Hardly any company voluntarily decides to reevaluate its IT architecture as long as it works. The situation is different for banks, insurance companies, healthcare providers, energy utilities, and public sector entities: In these cases, the decision is influenced not only by the organization’s own risk tolerance but also by legislation and regulatory oversight. For these companies, digital sovereignty is no longer just a strategic option—it is becoming a regulatory requirement.
The regulatory pressure is real—and growing
The Digital Operational Resilience Act (DORA) has been in effect in the EU since January 2025. The regulation requires financial firms to actively manage their dependence on third-party ICT providers, document it, and be able to demonstrate it in the event of an emergency. BaFin has explicitly addressed this issue multiple times in its “Risks in Focus” reports: Many financial firms are becoming dependent on the technology, platforms, or services of a small number of providers—if access to these is lost, the consequences are severe, and a sudden switch is practically impossible. This is precisely a recurring finding in audit reports: vendor lock-in with Microsoft, Amazon, or Google, without a documented exit strategy.
DORA is by no means an isolated case. Starting in 2027, the EU Cyber Resilience Act will make systematic supply chain and dependency management mandatory even outside the financial sector. NIS2 tightens the requirements for operators of critical infrastructure—and it is precisely there—in healthcare, the energy sector, and municipal utilities—that the geopolitical risk of unilateral dependence on non-European hyperscalers is amplified.
That is why regulated industries are particularly affected
A medium-sized industrial company can weigh the economic implications of a certain degree of dependence on Microsoft 365 and consciously accept it. A hospital, a bank, or an energy provider cannot do so in the same way—not because the technology is different, but because:
- Regulatory authorities require proof of compliance. It is no longer enough to say, “We use a reliable provider.” A documented ability to exit is required: Can the service be replaced promptly by an alternative in an emergency?
- Critical infrastructure requires special protection. For companies that are part of critical infrastructure, a total outage of a central ICT service provider carries far greater consequences than elsewhere.
- Data sovereignty and jurisdiction are directly relevant from a regulatory perspective. The server location alone is not sufficient—what matters is which legal system governs the operator. A data center in Frankfurt is of little help if the operator remains a U.S. company and is thus potentially subject to the U.S. CLOUD Act.
Sovereignty Does Not Mean “Get Out of the Cloud”
The most common misconception is to equate digital sovereignty with a complete technology overhaul. That is neither necessary nor realistic. What matters is the ability to switch—not the switch itself. A company that can demonstrate it could replace its most critical dependencies (email, file storage, identity management) if necessary meets the regulatory requirement—even if it continues to use Microsoft products in its day-to-day operations.
In practice, this means parallel operation instead of a “big bang.” A realistic first step looks like this:
- Assessment. Where exactly do dependencies exist today, and which of them affect critical or important functions in the regulatory sense?
- Set up a parallel instance. A Nextcloud environment hosted in Europe alongside SharePoint/OneDrive; a Mailcow or other European mail server alongside Exchange for a designated area; and Keycloak as an SSO layer connecting both environments.
- Migration plan with a cost-benefit analysis. Current state analysis, runbooks for data and email migration, security plan, and milestone planning.
- Gradual expansion. Based on the experience gained from parallel operation, decisions will be made regarding which areas will be migrated further—completely, partially, or not at all.
Hybrid models are the norm, not the exception
Not every application needs to be replaced, nor does every department need to be migrated at the same time. A realistic target scenario often looks like this: communication and file storage are managed seamlessly, specialized business applications remain with established providers, and AI-powered automation runs on a locally hosted model for sensitive data. It is precisely this deliberate, documented combination—not a complete break from U.S. hyperscalers—that regulators and auditors want to see in practice: freedom of choice, robustness, and feasible exit scenarios rather than ideology.
The first step counts
For regulated companies, digital sovereignty is not a project to be tackled “someday.” It is part of the response to recurring audit findings and an increasingly stringent regulatory framework. Getting started doesn’t have to be a major or risky undertaking: an initial sovereign instance running in parallel with existing IT, a well-founded migration strategy with a clear cost-benefit analysis—and the certainty of remaining capable of acting in an emergency.
VIALUTIONS supports companies in regulated industries with the step-by-step migration from Microsoft 365 environments to sovereign alternatives such as Nextcloud, Mailcow, and Keycloak—from analysis and the migration plan to the development of an AI and automation strategy on their own infrastructure.