d'accès sécurisé aux données, the secure data access centre).
• What is required: hosting with a SecNumCloud-qualified provider, or one holding an equivalent European certification.
• The framework: ANSSI is tasked with drawing up a technical framework, approved by order of the Prime Minister, covering some ten areas, from cryptology to where the provider's shareholders are based.
• Exemptions: they exist for projects begun before the decree was published, are granted by the minister after approval by the Prime Minister, and are limited in time. An exemption is not an acquired right, it is a delay.

Seven workstreams, one plan per ministry, before the autumn #

The seminar of 8 April set the method. The DINUM coordinates an interministerial plan, and each ministry, operators included, must formalise its own plan for reducing dependencies by autumn 2026. We are writing these lines at the end of August: the deadline is now. The seven mandatory areas are as follows.

1. The workstation (operating system and office suite).
2. Collaboration tools (e-mail, video conferencing, file transfer, shared documents).
3. Antivirus and endpoint security.
4. Artificial intelligence.
5. Databases.
6. Virtualisation.
7. Network equipment.

It has not stayed theoretical. The press release of 8 April announces three moves already under way: the DINUM is leaving Windows for Linux workstations; the national health insurance fund (Caisse nationale d'Assurance maladie) is migrating its 80,000 staff to the interministerial platform (Tchap for messaging, Visio for video conferencing, FranceTransfert for files); and the health data platform is moving to a trusted provider by the end of 2026. On 29 June 2026, the first “Rencontres industrielles du numérique de l'État” (state tech industry meetings) brought the sector together to turn public-private coalitions into reality, with the announced formalisation of an alliance for European sovereignty.

These seven areas make a surprisingly transferable checklist. Look at your own: on virtualisation, for example, the question “which platform, and who controls it?” arises in exactly the same terms for an SME as for a ministry. We covered it in detail in Proxmox vs TrueNAS vs Unraid: which platform for sovereign self-hosting. On AI, it ties in with our lessons learned from self-hosting an LLM for business applications.

The Observatory: the state has already asked businesses the question #

One initiative went even more unnoticed, although it directly concerns the private sector. On 26 January 2026, Anne Le Hénanff and the High Commissioner for Strategy and Planning, Clément Beaune, launched the Observatoire de la souveraineté numérique (Tech Sovereignty Observatory), entrusted to the High Commission. Its mission has three parts: to draw up a shared diagnosis of critical dependencies, to provide decision-support tools for public and private buyers alike, and to guide public policy.

Its operational phase consisted of a national questionnaire sent to businesses of all sizes and sectors, open until 12 June 2026, on their critical IT uses and their technological dependencies. Clément Beaune sums it up as follows: “to identify dependencies on non-European software tools, with the businesses themselves […] in order to identify weak points and then remedy them, by proposing French and European alternatives”. The findings are announced for after summer 2026: they are therefore imminent as we publish.

Sovereignty begins with clear-sightedness. We need to know where we depend and on what: on which technology building blocks; in which sectors; and for which uses.

“Changing the tyrant's nationality is not enough” #

That is Henri Verdier's phrase, quoted by Emma Ghariani, head of the Open Source and Software Commons unit at the DINUM, in a blog post published on 12 August 2026. Everyone who sells, or buys, “sovereignty” should reflect on it. Replacing a foreign technology monopoly with a national or European one reduces certain dependencies, but does not remove the risk that comes from concentrated technological power. Sovereignty based solely on proprietary software, even French software, does not solve the underlying problem: you still cannot audit, modify or develop what you depend on.

This is precisely the test we applied to the European Parliament's move to Qwant: real sovereignty, or a layer placed on top of an American index? The full analysis is here, and its conclusion holds for any supplier: you have to look beneath the top layer, and know who can be compelled by which law.

The DINUM's answer is openness and shared governance. Three examples it highlights:

• Tchap, the state messaging service used by more than 400,000 staff, is built on the open Matrix protocol, backed by a British foundation. The dependency is acknowledged but managed: the DINUM supports the foundation, takes part in its working groups and sends staff to its decision-making bodies. Depending on a building block whose roadmap you help decide is not the same as depending on a vendor.
• Panoramax, an open alternative to Google Street View backed by IGN (the French national mapping agency) and OpenStreetMap France, whose governance brings together local authorities, public bodies and private companies.
• Geotrek: €70,000 of initial development funded by two national parks, today more than 100 organisations using and contributing to it, for an estimated value of €4 million. Emma Ghariani draws a formula from it that should speak to any business leader: “For every euro invested in open source software, 10 ministries can benefit.”

France has also supported the creation of a European structure (EDIC) bringing together Germany, the Netherlands, Italy and Luxembourg, with a dozen observer countries, to fund the scaling-up of strategic software commons. This momentum fits with the European regulatory movement we analysed in Tech Sovereignty Package: Europe takes back control of its public data.

