Digital sovereignty: at the Senate, they hold hearings. But when do they act?

The Senate did what it knows how to do: hold a series of hearings on digital sovereignty.

Yet another one.

Experts, industry players, representatives of the State. Plenty of clear-eyed observations. Plenty of pious wishes. But in the end, always the same French reflex: saying we should have done better, without ever taking the decisions that would truly change things.

There is no shortage of reports. There is a shortage of courage.

For ten years now, we have heard the same phrases:

• "We must support European players."
• "We must strengthen digital independence."
• "The administration must lead by example."

But in practice, we keep on:

• Signing contracts with Microsoft for the national education system.
• Migrating local authorities onto Google Workspace.
• Hosting our health data on non-European clouds.

Everyone sees the problem. No one decides.

What does the Senate's July 2025 report actually say?

On 9 July 2025, the Senate committee of inquiry into the costs and procedures of public procurement, chaired by Senator Simon Uzenat, delivered its conclusions after around a hundred hearings held over four months. The title changes, the refrain stays the same: the Senate finds "a great inertia on the part of the State" when it comes to digital sovereignty.

One moment in the inquiry sums it all up. Questioned by the senators, the head of legal affairs at Microsoft France admitted that he could not guarantee that the data of French citizens would never be handed over to foreign authorities without France's agreement. This is not a classroom hypothesis: it is the supplier itself saying so, in front of the senators.

The report points to a case that has become emblematic, the Health Data Hub, the health data platform created in 2019 and hosted at Microsoft. The senators call it a "clear-cut mistake", a choice dictated by deadlines and costs rather than by functional needs, a European solution having been judged "five to eight months" slower to deploy. Six years on, the expected migration still has not happened, and the committee is calling for a decree to finally make it effective.

On the levers side, the Senate proposes a French-style "Small Business Act", reserving at least 30% by value of public contracts for SMEs. A sound idea. Also an idea that has been dragging through reports for more than fifteen years.

Why does France remain so dependent?

The strategic State has been outsourced at a forced march for ten years now.

Cloud and software SMEs are being swallowed up or shut out of tenders written too narrowly. Public decision-makers buy American without owning what it entails. And the rare schemes such as SecNumCloud, the ANSSI security visa meant to protect sensitive data against extraterritorial laws, have neither the agility nor the resources to carry weight: the qualification protects the infrastructure, not the uses stacked on top of it, and it remains marginal against the American offer.

We have reached the point of regretting that we never had a "European champion". But who supported that champion? Who gave it access to the big contracts, the public references, the diplomatic backing?

What clear choices does digital sovereignty demand?

Sovereignty does not need conferences. It needs clear choices. We could perfectly well:

• Decide that any sensitive public data will be hosted in France or Europe, full stop.
• Allocate part of the IT budgets to local players, even if they are not "market leaders".
• Build in security and independence as political criteria, not just technical ones.

But for that, you have to accept taking a position. Stepping out of the comfort of industrial balances. Upsetting some partners.

And that is precisely what we do not do.

The time for observing is over. It is time to take ownership.

The next major incident will not come from a lack of AI or sovereign cloud. It will come from our inability to build a coherent model.

The Senate can go on holding hearings. But History will mainly remember what we let slip away.

And for now, we are letting everything slip.

---

Sources

• Report of the Senate committee of inquiry into public procurement, finding of State inertia and the Health Data Hub case: Acteurs Publics, 9 July 2025 (in French).
• Senate work on digital sovereignty: Sénat, committee proceedings (in French).
• SecNumCloud qualification, the ANSSI security visa and the "cloud at the centre" doctrine: ANSSI, cyber.gouv.fr (in French).