The concept of digital sovereignty—the collective ability of states and communities to shape, govern, and safeguard digital infrastructures, data, and standards that underpin their societies—is a crucial topic gaining traction worldwide. While it’s out of reach, impractical, and counterproductive for every country to own every layer of its technology stack, national and regional digital sovereignty movements should focus on developing critical capacities and being strategic about their technology dependencies. They should also embrace like-minded digital cooperation if they choose to engage in such conscious decoupling. Digital public goods (DPGs) and the communities built around these public interest, open-source tools are proving to be of great value to governments, communities and people as they seek to strengthen their digital sovereignty in a shifting geopolitical landscape.

A Global Imperative: Beyond Europe

Digital sovereignty has become one of the leading policy priorities in the European Union, which is addressed twofold by (1) laws and regulations that are designed to address the concentrated power of tech giants, e.g. through the Digital Markets Act, Digital Services Act and industrial policy proposal and (2) by strategically supporting Europe’s tech ecosystem through legislation and investment vehicles such as the European Chips Act, the Apply AI Strategy, and the InvestAI Initiative. The growing EU tech sovereignty movement doesn’t stop there. Initiatives such as the EuroStack proposal and calls for strategic funding of open-source software with a European Sovereign Tech Fund are increasingly focusing on the role of open-source technologies in achieving technology sovereignty. Yet, this debate is far from a solely European concern.

We also see this desire for digital sovereignty on the African continent, where the pursuit of digital self-reliance is equally, if not more, critical. The African Union's Digital Transformation Strategy for Africa (2020-2030) explicitly aims to empower Africa's "ownership of modern tools of digital management" and safeguard the continent's data sovereignty. Similarly, the AU Digital Compact (2023) further emphasises the need for an inclusive and rights-respecting digital future, built on African terms. H.E. Wamkele Mene, Secretary-General of the African Continental Trade Agreement Secretariat, described digital sovereignty, alongside inclusivity and interoperability, as a shared principle on which African digital public infrastructure should be built.

The Stakes Are High: Lessons from Real-World Examples

The urgency of this quest is underscored by real-world incidents where a lack of digital sovereignty has led to significant vulnerabilities.

Consider the case of Kenyan health data. For years, critical national health systems and sensitive patient data were hosted on US-based servers, supported by USAID. When USAID was dismantled, these systems were abruptly shut down, leaving Kenya without access to its own vital public health information. This starkly illustrates how external control over fundamental digital infrastructure can undermine a nation's ability to manage its own public services and safeguard its citizens' well-being.

Another powerful example emerged from a diplomatic spat involving the International Criminal Court (ICC) and Microsoft. Amidst US sanctions against an ICC official, Microsoft was compelled to disconnect the official's email account temporarily—although the details of this process remain contested. Even though the data might have been physically located in Europe, the incident highlighted the extraterritorial reach of certain national laws, like the US CLOUD Act. This demonstrates that not even the physical location of data always guarantees sovereignty if the service provider is subject to foreign jurisdiction, posing a significant challenge to the notion of data control.

In light of these and other examples, there’s a growing uncertainty over the reliability of critical digital infrastructures that power societies if they can’t be effectively controlled. The Linux Foundation concluded: “That lack of certainty is driving governments everywhere to find self-reliant solutions that put the steering wheel back in their hands."

DPGs: Enablers of a better digital future

In the face of such challenges, open source technologies and DPGs are a critical part of the puzzle in advancing national digital sovereignty. They provide foundational, open and accessible components and solutions that nations and communities can own, adapt, and control. By doing so, they reduce dependence on proprietary systems, strengthen autonomy and advance transparency and accountability - essential aspects to building trusted and reliable digital solutions. Moreover, open-source technologies and digital public goods are inherently designed to be built by communities, facilitating broader participation in technology development and promoting democratic, commons-based governance. As Christian Paterson put it: “[Open source] is one of our strongest tools for digital autonomy, a powerhouse for value creation, and an unmatched engine for knowledge sharing.“ The number of contributors to open-source projects is growing most significantly in developing and emerging economies, such as India and Brazil, where leading (potential) DPGs have emerged in recent years.

Take, for example, MOSIP (Modular Open Source Identity Platform), a leading platform that enables countries to establish secure, inclusive, and nationally owned foundational digital identity systems, which was modelled on the Indian Aadhaar system. In Ethiopia, the National ID Program (NIDP) has embraced MOSIP for its national digital ID solution. This strategic choice enables Ethiopia to tailor and manage its identity infrastructure, promoting self-reliance and ensuring that its citizens' identities are handled within national borders. You can read more about Ethiopia’s DPG journey here.

Another transformative DPG is X-Road, the open-source software that powers the data exchange layer in more than 20 countries globally, including Estonia, Finland, Cambodia, South Africa and Chile. It enables public and private sector databases to communicate seamlessly and securely, thereby building the backbone of digital service delivery. Ville Sirviö, CEO of the governing body Nordic Institute for Interoperability Solutions (NIIS), explains the advantages of X-Road’s approach: “X-Road, as an open-source software, allows governments to build a sovereign data-sharing infrastructure under their own control. It helps avoid vendor lock-in and provides a unified and secure data exchange model for organisations.”