What it changes for you, even if you are not the state #

If you sell to public buyers #

Your next specifications will contain requirements you did not see eighteen months ago: the supplier's immunity from extraterritorial law, the location of data and of shareholders, reversibility clauses, audit commitments, termination in the event of a change of control. This is not national preference in disguise: European law forbids it, and lawyers point out that these criteria must remain linked to the subject of the contract and proportionate. But a bidder able to document its subcontracting chain and demonstrate real reversibility will have an advantage. If you subcontract your hosting to a hyperscaler without knowing it, now is the time to find out.

If you are a municipality, a social welfare centre (CCAS) or a joint authority #

The decree of 14 April covers the state, its operators and six public interest groupings: local authorities are not directly subject to the SecNumCloud obligation. But the trickle-down effect is already here. The state's doctrine is becoming the reference cited by advisers, prefectures, cyber insurers and, in the event of an incident, judges. And in substance, a town hall does process data whose compromise would affect its residents: civil registration, social services, planning, video surveillance. We set out what a public website must comply with (RGAA, the French accessibility standard, GDPR, hosting, procurement) on our page dedicated to town hall and municipal websites.

If you are a private SME #

Nothing obliges you to do anything. But the state has just produced, free of charge, the best analysis grid available for a subject most business leaders do not know how to approach. And the Observatory has explicitly included you in its diagnosis: “decision-support tools for public and private buyers” are an announced deliverable. You might as well use it before your main contractor, your insurer or your key account client asks you the question.

The state's grid, adapted to an SME #

Here is how we translate the circular's criteria when we audit a client's existing systems. None of these points requires legal expertise: they are questions to put to your providers, in writing.

1. Business performance first. The circular puts performance before sovereignty, and that is healthy. A sovereign tool that does not do the job is not an answer, it is a problem moved elsewhere.
2. Which law is my provider subject to? Not “where are the servers”, but: what is the nationality of the contracting entity, and who controls its capital?
3. What is my exit cost? How many person-days and how many euros to leave, and in what format do we get the data back? If nobody can answer, reversibility does not exist.
4. What is my availability dependency? If this service goes down or closes, what stops on my side, and how quickly?
5. What is my price exposure? A supplier in a position of strength sets its prices. A 40% rise at renewal is a scenario, not a textbook hypothesis.
6. Do I understand, and can I audit, what I use? Are the formats open, the logs accessible, the configuration exportable?
7. Interoperability. Does this component speak standards, or a proprietary format that ties me in?
8. Full lifecycle cost, not the introductory price of the first year.

Where to start: mapping before migrating #

The most common mistake is to start by migrating something. The state did not fall into that trap: it launched an Observatory and a mapping exercise before setting a numerical target. The same method applies to an SME, in five steps.

1. Take inventory. The list of every IT service in use, including those subscribed to by business teams without going through IT. This is often the step that surprises people most.
2. Rank by criticality. What stops the business in less than a day if it goes down? The rest can wait.
3. Assess the exposure. For each critical service: applicable law, control of capital, location of data and backups.
4. Estimate the exit cost. For the three or four most critical services only. A rough figure is enough to decide.
5. Decide, and document the decision. Some dependencies will be brought back in-house; others will be kept knowingly. Both are valid choices. What is not valid is not knowing.

The limits that need naming #

It would be dishonest of us to present all this as a done deal. Several reservations need stating.

• The numerical target does not exist yet. The press release of 8 April states that the DAE's mapping and the DGE's work will make it possible “to refine the numerical reduction target with a clear timetable”. In other words: at the date this article is published, the figure and the timetable are still to come.
• A plan is not a migration. Each ministry must submit a plan before the autumn. Between a submitted plan and 2.5 million workstations migrated lie a decade of work and many opportunities to give up.
• The qualified offer remains limited. Requiring SecNumCloud is easy to write into a contract; finding, for each business need, a qualified provider that can handle the load and the budget is much harder. That is the whole point of the industry meetings: giving the sector visibility so that it invests.
• The risk of sovereignty-washing is real. Every new regulatory requirement produces its wave of repainted offers. The three-component grid (immunity, substitutability, control) is the best detector available.
• Pure national preference remains illegal under European public procurement law. Sovereignty requirements must be justified by the real sensitivity of the data and proportionate to the subject of the contract.

What we do, in practice #

We did not wait for the circular to work this way, and we do not claim to embody French tech sovereignty on our own. What we know how to do is apply this grid to real projects: our servers are in France, with operators under French law, and the infrastructure is our own. That is the purpose of our sovereign hosting offer and of our managed services.

