From Ambition to Action: Putting Digital Sovereignty into Practice

Digital sovereignty is taking shape through decisions about infrastructure, suppliers, security and the services organisations use every day. Choosing where to host data is part of that work. Understanding how it travels, who can access it and which third parties can act on an organisation's behalf makes the task more demanding-and more useful.

This issue of dotmagazine, Security, Compliance & Digital Sovereignty, brings together seven contributors to examine what meaningful control requires in practice. Their perspectives connect Europe's infrastructure ambitions with the operational responsibilities that sustain trust in digital services.

For sovereign workloads, the first requirement is somewhere suitable to run them. Georg Raiser of AtlasEdge examines why Europe's digital sovereignty ambitions depend on available data centre capacity. As established hubs face constraints, emerging markets can offer additional options for expansion and geographic diversity. His analysis also highlights the importance of assessing a provider's jurisdiction and operational control alongside its physical location.

The connections between those locations deserve equal attention. Ivo Ivanov of DE-CIX explores why sovereign AI depends on sovereign connectivity. As AI workloads spread across clouds, data centres and edge environments, organisations need to understand the networks carrying their data and the choices available along its journey. Together, these contributions show how capacity and connectivity shape the ability to put sovereignty strategies into operation.

Closer to everyday business, control can be lost through permissions that remain in place long after their purpose has ended. Thomas Kuechenthal of LEMARIT GmbH examines who is authorised to send email in an organisation's name. His six-step approach connects email authentication with service inventories, clear ownership and the careful introduction of enforcement.

Knowing what has been authorised also raises the question of what software actually does. Drawing on studies of W Social and Android cycle-tracking apps, Eric Clausing of AV-TEST explains what privacy testing reveals beyond published policies. The findings demonstrate why technical verification matters, while distinguishing observed communications and third-party components from conclusions about unlawful processing.

At the DNS layer, both policy interventions and security choices have consequences beyond individual organisations. Lars Steffen of eco - Association of the Internet Industry examines why removing unlawful content at its source should take priority over DNS blocking. His analysis considers the precision, proportionality and transparency needed when enforcement measures affect shared infrastructure.

Turning to the security of DNS itself, Barbara Jantzen of deSEC revisits familiar concerns about DNSSEC. She invites readers to assess those concerns against developments in automation, technical standards and operational experience, giving decision-makers a basis for reviewing inherited assumptions.

Maintaining control also means preparing for changes beyond the next procurement or software update. Patricia Trinkaus of eco explores post-quantum readiness for connected mobility. Vehicles designed to operate for decades make the importance of cryptographic inventories, adaptable architectures and coordinated supplier planning particularly clear.

Across these articles, digital sovereignty becomes a continuing responsibility shared by technical teams, business leaders, procurement specialists and policymakers. Explore the issue for perspectives that can inform your next infrastructure decision, permissions review or security discussion-and help turn ambition into action.

Enjoy the read!

dotmagazine Editorial Team