Digital sovereignty does not arise at a single point, but along the entire digital chain.

At its core, digital sovereignty describes the ability to operate digital systems independently. This includes technical aspects such as data locality, encryption, and transparency, as well as legal frameworks and economic predictability. It is crucial that organizations understand where their data is processed, who has access to it, and what legal frameworks it is subject to. At the same time, long-term control over costs, architecture, and dependencies is playing an increasingly important role.

Digital sovereignty does not begin in the data center. It arises at various levels: at the end device, in the operating system, in the identity and network architecture, on the platform, and finally in the cloud. If one of these levels cannot be controlled—whether for technical, organizational, or legal reasons—it is difficult to operate the other levels with sovereignty. That is why it is important to take a holistic view of IT architectures and not just optimize individual components in isolation.

Open source allows insight into the code and creates transparency about functionalities and security mechanisms. For many organizations, this is an important factor because dependencies are reduced and technical decisions remain traceable. Technologies such as containerization and automation also allow applications to be operated consistently and reproducibly—regardless of location or underlying infrastructure model. This supports both technical independence and flexibility.

Economic sovereignty begins with the question of how dependent you are on individual licensing, operating, or pricing structures. Many organizations are currently experiencing international providers regularly adjusting their models, and these adjustments are difficult to influence contractually. Clear governance, transparent cost models, and open technical platforms can help reduce these risks. This is particularly relevant for administrations, because planning security is a key factor.

The need for protection is constantly increasing – especially in areas such as administration, energy supply, and healthcare. Modern hardware is therefore increasingly following the principle of “security by design.” Current processor architectures, for example, make it possible to protect data in separate, isolated execution areas even during processing. These so-called enclaves ensure that sensitive information remains protected even if the operating system is compromised. Such hardware-based security mechanisms are gaining in importance because classic, purely software-based protection models are no longer sufficient to deal with today's threat scenarios, and because forms of attack are becoming more complex and classic protection models alone are no longer adequate.

The workplace is the first point of contact between users and data. If this level cannot be adequately controlled, for example due to proprietary dependencies or limited security mechanisms, it becomes difficult to maintain sovereignty in the rest of the architecture. Open operating systems and transparent security mechanisms can help reduce these dependencies while extending the service life of devices. For many public organizations, this is also relevant from a sustainability and cost perspective.

Confidential AI describes the ability to run AI models and training and inference processes on infrastructure that is fully controllable, both technically and legally. This requires that data remain in clearly defined environments and that the underlying architecture is transparent. For many organizations, this is a prerequisite for using AI productively without losing control over data or models. Various initiatives are currently emerging in Switzerland, such as Apertus, which support this idea.