Digital Sovereignty: Austria Takes the Initiative

A cloud region in Europe is not yet digital sovereignty. Server location and legal control are two different things.

Digital sovereignty means: the ability to decide for oneself which technology a company uses. A non-European jurisdiction must not gain access to this – neither to this decision nor to the underlying data. Because this does not arise at the level of the cloud interface. It arises at the infrastructure level: through software sovereignty and technical decision-making authority.

That's also the central claim of the Initiative's position paper:

Digital sovereignty does not arise solely from operating data centers in Europe. It requires competitive European cloud solutions, fair competitive conditions relative to global platform providers, and greater use of European offerings by business and government.

Critical infrastructure is the foundation on which public administration, healthcare, energy supply, and the financial sector run. Anyone who is dependent on individual, non-European providers for this foundation loses negotiating power. And becomes vulnerable.

The position paper names four reasons why the issue is pressing now:

• Reducing dependencies on non-European cloud providers. European cloud solutions create additional choices. They also combine data protection, cybersecurity, legal clarity, and competitiveness. This is not autarky or isolation, but a deliberate alternative.
• Strengthening Europe's opportunities for competitiveness and innovation. Targeted investments in capital, market access, and know-how enable European companies to fully tap into their economic potential.
• Switching to other providers is difficult and expensive. Proprietary software solutions tie companies and government bodies down long-term, hinder innovation, and reduce competition.
• Shortage of skilled workers in the digital sector. Without targeted training and attractive digital careers, Europe risks falling further behind internationally.

An important distinction here, also made by A1 Deputy CEO Thomas Arnoldner in his statement: "Digital sovereignty doesn't mean isolation – it means freedom of choice and European alternatives, especially for critical data. With our sovereign cloud solutions, where data does not leave Europe, we are already making a concrete contribution to this today."

In his statement, Windbichler puts forward a concrete model – using the regulation of the telecom and energy markets as a model:

A regulatory approach similar to the telecom and energy markets is conceivable: there, networks were opened up without mandating products. In the cloud space, for example, that means open interfaces and a clear separation between software and operations.

– Alexander Windbichler, Anexia Group CEO

Applied to the cloud market, that means: infrastructure and application are considered separately. No one prescribes which product a company uses. But access to the infrastructure is designed to be open and non-discriminatory. The position paper sums up the goal as follows: a "level playing field." This allows European providers to compete on equal footing.

Windbichler also sees a need for action in public tenders. The evaluation criteria should reflect the reality of a highly digitally connected world. That would strengthen what makes society, Austrian companies, and Europe as a location more resilient in the long run. "Competition is a central aspect — and the rules it operates under set the course," Windbichler said. "We have potential here locally — strong companies in the digital sphere — that, like us at Anexia Group, stand ready with expertise and are able and willing to advance digital sovereignty."

1. Innovation & value creation – new digital products and services are developed in Europe, creating jobs and prosperity locally.
2. Security & trust – data remains under European control, cyber risks decrease. As a result, citizens and businesses gain more trust in digital services.
3. Independence & resilience – Europe becomes less vulnerable to external market power and geopolitical dependencies, without giving up global connectivity.
4. Competitiveness – European solutions become more competitive worldwide, and therefore also exportable.
5. European values – data protection, transparency, and human rights become anchored in global technology standards.

Besides Anexia and A1, all of the initiative's supporters have positioned themselves with their own statements. Erste Bank CEO Gerda Holzinger-Burgstaller points to the pioneering role of Austrian research in quantum security. KEBA CEO Christoph Knogler warns: Europe must not fall behind when it comes to the use of artificial intelligence. That's why he is focusing on on-device and on-edge AI solutions for independent, mission-critical processes. SPAR ICS managing director Andreas Kranabitl contributes his experience as a user and operator of digital retail solutions. Umdasch chairman Wolfgang Litzlbauer describes his approach as "glocal." It means a global strategy implemented locally, with the greatest possible local value creation. And Vienna Insurance Group CIO Harald Schabernack sees independent European innovations as an opportunity to retain control over technology and data.

Anexia is one of the leading technology companies for cloud technology and digital engineering, rooted in Austria. The Anexia Group operates its own infrastructure in Europe. In addition, the company is subject exclusively to European law and structurally excludes extraterritorial access. Digital sovereignty is not a new campaign for Anexia. Rather, it has been one of its own spheres of responsibility for years. One expression of this, not least, is CEO Alexander Windbichler's board membership at CISPE, a trade association for European cloud providers.

What that means in practice is shown in the company's own structure. Founded in 2006, owner-operated – and headquartered in Austria. Add to that 500 employees and 210,000 customers worldwide. For this, the company operates a global network of more than 100 data center locations in 70 countries. This distinguishes the structure from US hyperscalers. Their parent company is itself subject to US law and therefore potentially to the US Cloud Act. This US law allows US authorities, under certain conditions, to access data from providers with a US connection. This applies regardless of server location. That's why many companies are looking for a European alternative to US hyperscalers like AWS or Azure. But this is precisely where the fundamental difference lies. It's not the server location alone that counts. What matters is ownership, the parent company's legal jurisdiction, and the structural exclusion of extraterritorial access at the European level.

The position paper proposes a "Seal of Quality for Sovereignty." This would make the distinction officially visible in the future as well. Such a seal is meant to make reliable quality standards in the cloud sector transparent. It should also help prevent what's known as "sovereign-washing." Public procurement, businesses, and citizens benefit from this equally.

For companies that want to structurally implement this independence today, Anexia Cloud Solutions supports the development of sovereign cloud architectures. This ranges from assessing existing dependencies to resilient, auditable infrastructure without proprietary lock-ins.

The initiative sees itself as a catalyst. Its position paper feeds into political and socio-political dialogue with business and academia. In addition, further discussion events on the topic are planned.

The complete position paper of the Initiative Digital Sovereignty is available for download here: www.souveraen-digital.at

What does digital sovereignty specifically mean?

Digital sovereignty refers to the ability of businesses, government bodies, and states to independently determine their own digital infrastructure and data. It also covers their technology decisions. A non-European jurisdiction must not be able to access this.

Is a cloud region in Europe sufficient for digital sovereignty?

No. A server location in Europe says nothing about legal control over the data. What matters is software sovereignty and legal jurisdiction over the infrastructure operator.

Does digital sovereignty mean isolation from global providers?

No. Both the initiative and Anexia make clear: it is not about autarky. Rather, it is about freedom of choice and European alternatives for critical areas such as government, healthcare, and infrastructure.

Who is behind the Digital Sovereignty Initiative?

Anexia, A1 Telekom, Erste Bank, Keba, SPAR ICS, Umdasch, and Vienna Insurance Group – seven leading Austrian companies from seven industries.