A new Capgemini study reveals that a substantial share of government websites and email services across the EU rely on non-European providers. The findings highlight the growing relevance of digital sovereignty and raise a fundamental question: how much control do governments retain over the digital infrastructure that supports public services?

At a glance:

  • The eGovernment Benchmark 2026 found that more than one-third of assessed government websites and at least half of government email services rely on network operators exposed to non-EU jurisdictions. 
  • The United States is the most dominant non-EU jurisdiction, driven largely by providers such as Microsoft, Cloudflare, Google and Amazon. 
  • Technological dependencies may expose critical public services to non-EU legal and regulatory frameworks, with implications for data governance, data flows, and reliance on external providers for service continuity. 
  • Dependencies are a fact as governments continue to transform digitally, so balancing reliance and risk in a strategic approach must become the norm. 
  • Public leaders should map dependencies, assess where they create risks, and strengthen resilience through diversification, contingency planning, open standards, and exit strategies.

The digital transformation of government has fundamentally changed how public administrations deliver services to citizens and entrepreneurs.  

The latest eGovernment Benchmark, a European Commission study monitoring the digitalization of public services, shows that the availability and accessibility of digital public services have increased considerably over the past four years. Compared with just three years ago, on average across the 27 EU Member States (EU27), 15 additional services are fully accessible online, eight additional services allow access using an official electronic identification solution, such as a national eID, and 24 additional services are adapted for smartphone use. 

Making these public services available and easy to access digitally, however, depends on digital infrastructure that is technically demanding to develop, operate and maintain. When it comes to the digital infrastructure that hosts government websites and stores their data, governments have managed technical demands by increasingly relying on external technology providers for cloud platforms, hosting environments and globally distributed communications infrastructure.

While this model has accelerated the digitalization of public services, it has also raised questions about how much control public administrations retain over the infrastructure underpinning them. Digital sovereignty, then, becomes an increasingly important consideration for policymakers and public-sector organizations in the context of growing geopolitical uncertainty and shifting international relationships.

Digital sovereignty becomes an increasingly important consideration in the context of growing geopolitical uncertainty and shifting international relationships. 

There is no denying the significant role of external tech companies in the evolving eGovernment landscape. At the same time, over-dependence is a concern. As we discuss in the following, by adopting a strategic approach that balances potential risks with alternative options, public sector leaders can ensure resilience. 

What does the eGovernment Benchmark tell us about EU digital sovereignty? 

To better understand the digital dependencies, the European Commission’s eGovernment Benchmark, produced by Capgemini, Sogeti, and IDC, introduced a set of pilot digital sovereignty indicators in 2026, focusing on the network and routing infrastructure that supports government websites and email systems.  

The findings reveal a significant reliance on non-EU providers. Across the EU, 37.2% of government websites were found to be hosted on network infrastructure ultimately controlled by organizations headquartered outside the European Union. The United States was by far the most prominent non-EU jurisdiction, accounting for infrastructure through which approximately one-third of assessed government websites were routed. 

Dependence on non-EU providers is even more pronounced in government email systems. The assessment found that 60.4% of incoming government email services and 50.3% of outgoing government email services rely on infrastructure operated by organizations whose ultimate ownership lies outside the EU.  

The United States emerges as the dominant non-EU jurisdiction across the routing and communication layer. U.S.-owned operators provide the network infrastructure through which 32% of assessed government websites, 35.2% of incoming government email services, and 45.5% of outgoing government email services are routed. This reliance is driven by a small number of globally dominant providers, including Microsoft, Cloudflare, Google and Amazon. 

Why does this dependency pose a risk? 

When digital public services and government communication channels rely on infrastructure operated by non-EU organizations, they may become subject to foreign legal frameworks, regulatory obligations, and broader geopolitical developments. Such dependencies can have implications for how data is governed, retained, and accessed, while also increasing reliance on external providers for the continuity and availability of essential services.  

As governments continue to digitize critical services relating to healthcare, taxation, business operations, and citizen records, maintaining oversight and control of the infrastructure that underpins these services becomes increasingly important. 

How is Europe pursuing greater digital sovereignty?  

While the findings of the 2026 eGovernment Benchmark report shed light on an important dimension of digital sovereignty, this is only one part of the story. Digital sovereignty ultimately depends on the degree of control governments retain across the full technology stack, from infrastructure and software to data and emerging technologies. 

Digital sovereignty ultimately depends on the degree of control governments retain across the full technology stack.

Public administrations, for example, handle large amounts of (sensitive) data in order to carry out their responsibilities. This concerns citizen records, healthcare data, business data, and tax information. Questions about where this data is stored, who can access it, and under which legal frameworks it is governed have therefore become an increasingly important dimension of the digital sovereignty debate.  

The answers to these questions increasingly influence organizational resilience, legal compliance, and the ability of governments to align digital operations with their own policy objectives. At the same time, much of the technology used to store, manage, and analyze this information is developed and operated outside Europe, extending sovereignty concerns beyond data governance alone. 

Recognizing these challenges, the European Commission has placed digital sovereignty at the heart of its digital agenda through the Tech Sovereignty Package. Initiatives such as the Chips Act 2.0 and the Cloud and AI Development Act aim to strengthen Europe’s capacity to develop, deploy, and govern critical digital technologies, while reducing reliance on non-European providers. In practice, this means creating stronger European alternatives in areas where strategic dependencies are the greatest, from semiconductor production and cloud infrastructure to artificial intelligence systems, and the storage and processing of European data. 

What should Europe’s public service leaders do? 

The path towards digital sovereignty should not simply be about replacing non-European technologies with European alternatives. Rather, there is a balance to be struck, and leaders must become more strategic about their digital dependencies. 

The path towards digital sovereignty should not simply be about replacing non-European technologies with European alternatives.

With the challenge ultimately being one of strategic leadership, we recommend: 

  • Taking a deliberate approach to understanding strategic dependencies 
  • Assessing where the dependencies matter most  
  • Putting in place the mechanisms needed to manage and mitigate the risks they create.  

Taking the case of the routing and communication layer of digital public infrastructure, it is important for digital government leaders and policymakers to establish visibility over the organizations that operate government web and email infrastructure, including their jurisdictional exposure.  

Once dependencies are understood, leaders should assess whether they create strategic, operational, or governance risks. Namely, identifying which sensitive public services rely on a small number of providers and where ownership structures may expose the flow of data to external influence.  

Maintaining resilience by understanding and managing dependencies 

Going forward, resilience can be improved by managing those dependencies that create the greatest exposure through exit strategies, contingency planning, and the adoption of open standards and open-source technologies where appropriate. This can help reduce vendor lock-in and increase the ability to transition critical services between providers as strategic requirements evolve.  

Ultimately, sovereignty considerations should be embedded into the governance and procurement of the digital infrastructures that enable public services, ensuring that decisions balance performance, security, and cost, alongside strategic autonomy. 

Find out more 

For further insight: