Digital Sovereignty: Legal Perspective

A legal sovereignty risk analysis identifies relevant legal risks by jurisdiction and technology layer - ranging from extraterritorial access regimes (e.g., CLOUD Act, FISA) to foreign trade regulations (AWG/AWV, EU Screening Regulation) to cross-sector EU regulations (e.g., EU AI Act, NIS2). Based on this, we develop a legally sound sovereignty strategy with a clear vision, prioritization, and roadmap - including a clear distinction between mandatory requirements (regulatory compliance) and target requirements (strategic sovereignty goals).

Sovereignty requirements must be enshrined in public procurement law as transparent, traceable award criteria and specified in sovereign cloud contracts - for example, regarding ownership structures, personnel deployed, audit and evidence requirements, as well as exit and interoperability provisions under the Data Act. Reference frameworks such as the EU Cloud Sovereignty Framework, the BSI C5 criteria, EUCS, and GAIA-X make providers comparable and requirements verifiable. In this regard, we also refer to our article “Procuring Sovereign IT in the Enterprise: Legally Sound Planning and Implementation.”

Those who are unaware of the license terms lose control. We provide support in the form of licensing due diligence for the use of open-source software, the drafting of development and licence agreements containing sovereignty clauses (source code deposit, audit rights, rights of use after the end of the contract), as well as advice on export control regulations for software products and AI systems.

Data sovereignty must be legally enforced: through data transfer impact assessments, standard contractual clauses, and binding corporate rules, the instruments of the Data Act and the Data Governance Act, and contractual sovereignty clauses (“Sovereignty by Contract”), which effectively preclude access by authorities from third countries.

Digital sovereignty without a legally enforceable security framework is not sustainable. Relevant cybersecurity regulations make information security the personal responsibility of corporate management. We conduct gap analyses and compliance audits, establish audit-proof governance structures, support certification processes (BSI C5 certificates, EUCS), and represent clients in reporting to authorities and in proceedings following cybersecurity incidents.

Even with outsourced IT services, legal responsibility and liability remain with the company - legal delegation is not possible. We draft operating agreements, develop legally sound exit strategies without disrupting business operations, assess concentration risks, and advise on the personal liability of management bodies.