Europe is finally getting serious about digital sovereignty, and getting it half right. The instinct to “Buy European” is sound, but the frameworks being built around it are solving for the wrong variable. Ownership and headquarters are snapshots; they tell you where power sits today, not where it will sit after the next acquisition. Skype had every European credential imaginable. Microsoft shut it down in 2025.

The missing piece is durability. Dries and Nicholas argue, convincingly, that a sovereignty score without an open-source licensing requirement is a sovereignty score with an expiry date. The GPL licence did not stop Oracle from acquiring Sun Microsystems, but it ensured that MySQL could not be discontinued. MariaDB exists today because someone had the legal right to fork before the deal closed. That right is structural; it does not depend on which flag flies over the headquarters.

The forthcoming Cloud and AI Development Act is the real test.…