Africa's Lessons from Europe's Digital Sovereignty Journey

Over the past decade, the European Union has turned "digital sovereignty" from a niche phrase into an organising idea for its technology policy with influence that now extends well beyond Europe. To achieve this, the European Union has written some of the world's most influential digital laws that now shape global rules on data and platforms, funded public supercomputers and cloud projects, and set targets for semiconductor production. Yet its AI ecosystem remains closely connected to international providers of cloud services, advanced chips and frontier AI models. For geographies such as Africa that hold similar aspirations for digital sovereignty, Europe offers both a model and a caution. Its experience shows how far rule-making can extend a region's influence, and how much harder it is to build the infrastructure and industries that would diversify its sources of technology and infrastructure.

In Africa, the African Union's Data Policy Framework and its Continental AI Strategy both speak of data and AI serving African priorities, and many national strategies use the language of sovereignty. Europe is a natural reference point because it has tried several routes to the same goal and has published unusually candid assessments of what worked.

This article reviews that record and asks what Africa can reasonably take from it. The argument is that Europe offers useful lessons about method, sequencing and the limits of regulation on its own, but that its model cannot be transplanted. Africa's markets, institutions, fiscal capacity and development priorities differ in ways that matter, and some of Europe's choices have costs that would weigh more heavily on African economies.

Europe’s Digital Sovereignty

There is no single legal definition of digital sovereignty. Pohle and Thiel describe digital sovereignty as "a discursive practice in politics and policy" more than a settled legal or organisational concept, and they identify three elements that often run together namely the autonomy of the state over its digital infrastructure, the economic self-determination of domestic industry, and the empowerment of individual users through rights and skills (Pohle and Thiel 2020). Floridi makes a related point, arguing that the real question is who controls the digital, and that for the EU this control has to be exercised through law and shared institutions because no single member state has the scale to do it alone (Floridi 2020).

In practice, Europe's use of the term has shifted over time. In the 2010s the emphasis was on protecting personal data and fundamental rights, a concern sharpened by the Snowden disclosures and later by the Court of Justice's ruling in Schrems II, which struck down the EU-US Privacy Shield because US surveillance law did not offer protection essentially equivalent to EU law (CJEU 2020). From around 2020, the language widened to include industrial capacity and resilience, as the pandemic, chip shortages and rising US–China tension exposed supply-chain dependencies. More recent proposals, such as the EuroStack initiative, frame sovereignty as building European alternatives across the whole technology stack, from chips and cloud to software and AI models (Bria et al. 2025).

This evolution holds particular relevance for Africa, as the continent continues to define its own approach to digital sovereignty because each of the three elements implies different policy tools. Rights-based sovereignty is pursued mainly through law and independent regulators. Industrial sovereignty requires capital, infrastructure and long time horizons. Treating them as one project can obscure the fact that they compete for the same scarce resources and political attention.

The Regulatory Route

Europe's clearest success has been in rule-making. The General Data Protection Regulation (GDPR), applicable since 2018, was followed by the Digital Services Act and Digital Markets Act in 2022 and the AI Act in 2024 (Regulation (EU) 2024/1689). The resulting global influence is referred to as the "Brussels effect" because other governments borrow EU models when writing their own laws (Bradford 2020). Many African data protection laws show clear GDPR influence in their structure, principles and data subject rights (Boshe and Goberna Caride 2024).

The evidence also shows the limits of regulation as a sovereignty strategy. Laws can set conditions for how technology developed outside Europe is used in Europe, but they do not by themselves create European alternatives. The 2024 Draghi report on European competitiveness noted that the EU had around 100 tech-focused laws and over 270 regulators active in digital networks, and argued that compliance costs fall hardest on smaller firms, which are more often European (Draghi 2024). The EU has since taken steps to adjust its implementation timeline for laws such as the AI Act. The Digital Omnibus on AI, which entered into force in July 2026, postponed most high-risk obligations under the AI Act to December 2027 and August 2028 (Regulation (EU) 2026/1744). Supporters view this much needed adjustment to standards that were not ready while critics view this as a weakening of protections under industry and geopolitical pressure.

There is also a jurisdictional limit. In June 2025, a senior Microsoft France official told a French Senate inquiry under oath that he could not guarantee that French citizens' data held by Microsoft would never be transmitted to US authorities following a US order, while adding that this had never happened (Convotis, 2025). European law governs what happens in Europe, but a provider headquartered elsewhere remains subject to its home country's law as well. Regulation can only  manage this tension but cannot remove it.

