The State of Digital Sovereignty in Sweden

Over the past decades, organizations have gradually lost control over the software, infrastructure, and data they depend on. Today, digital sovereignty has become a key concern for Swedish organizations facing increasing demands for compliance, data protection, and regulatory control. This session explores how we arrived here, what sovereignty means in practice, and how open technologies such as OpenStack, Ceph, Kubernetes, and open-source software can help organizations regain control of their digital future. Through practical examples, we will examine the role of data residency, access control, auditability, and modern infrastructure in building a more sovereign and resilient cloud strategy. Takeaways An understanding of the current state of digital sovereignty in Sweden and the factors driving growing interest in sovereign cloud and data control. Practical insights into how open-source technologies and open infrastructure can help organizations regain control of their data, compliance, and digital services. Key considerations for evaluating cloud strategies in relation to data residency, regulatory requirements, and long-term digital resilience.

Transcript

2. A Nordic cloud platform, owned, operated and governed here We deliver cloud infrastructure to research, the public sector and companies that need to know where their data is and who can access it. A PP LICA TION R OME CUST Swedish ownership Owned by employees and the board. Management and staff within the EU/EEA. Open source OpenStack, Kubernetes and S3 storage, no proprietary lock-in. Data stays here Data centres in Sweden and Norway. Customer data does not leave the country. The full stack Compute, Kubernetes, storage, backup, databases and GPU for AI.
3. What is sovereignty? Supreme decision-making authority and selfdetermination over one's own affairs, without being subordinate to any other power. Self-determination The right to make one's own decisions Independence Not subordinate to another actor's authority From the Latin superanus: superior, highest-ranking. Control The actual ability to direct and uphold decisions
4. Sovereignty in four forms TYPE MEANING State A state's supreme authority within its territory and its independence from other states Political Who holds ultimate decision-making authority in a political system Economic Independent economic decisions without decisive dependence on external actors Digital Independent control over, and decisions about, digital infrastructure, data and technology Sovereignty is not self-sufficiency. The question is who ultimately has control, not who provides the resources. Formal control is not always actual control. You can legally own your data and still be unable to switch provider.
5. The ability to decide over your own data, systems and dependencies, and to be able to switch, even in a crisis Legal control Security of supply Economic freedom of action Which law applies to our data? Can a foreign authority demand access Do critical services keep working if a supplier, a country or a cable Lock-in dictates prices and terms. The value of our data and our AI to it without our knowledge? drops out? A core issue for total defence. should stay in the European economy.
6. Europe's cloud is largely run from outside Europe 70 % of Europe's cloud market is held by Amazon, Microsoft and Google 15 % for European providers, down from 29 % in 2017 Sources: Synergy Research Group (2025); European Commission, Chips Act 2.0 (June 2026) <10 % of the world's semiconductors are made in Europe
7. Which rules apply to data today? REGULATION WHAT IT REQUIRES STATUS GDPR Legal basis and safeguards for transfers to third countries (Schrems II, EU–US Data Privacy Framework) In force. Digital Omnibus proposes changes Swedish Cybersecurity Act (NIS2) Risk management, incident reporting and management accountability in 18 sectors In force 15 January 2026 Data Act Right to switch cloud provider, portability, protection against unlawful third-country access In force since Sept 2025. Switching charges removed Jan 2027 AI Act Transparency requirements and requirements for high-risk AI Transparency from Aug 2026. High-risk: Dec 2027 / Aug 2028 Protective security and OSL Protection of security-sensitive activities and confidentiality when outsourcing Swedish law, in force Plus sector rules such as DORA (finance) and the Cyber Resilience Act (products)
8. Encryption and contracts do not solve jurisdiction US law, such as the CLOUD Act and FISA, can give authorities access to data controlled by US companies, regardless of where the data centre is located. The question is therefore not only where data is stored, but who owns it, operates it and can be compelled to hand it over.
9. Eighteen months that redrew the map Apr 2025 AI Continent Action Plan: AI factories, gigafactories, cloud and AI legislation announced 3 Jun 2026 Oct 2025 The Apply AI Strategy and the Cloud Sovereignty Framework 30 Jul 2026 Nov 2025 May 2026 Digital Omnibus: AI omnibus agreed. Sweden's simplification of the GDPR, the Data Act and the AI Act first national cloud policy 9 Sep 2026 12 Nov 2026 Tech Sovereignty Package: Procurement of up to seven Public Procurement Act: Deadline for gigafactory bids. Cloud and AI Development Act and Chips Act 2.0 AI gigafactories opens proposal with “Buy European” Selection early 2027 Sources: European Commission, EuroHPC JU, Government Offices of Sweden
