The first 100 days of the year are to set the direction

The opening months of the year leave little room for doubt: planned initiatives in cybersecurity, digital infrastructure, cloud, connectivity and AI, public procurement and defence all converge around one central question: how serious is the EU about technological sovereignty?

Strengthening digital sovereignty and reducing external dependencies will be major priorities in these first 100 days of 2026. This period will see the EU tackle big challenges, ranging from responding to an increasingly threatening geopolitical landscape, to crafting the EU’s next long-term budget, to reforming a large body of tech regulations. For European tech SMEs, the bridge between ambition and delivery matters. Sovereign digital infrastructure is not an abstract goal, it is a precondition to boost the homegrown innovative solutions these businesses produce.

The European DIGITAL SME Alliance is helping to build this infrastructure: Together with our partners and experts, we have launched the Tech Sovereignty Catalogue and two sovereign Software Labels, which help public and private buyers identify trusted, homegrown solutions. The new year will see these initiatives take up speed, broaden in scope, being at the centre of Europe’s efforts to become a Tech continent.

In what follows, we anticipate how the continent’s capacity to become technologically sovereign depends on expected initiatives in different areas:

Cloud and Artificial Intelligence

Nowhere is the opportunity for Europe to strengthen its tech sovereignty more evident than in the upcoming Cloud and AI Development Act. This proposal sits at the heart of Europe’s tech sovereignty push. Just three US-based companies count for 65% of European cloud services market – and are investing billions to augment this dominance. The result is a deep and dangerous structural dependency.

The stated ambition to strengthen European cloud and AI capacity is therefore welcome. AI cannot be applied at scale without cloud, and right now, Europe lacks the physical infrastructure to offer widely deployable, secure and sovereign cloud capacity. Without decisive action, European public administrations, SMEs, and strategic industries will remain dependent on non-EU hyperscalers.

For DIGITAL SME, the Cloud and AI Development Act is a unique opportunity[1] to build a European Sovereign Cloud, an essential layer for a European technological stack.

Competitiveness and Public Procurement

If cloud and AI are the supply side of Europe’s tech ambition, public procurement is the demand side, and arguably the most powerful lever the EU has to boost demand for homegrown innovation. The forthcoming review of the Public Procurement directives could fundamentally reshape how digital markets function in Europe. Since the beginning, DIGITAL SME has called for a clear definition of European preference criteria in the revised rules.[2]

This criterion is key to implementing a more strategic approach to procurement, rewarding security, interoperability and innovation, and enabling public authorities’ role as anchor customer for European tech alternatives. A European preference should be clearly defined and consider key factors like company ownership, headquarters location, data storage, and technological development processes, to ensure products genuinely originate and develop in Europe.

As a test before the Public Procurement review, the upcoming Industrial Accelerator Act offers a critical opportunity to introduce simple, effective made-in-EU and local content rules for electric vehicles and batteries. These rules can be a first step towards the definition of European preference in the revision of Public Procurement rules.

Cybersecurity

The revised Cybersecurity Act (CSA) is expected to land in mid-January, reopening debates about trusted suppliers and strategic dependencies. Small firms will feel the impact most directly, through certification requirements and changed reporting to the EU’s cybersecurity agency ENISA.

Critically for cyber sovereignty, the implementation of the European Cybersecurity Certification Framework has been challenging. So far, only one EU scheme has been adopted – the EUCC[3] – while all other schemes, including one on cloud services, the EUCS, are still under development. A revised Act should therefore focus on making the framework workable in practice, especially by including non-technical supply-chain risks such as geopolitical dependencies in its criteria.[4] 

Simplification, Skills and Scaling-up

Alongside infrastructure and procurement, long-standing structural issues remain. The proposed “28th regime” for company law could, if ambitious, reduce the legal friction that still fragments Europe’s startup landscape. While the EU creates more new firms than the US, it struggles to scale them into global leaders.

DIGITAL SME supports the 28th regime[5] because it can address shortcomings in the EU’s ability to scale up innovative companies. If designed pragmatically and adopted as a regulation, it could become a powerful tool to boost the global competitiveness of EU-based companies and strengthen Europe’s technological sovereignty.

Simplification will be equally decisive. Following the Commission’s proposal of November 2025, the Cyprus Presidency should drive progress on the Digital Simplification Omnibus. For SMEs, regulatory relief means practical implementation: flexible AI Act enforcement until compliance tools are available, adjusted timelines under the Cyber Resilience Act, and lighter GDPR documentation obligations where risks are demonstrably low. Simplification must not, however, favour large incumbents or non-European hyperscalers.

Skills are an additional – often overlooked – pillar to build EU tech sovereignty in 2026. The EU is updating its visa policy strategy and advancing the EU Talent Pool, designed to connect skilled workers from third countries with European companies. If properly implemented, these initiatives could be game-changers: enabling innovative European firms to attract global talent that might otherwise head to the US, while limiting the brain drain of European graduates towards large tech firms across the Atlantic. Sovereignty, in this sense, is not only about infrastructure and capital, but it is also about people.

New initiatives on chips and quantum technologies, the circular economy, as well as defence in the single market further illustrate how deeply tech policy is now intertwined with security and industrial strategy.

Over the course of the year, DIGITAL SME will make sure the voice of European innovators is heard and their potential fully leveraged as the engine of European tech sovereignty.