Webit 2026: Digital sovereignty starts with everyday systems - Fabrice Mous

This talk addresses the concept of digital sovereignty and its implications for organizations in Europe. The speaker, Fris from NextCloud, emphasizes that digital sovereignty is not just about data residency but also about control, governance, and operational choice. He discusses the evolution of the sovereignty debate from focusing solely on data location to broader concerns about who operates the systems and how organizations can adapt to changes. Fris highlights that dependency on external platforms can become a significant risk for organizations, especially when these dependencies are not manageable. He presents a model for understanding different layers of dependencies and outlines practical questions for organizations to consider in order to maintain their freedom of action. Ultimately, digital sovereignty is framed as the ability to adapt and change course rather than just the ownership of infrastructure.

Ladies and gentlemen, as AI becomes a strategic asset, a new question is emerging across Europe. Can we be truly competitive if we do not control the systems we depend on every day? For years, digital sovereignty was discussed as a technology issue. Today, it has become an economic issue, a security issue, and increasingly a competitiveness issue. Because sovereignty is no longer only about infrastructure. It is about the

tools we use to communicate, collaborate, share information, and make decisions every single day. Our next speaker explores why Europe's digital future may depend not only on innovation, but on ownership, trust, and control. Please welcome Fabric Mouse, manager, strategic markets and initiatives at Nexcloud, with his keynote, digital sovereignty starts with everyday systems. right? Thank you everyone. So yes, all these cool talks today, all those cool presentations and

I have a different message today. Not about AI but about digital sovereignity and about digital sovereignity in our everyday systems. for you. I want to explain first digital sovereignity. This is where we want to control the data and the system we work in. But today I want to bring you a deeper message here. I want to talk about something which is behind that digital sovereignity narrative because

we have been discussing this for the last few years and let's touch upon that. I've been already introduced. I am Fris. I work for a company called NextCloud and we are building an open-source cloud collaboration software solution. And this is being used by organizations worldwide who want to remain in full control of how they work. So that's the vantage point why I'm here today. This is the

lens through which I want to talk to you today. Now the sovereignity discussion that's very interesting. It has been changing over the last few months. The if you are watching this you see it evolve a little bit. You see that it started with data residency which is the data location. Um that's the inner circle and that's everybody talks about where is my data residing at the moment.

Of course that's an important question but this has been matured this discussion. It's no longer more about data location but also how much control do we have and then you see this shift happening from data to operations to operations from governance and from governance to choice. So let me explain this to you. Of course data I told you this is where my data is residing. But why

is this important? It's important because you want to know for sure what kind of law and regulations are applicable to your data. who can touch my data in an juris jurisdiction kind of sense. Then we have kind of seen it shift upwards. Then the question became more important like who is running those systems? Who is controlling the updates on those systems and can another provider take over

when needed? And again the conversation shifted to governance and there the question became more like who's setting the rules on these platforms who controls them and who decides how this system can evolve and then we finally arrived at the outer circle here which is all about can an organization move adapt and change course when circumstances change and that's how I see this conversation being expanded beyond location

towards Now the funny thing is oh sorry the funny thing is with sovereignity and this discussion that because it matured and it's become so important something else happened here. People start adapting adopting using the the word the term everybody starts saying that they were sovereign and also sovereignity meant many different things to many different people. Some people say it only is about where your data is residing.

Is the data on your own soil? Is it your local operator who can process that uh that information? Do you have legal rappers in place, the right organization? Do we have the governance structures and do we have the operational models in place? This has been known within the industry as sovereignity washing. Increasingly, we see the misuse and the abuse of the term sovereignity. And that's why we

need to be careful there. But there's an interesting question here. What's the underlying problem? What are we trying to solve here? Maybe it's a wrong question to ask what sovereignity means. And do we want to try to solve something else? So what are we trying to protect? What are we trying to protect here? So data residency, operational control, governance or portability, they all want to achieve the

same thing. They want to achieve that you can retain control. You want to maintain freedom of action. You want to change course when the circumstances change and you want options. So if sovereignity is the answer, then the real problem here is dependency. Now for this I bring you this abstract highle model which you can use for your discussions. So dependency lives in this model across all of