The principle applies building block by building block, and this blog is its logbook: audience measurement with no cookies or third parties using self-hosted Matomo, spam protection without Google or Cloudflare using ALTCHA, immutable backups on our own hardware, and AI connected to open models hosted by us rather than to an API a third party can switch off. When a business need has no off-the-shelf equivalent, we build it (custom software development, business applications) with the same reversibility requirements. Our case studies show what that looks like in production.

In summary #

• The circular of 5 February 2026 makes tech sovereignty an enforceable purchasing criterion for the state, with a three-part definition: extraterritorial immunity, ability to substitute, technological control.
• Decree no. 2026-272 of 14 April 2026 makes SecNumCloud-qualified hosting mandatory for data of particular sensitivity held by the state, its operators and six public interest groupings.
• Each ministry must submit its dependency reduction plan before autumn 2026, across seven areas: workstation, collaboration tools, antivirus, AI, databases, virtualisation, network.
• The Tech Sovereignty Observatory surveyed private businesses until 12 June; its findings are expected after summer 2026.
• Local authorities and SMEs are not legally bound, but they inherit a solid analysis grid, and public clients who will ask these questions.
• The right first action is not to migrate: it is to map, estimate the exit cost, then decide.

Do you want to know where your infrastructure is really exposed, and what it would be sensible to bring back? That is the scoping we do with our clients, in Strasbourg and across France: let us talk. The first conversation is free, and it always starts with mapping, never with migration.

Sources #

• DAE, “Tech sovereignty: a collective drive to speed up the reduction of non-European dependencies” (in French, 16/04/2026): https://www.economie.gouv.fr/dae/souverainete-numerique-une-dynamique-collective-pour-accelerer-la-reduction-des-dependances-extra-europeennes
• DINUM, press release “Tech sovereignty: the state speeds up the reduction of its non-European dependencies” (in French, 08/04/2026): https://www.numerique.gouv.fr/sinformer/espace-presse/souverainete-numerique-reduction-dependances-extra-europeennes/
• DAE, “The Prime Minister's circular on public procurement of IT: a key issue for the DAE in 2026” (in French, 06/03/2026): https://www.economie.gouv.fr/dae/circulaire-du-premier-ministre-sur-la-commande-publique-numerique-un-enjeu-cle-pour-la-dae-en-2026
• Légifrance, “Circular on public procurement of IT” of 05/02/2026 (in French): https://www.legifrance.gouv.fr/circulaire/id/45649
• DINUM, guide on data sensitivity (in French): https://www.numerique.gouv.fr/offre-accompagnement/reference-vade-mecum-sensibilite-donnees/
• DAJ Bercy (legal affairs directorate of the economy ministry), “Publication of the implementing decree for Article 31 of the SREN law” (in French): https://www.economie.gouv.fr/daj/publication-du-decret-dapplication-de-larticle-31-de-la-loi-sren-relatif-la-protection-des-donnees-dune-sensibilite-particuliere-de-letat
• DAJ Bercy, technical sheet on implementing Article 31 of the SREN law, with standard clauses (in French): https://www.economie.gouv.fr/daj/nouvelle-fiche-technique-sur-la-mise-en-oeuvre-de-larticle-31-de-la-loi-du-21-mai-2024-visant-securiser-et-reguler-lespace-numerique-associee-des
• High Commission for Strategy and Planning, “Launch of the Tech Sovereignty Observatory” (in French, 27/01/2026): https://www.strategie-plan.gouv.fr/actualites/lancement-de-lobservatoire-de-la-souverainete-numerique-mesurer-les-dependances-pour
• High Commission for Strategy and Planning, “Tech Sovereignty Observatory: launch of a national diagnosis among businesses” (in French, 18/05/2026): https://www.strategie-plan.gouv.fr/actualites/observatoire-de-la-souverainete-numerique-lancement-dun-diagnostic-national-aupres-des
• DINUM, “Tech sovereignty: why openness has become a strategic necessity” (in French, 12/08/2026): https://www.numerique.gouv.fr/sinformer/blog/souverainete-numerique-pourquoi-louverture-est-devenue-une-necessite-strategique/
• DINUM, “State tech industry meetings, 1st edition” (in French, 29/06/2026): https://www.numerique.gouv.fr/agenda/rencontres-industrielles-numerique-etat-1ere-edition/
• Mathias Avocats, “Anchoring tech sovereignty at the heart of public procurement: the circular of 5 February 2026 and the SREN implementing decree” (in French): https://www.avocats-mathias.com/cybersecurite/ancrer-la-souverainete-numerique-au-coeur-de-la-commande-publique-circulaire-lecornu-du-5-fevrier-2026-et-decret-dapplication-de-la-loi-sren
• Banque des Territoires, “SecNumCloud: six public interest groupings covered, sensitive data finally defined” (in French): https://www.banquedesterritoires.fr/secnumcloud-6-gip-assujettis-les-donnees-sensibles-enfin-definies