The cloud has long been treated as a remedy to risk. Hardware failures, the loss of a data center, traffic surges, data breaches—the combination of multi-AZ, multi-region deployments and geo-replicated backups has markedly strengthened the resilience of information systems. Yet, this architecture often rests on a fundamental assumption that is rarely questioned: the provider will remain reachable and reliable.
The “kill switch” reality forces a rethink of this assumption. It does not necessarily require imagining a red button triggered by a government. The risk encompasses any situation in which an organization suddenly loses access to a technology due to an external decision: sanctions, export controls, a legal ruling, or a service suspension.
In June 2026, two Anthropic AI models were suspended for certain clients for several weeks following an American export-control directive. Organizations capable of switching to alternative models fared only minimally affected. The scenario that once seemed unlikely has now become plausible, calling for a reevaluation of existing risk analyses.
Multi-AZ does not mean multi-vendors
A failure and a kill switch have different origins, but for an IT department they can yield the same result: a critical service becomes unavailable.
A system can be extremely redundant yet still feature a single point of failure: the same provider, the same contract, the same jurisdiction, and the same control framework. That is the paradox: multi-AZ is not synonymous with multi-vendors.
And companies are less prepared than they think. According to Capgemini, 36% of organizations would take more than twelve months to sever ties with a critical supplier. The Unitrends study “State of Backup and Recovery 2025” shows that only 35% can realistically resume operations within a few hours, while more than 60% believe they could.
Identity management is arguably the first area of vigilance. Without authentication, there is no access to email, documents, or collaboration tools. Then come business processes. This is why a robust fallback plan might include an independent backup directory outside the provider, emergency accounts, and an independent MFA. For email, this means an out-of-tenant backup and a standby MX; for data, a copy stored outside the provider in a usable format.
Sovereignty is not an absolute
The answer is not to abandon all American clouds. The concentration remains significant: three American hyperscalers hold around 70% of the European cloud market, according to the Court of Auditors.
Sovereignty should be viewed as a continuum. Who can order a disruption? Who operates the underlying infrastructure? Who holds the keys? Who controls the code and the updates?
There is also a pragmatic angle: 29% of leaders surveyed by MEDEF/Wavestone feel there is no European alternative mature enough, while 59% deem total sovereignty unrealistic. The goal is not to migrate everything, but to be able to switch where dependence becomes dangerous.
This logic also applies to AI. Rather than making an application dependent on a single model, an abstraction layer that supports multiple models can allow changing providers without rewriting the entire application, potentially complemented by a self-hosted open-source model as a fallback.
The ability to switch must be tested
Under the European regulations DORA (financial sector) and NIS 2 (critical and important entities), digital risk assessment must now obligatorily include an evaluation of dependence on critical third parties.
Reversibility cannot remain a contractual clause; it must be embedded in the architecture, documented, and, crucially, tested. A backup that has never been restored is not a contingency plan. An alternate messaging system requiring weeks to deploy is not a crisis channel. A multi-cloud environment that relies on a single identity system remains dependent.
Enterprises are accustomed to simulating cyberattacks or data-center outages; they must now test a different scenario: if tomorrow morning Azure Active Directory Entra ID, Microsoft 365, AWS, Google Cloud, or our LLM provider becomes unavailable, how long can we function? and how long will it take to switch?
The most valuable form of digital sovereignty may lie not in avoiding dependency entirely, but in ensuring that you never depend on a single actor to the point where you cannot operate without them.
Sources:
Dawn Liphardt.fr – Court of Auditors, digital sovereignty (October 2025)
Capgemini Research Institute – Digital Sovereignty (September 8, 2026)
Unitrends, State of Backup and Recovery 2025
MEDEF / Wavestone – Digital resilience and autonomy (2026)