these layers. But there's something interesting here because the most visible one and the most discussed one is the layer um below the infrastructure layer that's the most visible layer comput storage networking everybody can see that it's very tangible and that provides the foundation but on top of that you have platforms those platforms that provide functionality and those functionality they prov they define workflows and how your work

is getting done and if you have those workflows. Those workflows help you build and shape knowledge and use AI systems and help you design design systems as well. And each layer builds on top of the layer below it. Now organization have a tendency to move upward in this stack. So dependencies change form here and that's very important because infrastructure is actually a technical dependency. But this technical

dependency because of that it helps platforms becomes a functional dependency and the functional dependency becomes with workflow an operational dependency and now becomes the interesting part. If you have an operational dependency with workflows and your knowledge is built on top of that you have the cognitive Now those errors on the side of the model kind of explains to you how difficult it is to exit. The higher

up the stack you are, the more difficult it is to exit. And on the left side is the visibility. The lower you get into the stack, the more visible that layer becomes or is within your organization. So think of this. Let's bring it back to you. So what does this mean for you? Right? So what are the first five things you do when you opening up your

laptop in the morning? What are the five things you touch? I guess it would be email, right? writing a document, attending a meeting, chatting with somebody, you need to log in and you're kicking off your workflows there. So don't think of these things as productivity tools. They have become the operating system of your organization and something interesting happened over the last decade here because for reasons for

reasons we have been consolidating these functions into fewer platforms. So everything became integrated, everything became easier, everything became more convenient. But people convenience has a side effect because convenience creates concentration and concentration creates dependency. Because today the operating system of the organization, your organization is owned, operated and governed by somebody else. All right? So that's all fine and dandy Fris right but tell me more how does

it work in practice so we have been talking about the dependency as a concept here but it becomes more visible when something changes actually changes sometimes the rules change sometimes control moves sometimes decisions are made elsewhere and when that happens your organization inherits the consequences and these examples they prove point. This is an example from a commercial point of view, a regulatory point of view, and a

geopolitical point of view. Let me explain. On the left, the logo from Adobe. In 2019, Adobe disabled access to all users disabled access to all users in Venezuela because of US sanctions. Now it's not the fault of Adobe because they just followed the legal framework under which they operate. Sometimes you can think of overcompliance but that's another story. They just followed the legal framework. So it's not

so much if Adobe is right or wrong. You have no influence over that decision. But this decision translated into the availability of Adobe as a business platform for you. All right. 2019. Let's let's move back one week right one week ago we had this situation where something similar also happened but then in the space of AI. So the US government imposed export restrictions on two models from

entropic. So the debate is not so much whether the restriction was justified. Again the access to these capabilities changed because the decision was taken elsewhere. Organizations who are building workflows around those models they had a serious issue. Some of them are even claiming I need to change something here. And then the most discussed example here it involves the international criminal court and Microsoft. this is basically a

bit of a different question I would say what happens here because what happens if you have a geopolitical situation tensions happening and then some point the digital services from organizations from that country are operating under that specific legal and political framework just shut off. This is what happened to the international criminal court because judges and their staff were disconnected from the cloud services from Microsoft. So please

dependency is no longer an infrastructure question. It is an operational continuity question. So the question become how can we control this because not all dependency are bad they just exist. So not every organization depends on suppliers, not every organization sorry and every organization depends on technology or partners. But the question is are these dependencies manageable? And that's why I present you these practical set of questions that

notice that none of these questions are ideological. They do not require a specific vendor or a specific technology tech. There are just simply some tests you can do. There are tests they tell us if we retain the freedom of action. And I think that's the most practical definition of digital sovereignity, the freedom of action. So it's not about isolation. It's not about self-sufficiency, but the ability to

consciously manage, understand, and change critical dependencies. So to close this presentation, I give you three boardroom questions to take away. What systems can we no longer function without? Because that's the questions you need to answer with management. What Who control those systems? And what would it take to change course? If those questions are very urgent for you, please apply the workplace control layer, apply the dependency tech

stack. Think about what this mean for your organization. The operating system of your organization. So digital sovereignity is not about where your infrastructure sit again not where your infrastructure sit is the ability to choose to adapt and to change direction when circumstances change. And that's why digital sovereignity start starts Thank you.