Open source and digital sovereignty: why it concerns all of us

Almost every company using a US cloud service (AWS, Microsoft Azure, Google Cloud) is, directly or indirectly, subject to US law over its data. That’s the core of this article: why digital sovereignty isn’t an abstract concern, and how open source is a concrete answer to it.

Two US laws, one direct consequence for you

The CLOUD Act, passed in 2018, requires any US company to hand over data it controls to US law enforcement, even if that data physically sits on a server in France or Germany. Where the machine is located doesn’t matter; what matters is the nationality of the company operating it.

Alongside it, FISA Section 702 authorizes US intelligence agencies (the NSA foremost) to collect the communications of non-US persons from US cloud providers, without an individual warrant, under annual programs approved in bulk. In 2020, the Court of Justice of the European Union ruled, in its Schrems II decision, that this regime made US protections incompatible with GDPR.

In practice: three US companies (AWS, Azure, Google Cloud) now control roughly 70% of the European cloud market, and more than 80% of the digital products and infrastructure used in Europe come from non-European providers. That’s digital sovereignty: the ability of a state, a company, or an individual to choose their technological dependencies rather than simply inherit them.

And this isn’t just a European problem. The CLOUD Act and FISA apply the moment a US company is involved, no matter where its customers live: Global South countries are just as exposed, often with even less leverage to negotiate better terms. Globally, six companies (Amazon, Microsoft, Google, Oracle, Alibaba, Huawei) control more than 70% of the cloud market, a concentration that makes it hard for developing countries to secure equitable terms. In Africa specifically, dependency on foreign data centers has been identified as a direct obstacle to any real digital sovereignty by the US think tank New America.

The story of the free PDF tool

You’ve probably used a free online tool to merge or split a PDF at some point. Ask yourself honestly: would you hand it a copy of your ID card, your health insurance card, or a confidential internal contract from your company? Of course not.

And yet that’s exactly what shadow IT, and its more recent cousin shadow AI, describe: employees using digital tools their company never approved, usually just to save time. According to Microsoft, 80% of employees use unsanctioned apps to get their work done. According to Cyberhaven’s 2026 report, 33% of employees admit they’ve exposed sensitive company data to a consumer AI tool, and 54% of identified “shadow AI” usage involved uploading confidential data. Half of organizations have already suffered a breach tied to this phenomenon.

The real strength of open source: you don’t have to trust a third party

Now imagine that same PDF tool is open source: its code is public, you can audit it, download it, host it yourself on your own server. You no longer need to trust some unknown company not to exploit, resell, or expose your documents: you control the whole chain end to end. That’s the real strength of open source. It was never really about price, it’s about control.

Ten years ago, open source often carried a reputation as the “cheaper, weaker” alternative to proprietary software, for lack of funding and a clear economic model to compensate contributors. That’s no longer true today, especially in artificial intelligence.

The shift in large language models

In August 2025, OpenAI, whose very name promised openness, released its first open-weight models since GPT-2: gpt-oss-120b and gpt-oss-20b, under the Apache 2.0 license, freely downloadable and deployable on your own infrastructure. That was only the beginning. As we write this, July and August 2026 stand as the most consequential eight weeks in the history of open-weight AI. Moonshot AI (China) released Kimi K3, a 2.8-trillion-parameter model billed as the largest open-source model ever shipped, with weights published on July 27, 2026. At the same time, Z.ai, DeepSeek, and Alibaba (Qwen) shipped increasingly capable versions of their own open models one after another.

These models no longer just chase proprietary ones: they sometimes beat them outright. In early 2026, GLM-5.1 (Z.ai) briefly took the top spot on the SWE-bench Pro leaderboard, the first time an open-weight model had ever led that real-world GitHub issue-resolution benchmark, before Claude Opus 4.7 reclaimed the lead nine days later. On Humanity’s Last Exam, one of the most demanding reasoning benchmarks, Kimi outscored GPT (52.1%) and Claude (53.0%) with a score of 54%. And DeepSeek V4 Pro, released under the MIT license, resolves 80.6% of tickets on the SWE-bench Verified benchmark.

Would you hire an entire research team today to build your own large language model? Almost certainly not: the benchmarks no longer justify it. The gap between open and proprietary models, once measured in years, is now measured in weeks. More often than not, you can simply download an open model and host it yourself.

The real question: where does your data go?

Plenty of companies already hand over trade secrets to tools like ChatGPT without thinking much about it: source code, business strategy, a sensitive HR document. Almost nobody reads the terms of service before clicking “I agree.” And depending on which company hosts the tool and which jurisdiction it falls under, the CLOUD Act (or its equivalent) can apply without you ever being told.

Open source doesn’t solve everything, but it changes the question being asked: instead of “can I trust this provider?”, it lets you ask “can I verify what this software does, and keep it in-house if I want to?” That’s the question we consistently ask ourselves at Pabiosoft before choosing a technical component, for our own products as much as for our clients’.