Translated from the German original. Read the original in German.
Yes – but it is not enough.
Open source is a central building block of digital sovereignty. It creates transparency, reduces dependencies at code level and makes independent operating models possible. Without a binding legal framework, however, it remains incomplete.
In Germany, almost every critical area is regulated – from data protection and procurement law to critical infrastructure (KRITIS) and security requirements. For digital sovereignty, by contrast, there is no consistent legal framework with clearly defined minimum technical requirements.
Organisations that work entirely in a hyperscaler cloud – Microsoft Azure, for example – are in de facto lock-in. Switching is possible on paper, but barely feasible in practice. Proprietary platform services, complex identity architectures, non-standardised configuration models and the economic exit costs are simply unmanageable.
Nor does a conceptual “Plan B” replace switchability that is structurally safeguarded.
If Germany wants to be a sovereign digital state, it needs clear legal guard rails.
In my view, four points would be central:
1️⃣ A legal right to full portability.
An enforceable right to the release of all data.
2️⃣ Mandatory use of open standards.
Prescribed export and migration interfaces such as JSON, XML, ODF, OpenAPI, OCI.
3️⃣ Limits on economic barriers to exit.
No technically engineered obstacles to switching provider.
4️⃣ Regular proof of exit capability.
Actual switchability must be reviewed and documented periodically. -> “Plan B works.”
With the EU Data Act, Europe has taken a first step, particularly in reducing barriers to switching cloud services. For the public sector in Germany, however, a more far-reaching, concretely operationalised implementation is needed – firmly anchored in procurement law and in standard contract frameworks.
Such a framework would also be a cornerstone of a thriving digital economy in Germany and Europe.
When switchability is genuinely secured, real competition emerges. Every market participant remains free to choose its provider. Investment then follows not structural dependency but quality, innovation and value for money.
Under these conditions, substantial investment would be retained and expanded within Europe. Billions could flow into European providers, our own platforms and a viable digital ecosystem – instead of permanently into closed dependencies.
Digital sovereignty comes from open standards, technical reproducibility, regulatory enforcement and strategic architecture decisions.
We need to put digital sovereignty on a legal footing – and build a digital economy at the same time!
