How much control do we have over the use of technology and data? This issue, known as digital sovereignty, is on the agenda not only in the Netherlands but also in the European Union. After all, we have become increasingly dependent on large, non-European tech companies.

Paul van Vulpen, Assistant Professor of Management Information Systems at the UvA’s Amsterdam Business School, has been working on digital independence for around five years. A central question in his research is: how can we ensure that innovative technologies such as AI are available to Dutch organisations in a safe and responsible way?

‘AI- and data-driven solutions offer organisations many benefits, including efficiency gains. But digital transformation has given players such as Alphabet and Microsoft a great deal of power over the past thirty years. The question now is how we can benefit from AI without also accepting the disadvantages associated with this concentration of power.’

What are the major issues around digital sovereignty for Dutch organisations today?

‘One current issue is what I call sovereignty washing. Tech companies claim that a product or service gives your organisation digital autonomy, while in practice that is not the case. For example, US companies are subject to the Patriot Act and the CLOUD Act. As a result, the US government can request access to data stored on these companies’ servers, even if those servers are located in Europe. So when sovereignty claims are made, it is worth asking critical questions. Which laws apply to the provider? Which parties are involved in handling data and metadata? Who manages the IT infrastructure?’

‘Behind sovereignty washing lies a more fundamental problem. What exactly do we mean by digital dependency? What kind of independence do we actually want? There are still few clear-cut answers to these questions from the market, policymakers or academia. What is clear is that a great deal of power lies with the providers of widely used tools, systems and software. Organisations are trapped in a digital cage from which they can no longer easily escape, with all the technical, legal and practical consequences that entails. For example, a software provider sells you a package. Once your organisation runs on it, you are confronted with rising subscription costs, applications you do not want, or a new privacy policy that allows the supplier to collect all kinds of data.’

‘The point is that, as an individual organisation, you cannot simply achieve digital sovereignty alone. You have not solved the problem of digital dependency if you switch from an American tech giant to a European mega-company. Only through collaboration can organisations push back against the unequal balance of power between providers and customers.

Open-source alternatives are also only part of the solution. With open-source software, the source code is publicly accessible. This enables organisations to inspect software and systems and, if necessary, adapt them. But it takes considerable expertise and time to arrive at an open-source solution that truly fits your organisation. There are also often high costs for management and maintenance. When you collaborate with other organisations, you share those costs, which makes a solution easier to implement and maintain.’

Where do the solutions lie for organisations that want to take steps towards digital autonomy?

‘A basic principle is that your IT first has to work properly and run smoothly. As long as you are still having problems there, you should not start tinkering with digital sovereignty. A change to something as fundamental as IT and AI is not a hobby project for the IT department to take on in passing.

Another factor to keep in mind is the balance between transition and continuity. You want to experiment with alternatives, but alongside the existing IT infrastructure. Otherwise, you run the risk that important business processes no longer function properly.

There is also the task of finding the right collaboration partner, or partners, for experiments. This prevents improvised, makeshift solutions from emerging. Suppose you switch to an open-source cloud platform without first properly thinking through and securing its management and maintenance. If, after a few years, it turns out that the system does not work properly, you are back to square one.’

‘Organisations only really make a difference when they are supported by institutions. Think of an institute that sets and monitors standards for digital sovereignty. IT solutions can scale rapidly, which means that a single provider is able to take over a large part of the market. Institutional oversight helps prevent undesirable market dominance and dependencies. Cooperatives are also possible: organisations that take care of the development, implementation and maintenance of alternatives for multiple organisations. If every sector had such a cooperative, you would create a scale that could genuinely change the market.’

Which best practices already exist?

‘The success of an AI application depends heavily on attention to the long term, so that, as an organisation, you find a solution that is always ready for the future. SURF’s approach is a good example.

SURF manages the ICT infrastructure of more than 120 universities, universities of applied sciences, senior secondary vocational education institutions, university medical centres and academic research institutions. The participants jointly determine policy, which the cooperative then implements. This collaboration allows the affiliated organisations to benefit from the economies of scale of ICT services. The cooperative structure provides control and a say in decision-making.’

‘The Open Cloud Alliance shows that the Netherlands itself can take steps towards digital sovereignty, independently of other European Member States. In the Open Cloud Alliance, seven Dutch IT companies are working on a sovereign cloud infrastructure for government. Through the alliance, the companies reach agreements on open source and interoperability. This enables robust and scalable alternatives to emerge. The collaboration also ensures that organisations can easily switch between the products of the various providers.’

Why is interdisciplinary academic research so important for developing sovereign AI solutions?

‘For an organisation, digital autonomy is not only a technical issue. It is also about how you deal with IT infrastructure, data and suppliers. As independent experts with an eye for societal interests, academic researchers help think through these questions.’

‘My research connects IT, business administration and economics. I also work with researchers in law, public administration, media studies and cultural studies. Bringing together these different perspectives creates a rich picture of the developments. What are the advantages and disadvantages of AI? What are the implications for people, organisations and society? We also outline concrete possibilities for digital sovereignty. We are exploring blueprints for the next ten years, for example in relation to technical interoperability and the organisation of institutions.’

What is needed to advance digital sovereignty for Dutch organisations?

‘There is a great deal of public attention for this theme, and there are therefore plenty of opportunities for organisations to take digital independence seriously. First of all, there are more and more open-source options. Open conversations with suppliers lay the foundation for finding the right solutions together. AI also increases the possibilities for tailor-made solutions.

We also know that many organisations want to get started. A collective approach is now the obvious route. Digital technologies, such as the infrastructure underpinning large language models, are inherently scalable. This means that a good application can be developed further quickly and efficiently, for example through a sector-specific partnership.’

‘Despite the urgency, it is important to realise that digital dependency is not simply a major danger. Of course, there is every reason to ask critical questions about the balance of power between AI providers and users. But it does not help us to see the big tech companies solely as monsters. The central question is: do we think it is a good idea for a small number of players to control the technology for the entire world? Ultimately, we will make the most progress if we see digital sovereignty as an opportunity to make AI work better for us.’