10. What is CADA? PROPOSAL 3 JUNE 2026 Research and innovation Promote the development of European cloud and AI technology. An EU proposal to strengthen Europe's digital independence and competitiveness in cloud services and AI. Three objectives. AI Act Regulates how AI systems may be developed and Infrastructure Facilitate and speed up the construction of energy-efficient data centres in the EU. used: risks, safety and rights. CADA Builds Europe's capacity to develop, operate and provide AI and cloud services. Digital sovereignty Reduce dependence on foreign cloud providers and create common criteria for digital independence. Source: European Commission, Cloud and AI Development Act, COM(2026) 502 · Proposal, not law in force
11. Where are our dependencies? 15 % 10 % 10 % 15 % Ownership, governance, capital Which law applies and who can compel access Storage location, keys, control over models Who operates, has access, can shut down 20 % 15 % 10 % 5% Chips, servers, components; highest Open standards, portability, lock-in Compliance with GDPR, NIS2, certification Energy and sustainable operations Strategic Supply chain Legal Data and AI Technology Security weighting Source: European Commission, Cloud Sovereignty Framework v1.2.1 (Oct 2025) Operational Environment
12. The weakest link is the hardware, for everyone SEAL-4 Full sovereignty: complete EU control, EU law only SEAL-3 Digital resilience: marginal control outside the EU SEAL-2 Data sovereignty: EU law applies, but significant dependencies outside the EU SEAL-1 Jurisdictional: EU law applies, but is hard to enforce SEAL-0 No sovereignty: exclusive control outside the EU Lowest: supply chain (SEAL-2) and technology (SEAL-3). There is no European server and GPU manufacturing at scale. SAFESPRING, SELF-ASSESSMENT PER OBJECTIVE Strategic SEAL-4 Legal SEAL-4 Data and AI SEAL-4 Operational SEAL-4 Supply chain SEAL-2 Technology SEAL-3 Security SEAL-4 Environment SEAL-4 Sources: Cloud Sovereignty Framework (2025); Safespring, self-assessment (Nov 2025)
13. Public procurement becomes industrial policy PROPOSAL 3 JUNE 2026 PROPOSAL 9 SEPTEMBER 2026 Cloud and AI Development Act Public Procurement Act • Four sovereignty levels for cloud in the public sector, • One regulation replaces three directives and from data in the EU to EU ownership without exception • “Union added value” gives up to 15 of 120 points in the evaluation • applies directly in all member states • “Buy European” is introduced for the first time • Framework for economic security and supply Acceleration zones: data centre permits within 12 months • Open source and open standards are to be promoted chains in critical sectors • Best value before lowest price Both proposals will now be negotiated in the Council and the European Parliament
14. AI factories and gigafactories 19 + 13 AI factories and antennas ≤7 AI gigafactories 200+ EuroHPC network giving Over EUR 20 billion in private Organisations engaged since the researchers, companies and the investment expected. Bids due 12 2025 launch. NAISS and RISE. New AI public sector access to AI Nov, operational within 18 months of supercomputer in Linköping during computing and expertise. selection. 2026. Sweden AI Factory Computing power is not enough: the data, storage and operations around it must also be sovereign Sources: EuroHPC JU (July 2026); NAISS (Aug 2026)
15. Chips Act 2.0 and the omnibus packages PROPOSAL 3 JUNE 2026 NOV 2025 AND MAY 2026 Chips Act 2.0 Digital Omnibus and AI omnibus • • Clarified definition of personal data in the GDPR • Simpler rules for cookies and incident reporting • AI omnibus: high-risk requirements postponed to Dec 2027 and Aug 2028 • The data part is still under negotiation Builds on the more than EUR 52 billion mobilised by the first Chips Act • Permits within 12 months for strategic projects • Demand accelerators and support for “first-of-a-kind” facilities • B2B platform for monitoring the supply chain Simplification lowers the thresholds, but does not move the jurisdiction Sources: European Commission; EDPB; the Council and the European Parliament
16. Europe's AI strategy: from rules to capability APRIL 2025 OCTOBER 2025 FEBRUARY 2026 AI Continent Action Plan Apply AI Sweden's AI strategy Computing capacity, access to data, Bringing AI into industry and the Top ten in the world, best at AI in skills and simpler rules. The basis for public sector, with emphasis on public administration and a national AI factories and gigafactories. European solutions and reduced dependencies. AI workshop 2026–2030. The long-term question: whose infrastructure is Europe's AI trained, run and stored on? Sources: European Commission; Government Offices of Sweden
17. Sweden says yes, with reservations MAY 2026 National cloud policy Risk assessment, open standards and exit plans for the entire public sector. PTS provides guidance. FEB 2026 The AI strategy Security and protection of critical societal functions is one of four focus areas. JAN 2026 Swedish Cybersecurity Act NIS2 in Swedish law. Management is accountable for supplier risks. AUG 2026 Sweden AI Factory Mimer is renamed and given a national mandate. Sources: Government Offices of Sweden (28 May 2026; 2025/26:FPM99); NCSC; NAISS
18. Five priorities 1 Classify and choose a level 2 Procure sovereignty 3 4 5 Make exit a capability Embed AI in sovereign infrastructure A clear Swedish position in the EU AI factories need sovereign storage, High levels for critical Sovereignty level per Use the CADA levels The Data Act and the use case, with SEAL as now. Weigh cloud policy provide a common language. ownership, operations the right. Open Not everything needs SEAL-4; what is critical and jurisdiction, not just price. standards, open source and tested exit plans does. provide the capability. data and operations around them, especially for health data and government data. infrastructure and total defence in the CADA negotiations. Proportionality for the rest.
19. THANK YOU Sovereignty is a capability, not a label NAME EMAIL WEBSITE Fredric Wallsten fredric.wallsten@safespring.com safespring.com