When governments start building their own digital stack

When governments start building their own digital stack

Three stories from this year look unrelated until you line them up. Four Dutch municipalities started handing employees Linux laptops running a homegrown collaboration stack. The Dutch central government told its agencies that email and document management no longer belong in a public cloud, and that every important cloud service needs an exit plan. And China's Ministry of State Security told some state-linked organisations to uninstall their government edition of Windows 10 months earlier than planned.

None of that is a ban on Microsoft. All three are programmes about the same engineering problem: how much of government IT depends on a single vendor, and what happens on the day that dependency stops being convenient. The interesting part is never the operating system. It is everything bolted to it.

The Dutch pilot is small on purpose

Under the Netherlands' national digitalisation strategy, four municipalities — 's-Hertogenbosch, Zaanstad, Ede and Amsterdam — are testing a Linux-based laptop alongside MijnBureau, an open-source collaboration environment, according to Digitale Overheid's report from 3 April 2026. The workplace, DAWO (Digitaal Autonome Werkomgeving Overheid), is built by SSC-ICT. MijnBureau comes from the interior ministry and assembles components from France's La Suite, Germany's OpenDesk and Nextcloud, among others.

The pilot runs to the end of 2026, and its stated goals are refreshingly modest: collect user feedback, improve integration with existing systems, and work out which groups of municipal employees can move to MijnBureau in production first. Nobody is testing whether Linux boots. They are testing whether a European workplace stack survives contact with actual municipal work — the forms, the legacy systems, the printers, whatever the building has run for fifteen years.

The cloud policy is the stricter half

In July, the cabinet tightened the central government's cloud policy. Agencies now have to weigh geopolitical risk and single-supplier dependency before using public cloud services. For critical organisations — ministries, self-governing administrative bodies — services governed by legislation outside the EU/EEA are discouraged for core tasks. Email and document management sit in a different category: the cabinet discourages putting them in a public cloud at all, and the source data of base registrations such as the BRP and the Kadaster may not be managed there.

The requirement worth stealing is the exit plan. Any agency using an important cloud service must write down what it does if that service suddenly disappears — switch providers, or carry on by itself. A cloud strategy has to explain why a public cloud was chosen, which risks come with it, and how they get mitigated. Agencies have four years to adapt, longer where the case is genuinely complex. State secretary Aerdts framed the intent plainly: "Digital sovereignty means being able to make choices. Choosing another supplier when that is necessary. Choosing who has access to our data and who does not." (Translated from Dutch.)

Back in April, the same government had already signed a framework agreement with STACKIT, a European cloud provider, with data stored inside the EEA, audit rights, and termination terms if the provider falls into non-EEA hands.

The EU is buying sovereignty with procurement

The European Commission's technological sovereignty package, put forward on 3 June 2026, bundles a second Chips Act, a Cloud and AI Development Act, an Open Source Strategy and a strategic roadmap for digitalisation and AI in the energy sector. The open-source strategy is the one to watch: scale up open-source alternatives in priority areas, invest in skills and infrastructure, and push open source and open standards through public procurement instead of treating them as a nice-to-have.

The procurement side is already real. In April, the Commission awarded its sovereign cloud tender — up to €180 million over six years, deliberately split across four providers to avoid lock-in: a Post Telecom-led partnership with OVHcloud and CleverCloud, STACKIT, Scaleway, and a Proximus-led group using S3NS, Clarence and Mistral.

The scoring is what makes it more than a press release. The Commission's Cloud Sovereignty Framework grades providers on 48 criteria across eight categories and hands out a Sovereignty Effectiveness Assurance Level, or SEAL, from 0 to 4. SEAL-2 is the data-sovereignty bar required to qualify. SEAL-3 means technological autonomy — immune to supply-chain disruption from outside the EU. SEAL-4 demands a full EU supply chain, chips to software. Most winners reached SEAL-3; the Proximus group reached SEAL-2, partly on Google Cloud technology operated exclusively by EU companies. The Commission's own summary says the quiet part out loud: even non-European technology can clear the minimum bar inside a strict enough framework (Sovereign Cloud Framework explained, 1 June 2026).