The Infrastructure and Industrial Route

Alongside regulation, Europe has tried to build capacity directly, with uneven results. Cloud is the most cited case-study. Gaia-X, launched in 2020 as a Franco-German initiative, was widely presented as a European answer to US hyperscalers. It evolved into a framework of standards and certifications for federated data services, and admitted the large US providers as participants. Its former chief executive has since argued that conflicting expectations, political rather than industry leadership, and the absence of an agreed definition of sovereignty left the project without a clear purpose (Bonfiglio 2024). Meanwhile, market developments continued to reshape the landscape. Synergy Research Group estimates that European providers' share of the European cloud market fell from 29% in 2017 to about 15% in 2024, even though their revenues tripled, while Amazon, Microsoft and Google together held around 70% (Synergy Research Group 2025). Gaia-X's supporters argue that interoperable data-sharing standards were always a long-term goal. Even so, they did not change who controlled the underlying infrastructure.

Semiconductors tell a similar story. The 2023 European Chips Act set a goal of a 20% share of global chip production by 2030. In 2025 the European Court of Auditors regarded this as very unlikely, noting the Commission's own forecast of an 11.7% share by 2030, up from 9.8 per cent in 2022 (European Court of Auditors 2025).

Public computing for AI offers more promise. Building on the EuroHPC network of public supercomputers, the EU had designated 19 "AI Factories" across 16 member states by October 2025, with smaller "antennas" giving other countries remote access (European Commission 2025a). In February 2025 the Commission launched InvestAI, aiming to mobilise €200 billion for AI, including a €20 billion fund for large "AI gigafactories" (European Commission 2025b). While it is too early to assess outcomes, this model of resource pooling ensures that shared public infrastructure gets to researchers, start-ups and smaller states that could not afford alone.

Gaps in Europe’s Approach

Europe's own assessments openly acknowledge the extent of its dependence. The Draghi report observed that only four of the world's top 50 technology companies are European, that three US hyperscalers account for over 65% of the European cloud market, and that around 70% of foundational AI models developed since 2017 came from the United States (Draghi 2024). The EuroStack report estimates that more than 80% of Europe's digital technologies and infrastructure are imported (Bria et al. 2025).

There is no consensus on why this is the case. One view, associated with the Draghi report, holds that a dense and fragmented regulatory environment has raised costs and discouraged European scaling. Bradford disputes the idea that Europe faces a choice between regulation and innovation. She attributes the gap mainly to deeper structural features including an incomplete digital single market, shallow capital markets for risky ventures, bankruptcy rules that penalise failure, and difficulty attracting global talent (Bradford 2024). Nonetheless, both accounts agree that regulation alone has not produced sovereignty, and that capital, market integration and talent shape outcomes at least as much.

A second challenge, which receives less attention, concerns policy coherence. The EU pursues several objectives simultaneously, including the protection of fundamental rights, the promotion of competition, industrial development and security, and these are sometimes advanced by different institutions with differing priorities. Europe's experience therefore suggests that the concept of digital sovereignty is most effective when it is translated into specific and measurable dependencies that a government has chosen to address, rather than applied as a broad policy aspiration.

Africa’s Starting Point

For Africa, four differences shape what Africa can borrow from the EU experience.

1. The first is institutional. The EU can pass regulations that bind 27 member states directly and enforce them through a common court. The African Union's instruments work differently. The AU Data Policy Framework of 2022 and the Continental AI Strategy endorsed in July 2024 are guidance for member states (King'ori et al. 2023; African Union 2024). The Malabo Convention on cyber security and personal data protection took nine years to reach the 15 ratifications it needed to enter into force in June 2023 (Ifeanyi-Ajufo 2023). Additionally, many African constitutions require international or regional instruments to be ratified and incorporated into national law before they take effect domestically, which can add further time, particularly where political support is limited. National laws have nevertheless moved faster. By the end of 2025, 44 African countries had data protection laws and 38 had operational authorities (Buza 2026).

