During a session held on July 8 at the Presidency of the Palais Bourbon, the inquiry commission’s report on “structural dependencies and systemic vulnerabilities in the digital sector and the risks to France’s independence” does not overturn the field’s conceptual framing.
The question of French digital sovereignty has been on the agenda since the Senate’s Longuet report in 2019, and since Philippe Latombe’s; specifically, the chair of this new commission in 2021. But by 2026, it is the surrounding context more than the novelty of the diagnosis that lends the document its political weight.
The MAGA Shock
The chair, Latombe, a deputy from the Les Démocrates group representing the 1st constituency of Vendée, does not hide this in his foreword: he laments “that it took the MAGA era” for a collective electroshock to occur.
The report locates the rupture in Donald Trump’s second term, begun in January 2025, which shattered the postwar transatlantic cooperation framework. The American national security strategy published in early December designates the European Union as an obstacle to American interests. Moreover, powerful tech leaders, such as Elon Musk or Palantir’s Alex Karp, have shifted from executives to openly political actors.
The document highlights the blockage, by decision of the U.S. government, of access to Anthropic’s models as evidence that “the kill switch is no longer merely a hypothesis but a reality.” In other words: a digital tool on which an administration, a company, or a state depends can be taken away overnight by a foreign political decision.
A €1.5 Billion Dependency
According to UGAP (the Union of Public Procurement Groups), American players account for nearly 80% of software purchases by the French administration’s fifty largest suppliers. Public administrations’ expenditures, including local authorities, toward non-European actors are estimated at €1.5 billion, of which one billion is deemed directly substitutable by existing alternatives.
On the scale of private enterprises, the bill rises to €264 billion in software and cloud services purchased by Europeans from American companies.
Three suppliers concentrate the bulk of the software dependency of administrations: Microsoft, VMware, and Oracle.
The report also details a vulnerability on personal data. In the second half of 2025, the U.S. government issued more than 5,500 data-disclosure requests to Microsoft and more than 60,000 to Google, which complied in 89% of cases.
Regarding artificial intelligence and data centers, the report notes that RTE reserved 15 gigawatts of electrical connection capacity for data center projects, representing 24% of the power of France’s nuclear fleet.
According to the commission’s analysis, the bulk would benefit American hyperscalers or other non-European players, whereas only 1.4 GW would go to strictly European operators.
29 Proposals to Regain Control
The document draws a line between recommendations that are deemed consensual and quickly implementable, and 29 more structural proposals advanced by the rapporteur.
Several strands emerge.
Invest in Open Source as an Industrial Alternative.
The report proposes creating the France Libre Open Source Foundation (Flos) tasked with ensuring the longevity of the open-source blocks used by the state, backed by a fund (named Logic) that would complement the European Sovereign Tech Fund. Open source would become mandatory in public procurement by January 1, 2030, and territorial authorities’ spending in this domain would be accounted for as investment rather than operating expenditure.
Take Education Out of Microsoft’s Grip.
Proposal No. 5 is modestly titled “Zero Microsoft in Schools.” It is accompanied by an amendment to the education code to integrate the teaching of free software; the report highlighting the early establishment of digital habits among students as a key factor in long-term dependence.
Secure Service Continuity.
The text proposes generalizing escrow clauses in public contracts so that the state retains access to essential technical elements in case a provider fails. A more radical solution, a “final sovereignty clause,” would require, for strategic suppliers, the retrocession to the state of the elements necessary for software operation in the event of a sale.
Frame France’s AI Gems.
The report suggests that the state could hold specific shares (golden shares) in Mistral AI and ChapsVision, granting a veto over certain strategic capital decisions. It also proposes clawing back public subsidies (seed funding aid, research tax credit) in the event of a rapid sale of a French startup to a non-European actor.
A Moratorium on Data Centers
Slow the Data Center Race.
Facing the concentration of electrical capacity reserved for foreign actors, the commission proposes a moratorium on data center projects that do not meet a sovereignty imperative, paired with strengthened public oversight of their deployment.
Strengthen the Legal and Institutional Arsenal.
The report argues for activating the European Blocking Regulation and, if necessary, an anti-coercion instrument against the extraterritorial application of American law. It recommends creating a GDPR class-action procedure and a fully functioning Ministry of Digital Affairs with a strengthened interministerial authority. It would be complemented by a parliamentary delegation dedicated to digital matters.
Fruit of a consensual effort among political groups that otherwise oppose each other—from La France Insoumise to The Republicans—the report is now set to feed two legislative milestones announced for autumn and winter. First, the examination of the bill on the resilience of critical infrastructure and cybersecurity, due to begin on September 21. Second, the 2027 finance bill.