The office-suite fight shows where the real cost sits

Euro-Office launched on 9 June 2026: an open-source suite forked from OnlyOffice's core, backed by more than a dozen organisations, pitched as the workplace layer of a European stack. The Document Foundation, which maintains LibreOffice, published an open letter days earlier arguing against the marketing's implication. Euro-Office defaults to OOXML, the Microsoft-controlled format, rather than ODF, and the foundation called a suite that saves every document in OOXML "a de facto ally of Microsoft in its content lock-in strategy." ZDNet's coverage of the fight summed up the position as: compatibility is not sovereignty.

That argument is the most useful thing in this entire story. A licensing dispute with OnlyOffice's vendor was reportedly resolved before launch, and an early ZDNet review found the suite usable but not yet production-ready — in a market where Microsoft 365 and Google Workspace together hold 96% of online office use. You can self-host every server and still lock yourself into the document format, and the format is where the workflow lives.

China's version is faster, narrower, and already underway

Bloomberg reported on 18 August 2026 that China's Ministry of State Security told some state-linked entities to uninstall the government edition of Windows 10 built by C&M Information Technologies (CMIT), a 2016 joint venture between Microsoft and state-owned China Electronics Technology Group. Retirement had been scheduled for February 2027; the directive pulled it forward by several months over data-security concerns, without naming a specific vulnerability. Microsoft's answer to Bloomberg was carefully worded: "Microsoft is not aware of a security incident affecting this product, which continues to receive regular security updates."

Keep the scope honest — "some" state-linked entities, not every desktop in China. Tom's Hardware's reading of the numbers shows how much distance is left: Windows still carried 87.64% of Chinese desktop web traffic in July 2026, and within Windows, version 10 still held 43.56% of usage against 50.01% for Windows 11, ten months after mainstream Windows 10 support ended. The domestic alternatives are real, though: Kylin V10, UnionTech's UOS, HarmonyOS 5 laptops, and Qingyun desktops on Huawei's Kirin 9000X. Chinese OS stocks jumped on the news, with Hunan Kylinsec and Archermind hitting Shanghai's 20% daily limit and China National Software climbing 10%.

What actually has to be replaced

The short answer is: almost everything. The longer answer is that nothing gets replaced one-to-one, because the layers are wired together:

identity -> device -> email/calendar -> documents
         -> chat -> storage -> cloud platform -> workflows

Swap the device for Linux and leave Microsoft 365, Entra ID and Teams in place — in a browser, behind the same single sign-on — and you have changed the wallpaper, not the dependency. Sovereignty starts when the identity provider, the collaboration layer and the data can each be replaced without dragging the others along.

An exit plan is where that stops being a press release. The useful questions, roughly in the order that hurts:

• Can every byte of data leave in a documented, machine-readable format?
• Does identity use standard protocols (OIDC, SAML) or a provider-specific one?
• Can the workload be rebuilt elsewhere without rewriting integrations?
• What still works on day one if the provider is gone tomorrow?

The answers are usually uncomfortable. That is the point of asking.

The question worth asking

Not "can we replace Microsoft?" but "how much of government IT keeps running if Microsoft is not available?" — then run the same audit against AWS, Google, Oracle, SAP and VMware. The Netherlands is finding out the cost in a pilot. The EU is turning it into procurement criteria. China is doing it under a security directive, with a domestic operating-system industry waiting to absorb the demand.

Three very different states, one engineering lesson: sovereignty is not an operating system you install. It is the set of exit routes you keep open. The same audit applies far beyond desktops — it is the argument we made about Malaysia's AI infrastructure, and it is the question sitting behind every rack in the data-centre build-out in Johor.

Sources

• Digitale Overheid (Dutch government): Gemeenten verkennen autonome digitale werkomgeving
• Rijksoverheid: Strengere regels voor het gebruik van clouddiensten door de Rijksoverheid
• Rijksoverheid: Rijksoverheid sluit deal met Europees cloudplatform STACKIT
• European Commission: Strengthening Europe's tech sovereignty
• European Commission: Commission boosts open and interoperable digital ecosystems for public administrations
• European Commission: Commission advances cloud sovereignty through strategic procurement
• European Commission: Sovereign Cloud Framework explained
• Bloomberg via The Straits Times: China removes Microsoft Windows at state users ahead of plan
• Tom's Hardware: China reportedly orders state agencies to uninstall its government-only edition of Windows 10
• The Document Foundation: An open letter to office suite users, just before the Euro-Office announcement
• ZDNet: Euro-Office 1.0 arrives to open-source infighting: 'Compatibility is not sovereignty'