EU Digital Sovereignty in Practice: A Technical Assessment of Digital Infrastructure Dependencies#

Authors: Jürgen Brandl (TU Wien), Florian Holzbauer (IT:U), Aaron Kaplan (European Commission, DIGIT S.2), Johanna Ullrich (IT:U), Adrian Dabrowski (University of Applied Sciences Technikum Wien)

• Why: Quantifies, for the first time systematically, how dependent EU institutions are on non-EU infrastructure. If your organization has EU regulatory exposure (NIS2, DORA) or sells into regulated EU sectors, this is a concrete dependency map of your customers' environment.
• What: Empirical analysis of 1,988 domains across government, banking, media, and higher education in all 27 EU member states, across six sovereignty dimensions: nameservers, web hosting, external resources, certificate authorities, email, and SaaS. Only 61 domains (3%) show no detectable non-EU dependency. Key exposures: CDN/DDoS services, cloud-hosted email, office suites, and TLS certificates. A neat methodological detail: internal third-party SaaS deployments are detected via domain verification tokens. (from abstract only)
• How: Collection of DNS records, TLS certificates, and HTTP responses; dependencies classified by criticality and EU/non-EU status, spanning infrastructure through application layer.
• Where applicable: EU-regulated sectors specifically. The dependency categories (CDN, email, CA, SaaS) transfer well to any sovereignty/supply-chain assessment exercise; open dataset released for replication and monitoring.