Poland’s Sovereignty Test: A New Frontier in Digital Independence

A Shift Toward Strategic Autonomy

In a move that signals a significant cooling of the traditional reliance on global hyperscalers, the Polish government has unveiled plans for a mandatory digital sovereignty test for state-funded technology projects. The proposed mechanism, introduced by Prime Minister Donald Tusk, aims to audit the risks associated with outsourcing critical infrastructure to non-European entities. By subjecting major IT procurements to a vetting process, Warsaw intends to regain control over its administrative systems and, crucially, the public data flowing through them.

This initiative targets large-scale public expenditure. Any IT-related contract exceeding 5 million zloty ($1.39 million) or infrastructure projects valued at over 15 million zloty ($3.95 million) will be required to undergo a rigorous evaluation. The core objective is to identify potential vulnerabilities, such as over-dependence on a single vendor or exposure to foreign legal jurisdictions that might compromise state secrets.

The Risks of Hyper-Dependency

Current market dynamics in Poland reveal an industry heavily weighted toward a few key players. Microsoft, Amazon Web Services (AWS), and Google currently command an estimated 70% of the local cloud computing market. For public sector organizations, this concentration creates an environment where competitive pricing and true operational control are difficult to maintain. Furthermore, this reliance creates a strategic single point of failure.

Beyond cost and competition, the underlying motivation for the sovereignty test is rooted in international legal frameworks. The US Cloud Act, for instance, allows American law enforcement to compel companies to surrender data stored on their servers, regardless of the data’s geographic location. This creates a friction point between US data access rights and the privacy requirements governed by the GDPR. As public entities increasingly migrate to the cloud, the prospect of national data being subject to the reach of foreign intelligence agencies has moved from a theoretical concern to a top-tier national security issue.

The “Kill Switch” Concern

Proponents of digital sovereignty within the European landscape have frequently highlighted the potential for a technological “kill switch.” If a foreign government were to compel a provider to disable services to a European client, the fallout for national defense and critical administrative infrastructure would be immediate. Research from the Future of Technology Institute suggests that at least 16 European national ministries are currently exposed to this specific risk, largely because their operations are tethered to global hyperscaler networks without adequate air-gapping or local data residency assurances.

Legislative and Economic Pressures

Poland’s move is part of a broader, more assertive European effort to define and protect its digital borders. While countries like France and the Netherlands have led the charge on this front, Poland’s inclusion represents a significant shift for Eastern Europe, a region that has historically prioritized close security ties with Washington. This pivot is not occurring in a vacuum; the Polish government is simultaneously exploring a 3% digital services tax, a measure designed to capture value from multinational tech giants.

Implications for Data Protection

For data protection officers and government agencies, the “sovereignty test” represents a move toward localizing risk assessments. Future procurement will likely require vendors to provide greater transparency into where their cloud infrastructure is physically housed and how their data access policies are structured. Organisations tasked with managing public data must now prepare for a future where compliance involves not just security certifications, but proof of architectural independence from global hubs.

Ultimately, this initiative highlights an emerging reality: digital sovereignty is becoming a cornerstone of national security. As nations seek to distance themselves from global hyperscalers, the demand for locally controlled cloud services and secure, sovereign-hosted technologies is expected to grow. Businesses and public bodies would do well to begin auditing their own reliance on foreign cloud providers, anticipating that similar standards could soon become the norm across the continent.