2. The second is market leverage. The Brussels effect depends on a market large and wealthy enough that firms adapt to it rather than leave. Most individual African markets lack that pull, and the continental market is still fragmented. Evidence also suggests that EU-style rules may carry particular costs in Africa. A study of African data governance models found that comprehensive, GDPR-style data protection laws correlate negatively with intra-African trade in digital services, especially in lower-income countries, possibly because of compliance costs (Ferracane et al. 2025). This does not mean data protection is harmful, but it does suggest that context-specific design, harmonisation and support for compliance matter a great deal.

3. The third is the development baseline. The International Telecommunication Union estimates that 36% of Africa's population used the internet in 2025, compared with roughly 88 to 93% in Europe and the Americas (ITU 2025). Europe's sovereignty debate is about who supplies services to an already connected population. Much of Africa is still about connecting people at all, and external investment often finances that connectivity.

4. The fourth concerns the state. Some scholars describe the dominance of foreign technology firms in the Global South as a form of "digital colonialism" (Kwet 2019), and that critique has real force. Yet, sovereignty language can also serve governments seeking control over their own citizens as seen in activities such as internet shutdowns which Access Now notes stood at 30 across 15 African countries in 2025 (Access Now 2026). Pohle and Thiel note that the concept is used in authoritarian as well as democratic settings (Pohle and Thiel 2020). Any African sovereignty agenda therefore has to answer a question Europe has largely been able to answer; sovereignty for whom?

Lessons for Africa

With those differences in mind, seven lessons stand out for Africa as it pursues its digital sovereignty.

1. Name the dependencies. Europe's most productive moments came when it identified a specific problem, such as unlawful transfers of personal data or a shortage of public AI compute, and designed a tool for it. Its weakest came when sovereignty served as a broad aspiration that different actors filled with different goals, as happened with Gaia-X. African governments would benefit from listing the dependencies that matter most to them. It could be payment systems, identity infrastructure, government data hosting, language technology, or compute for research and deciding which to reduce, which to manage, and which to accept.

2. Treat regulation as necessary but insufficient. Europe's laws gave it influence and protected rights, but did not create domestic capacity. Africa already has more than 40 data protection laws. The marginal gain from new legislation is likely smaller than the gain from properly funding the authorities that enforce existing laws and from aligning rules across borders.

3. Design rules for African markets. Europe has itself recalibrated the AI Act's implementation timeline. African lawmakers can learn from that by building in proportionality for small firms, phased obligations and regulatory cooperation from the start, so that protective rules do not unintentionally raise barriers to intra-African trade, as the evidence on GDPR-style laws suggests is a risk (Ferracane et al. 2025).

4. Pool capacity. Europe's AI Factories show how shared public infrastructure can give smaller countries and researchers access they could not afford alone. Regional pooling, whether through AfCFTA mechanisms, regional economic communities or university networks, is more realistic for most African states than national self-sufficiency.

5. Distinguish sovereignty from localisation. The AU Data Policy Framework already makes this distinction and discourages broad localisation mandates (King'ori et al. 2023). Europe's experience supports it by showing that storing data in-country does not by itself change who can compel access to it. Contractual terms, encryption with locally held keys, audit rights and exit provisions would offer better routes.

6. Use public procurement deliberately. Governments are major buyers of cloud and software. The French Senate inquiry into public procurement shows that Europe is now examining what its own purchasing decisions mean for control over public data. African governments can set clear criteria for hosting, portability and access when they buy, without closing their markets.

7. Keep rights at the centre and audit the targets. Europe's rights-based approach is the part of its model with the strongest legitimacy, and the European Court of Auditors' review of the Chips Act shows the value of independent scrutiny. African sovereignty agendas will be more credible if they protect citizens against the state as well as against external technology providers, and if parliaments and audit institutions test whether stated targets are being met.

Europe's experience with digital sovereignty offers both instructive successes and important limitations. It demonstrates that a region can influence global rules and safeguard fundamental rights through legislation, that developing industrial capacity requires considerably more time and investment than policy announcements may suggest, and that shared public infrastructure can broaden access for smaller actors. It further indicates that sovereignty objectives are more readily achieved when they are clearly defined and when progress towards them is assessed rigorously.

Africa's circumstances call for an approach to sovereignty that places connectivity, interoperability and the rights of citizens at its centre, draws on regional cooperation where national capacity is limited, and identifies with care which dependencies should be prioritised. Perhaps the most valuable lesson Africa can draw from Europe is its willingness, as reflected in the Draghi report and the reviews of the European Court of Auditors, to evaluate its own record openly and to adjust its course where necessary.