Finally, the DPG Decidim, an open-source platform for participatory democracy, empowers citizens to engage directly in public policy-making and service design. Used by hundreds of cities, regions and organisations globally, including Helsinki, Mexico City, New York City and Yokohama, it champions transparency and democratic control over digital processes. As Nil Homedes, Executive Director of the Decidim Free Software Association, highlights: “Decidim supports digital sovereignty efforts by providing a commons-based, open-source platform for citizen participation, enabling communities to establish publicly governed digital spaces for democratic discourse rather than relying on established, toxic social media platforms. Its public-commons collaboration model demonstrates how to design the governance of digital commons, making it a unique global example of implementing free software as public policy through community-led governance."

Three notes of caution

However, open-source and digital public goods are not an end in themselves or silver bullets. As it stands, open-source is also a business strategy that has been successfully used in the past by big tech companies to dictate standards and capture labour and ecosystems. Google’s Android operating system is a prime example of this approach. Regulations and policies that aim to support open-source and digital public goods, particularly in the context of digital sovereignty, must therefore be carefully crafted to avoid corporate capture.

Nations and regions also have varying capacities to achieve greater strategic autonomy and build for intelligent interdependence. Even though digital public goods are intended to reduce reliance on big technology vendors, they can also create new dependencies if introduced without the right foundations. For example, adopting a complex platform that is maintained abroad may leave governments reliant on external experts or donors for updates and operations. In such cases, control is not truly gained — it is simply shifted. This makes it essential to consider the local context carefully. Where skills, resources, or governance structures are limited, investments may need to begin by building local capacity. Otherwise, even open technologies risk replicating the very lock-in dynamics they were designed to overcome.

Lastly, national sovereignty interests don’t necessarily equal public interest. Several proposals on the EU level that focus on supporting national champions, for instance, in applied AI, say surprisingly little about the public interest these investments should yield and the enablement of democratic governance of publicly supported digital infrastructures and products. If we genuinely want to advance digital sovereignty, it is paramount to make the public interest centre stage and strengthen the technology autonomy and resilience of individuals, communities and institutions. This also includes supporting technology that reflects the lived realities of everyone it should serve, not just the private interests of the few, regardless of whether they are so-called “national champions”.

Five steps countries and societies can take to advance DPGs for digital sovereignty

Against the shifting geopolitical landscape, the striving for digital sovereignty and self-reliance is gaining urgency globally. We must collectively act now to accelerate this progress, translate policies and declarations of intent into action, and avoid falling into the same old trap by prioritising “national champions” over the public interest at large.

Here are five steps that countries and communities can take to strengthen digital sovereignty through the use of digital public goods and open source technologies:

1. Collaborate with like-minded partners: There is an ongoing misconception that the digital sovereignty movement is “isolationist.” Open-source and digital public goods are inherently designed to enable commons-based peer production. Collaboration and coordination with like-minded partners across sectors and geographies is key to unlocking the potential of open-source and digital public goods by sharing learnings, best practices and technologies and collectively coordinating the production and maintenance of key resources. Organisations and vehicles such as the DPGA, Open Forum Europe and the EDIC on digital commons, amongst others, provide the platforms for doing so.

2. Use procurement as a lever: Amend regional and national procurement policies, such as the EU’s public procurement directives, to include an open-source first approach (see a collection of examples from the Inter-American Development Bank here). Under this rule, public bodies would have to choose open-source software by default, and a proprietary solution could only be procured if there's a demonstrable and publicly documented justification for doing so. Yet, procurement must be outcome-focused, not ideological. Additional measures should include shifting away from over-indexing on upfront investment cost assessments to prioritising total cost of ownership (TCO) while ensuring feature parity, revising templates to fit open-source solutions, and building open-source literacy and capacity within procurement offices.

3. Sustainable funding for open-source technologies: Nations and regional blocs should significantly increase their investment in open-source technologies to strengthen our shared digital foundations by enhancing cybersecurity and ensuring long-term maintenance, laying the basis for interoperability, cost savings, competitiveness and resilience. To make this a reality, the EU and nation states should strategically support DPGs and earmark a dedicated stream of funding for the EU Sovereign Tech Fund in the next Multiannual Financial Framework.

4. Understand the demand side and support open-source and digital public goods: Public investments in digital technologies and the necessary infrastructure must be demand-driven. It should focus on resolving bottlenecks that hinder the development and scaling of solutions that deliver public value and prioritise user demands. This includes providing enabling environments for digital solutions that solve real-world problems, such as toxic social media platforms. Policy instruments such as R&D tax exemptions for public interest technologies and advance purchase commitments can help create investment security, predictability, and incentivise product development that addresses market failures.

5. Develop capacities and skills: Digital sovereignty requires the ability to create and enforce one’s own rules and democratically govern one’s own infrastructures. This is particularly true for countries and communities from the Global Majority – they must develop public sector capacity to create an enabling environment for digital public goods, open-source, and public interest technologies. This effort should go hand in hand with unlocking local economic potential by growing open-source capabilities and skills among youth, aspiring and established developers and innovators.

Digital public goods are a subset of open-source technologies that demonstrate adherence to the DPG Standard. This includes being relevant for the Sustainable Development Goals (SDGs) and thereby offering solutions that create public value. Supporting the open-source and public-interest tech ecosystems will lead to more and better digital public goods, advancing digital sovereignty efforts and fostering more just society.