The balance: regulation needs alternatives to have leverage

This is the keystone chapter of the site's argument. Everything else builds toward this synthesis.

What the enforcement record shows

Three patterns emerge from the GDPR record, the DMA record, and the selective exit cases:

Pattern 1: Regulation produces formal compliance, not substantive change. Eight years of GDPR, €7.1 billion in cumulative fines , and the business models of the major regulated platforms remain structurally intact.

Pattern 2: When regulation pushes harder, vendors respond with selective exit. Apple Intelligence and Meta multimodal Llama are not coming to the EU. The DMA's stated goal — open markets, increased competition — is being substituted in practice by less product availability for European consumers.

Pattern 3: Regulation without industrial policy invites geopolitical retaliation. The U.S. retaliation threats of December 2025 escalate the conflict to a level where it is no longer about specific gatekeepers, but about EU-U.S. trade relations as a whole — with non-DMA-related European firms (Mistral, SAP, Spotify, Siemens) as collateral targets.

These three patterns share a structural cause: regulation alone cannot compel a monopoly provider to change its core business model. The provider has rational alternatives (pay the fine, litigate, withdraw) that are cheaper than substantive change. The only thing that makes substantive change rational for the provider is the credible threat of customer loss to an alternative.

That alternative does not currently exist at scale in most segments where European regulation is engaged.

The synthesis

Two propositions follow:

Proposition 1: Regulation without alternatives is a negotiating position without leverage. It can extract fines but it cannot dictate terms. The EU has learned this through eight years of GDPR enforcement and the first eighteen months of DMA enforcement. Continuing to expect different results from the same instruments — more regulation, harsher fines, longer investigations — is the political equivalent of pushing harder on a stuck door.

Proposition 2: Alternatives without regulation are commercially unviable for most customers. Even where European alternatives exist (Mistral, OVHcloud, Scaleway, Nextcloud, IceWarp, Authentik), customers will not migrate from established products without contractual leverage forcing the question. DORA exit-strategy requirements, Data Act portability requirements, CRA SBOM requirements are exactly that leverage — they convert "we'd like to switch eventually" into "we have to be able to switch within months." This is what makes the alternatives commercially viable in the first place.

The two together work. Regulation without alternatives is impotent. Alternatives without regulation are stranded. The pairing is the point.

What pragmatic strategy looks like for 2026–2028

The strategy on two legs:

Use the existing legal framework to enforce contractual provisions — DORA exit strategies, Data Act portability obligations, CRA SBOM and lifecycle requirements. This is what the operations roadmap operationalises chapter by chapter for the European CIO. These obligations are law; one does not need to wait for new legislation to apply them.

Simultaneously build real alternatives — European cloud providers (OVHcloud, Scaleway, STACKIT, with the redistribution-of-responsibility model that plays to European talent density), AI platforms (Mistral Studio, Forge, the Koyeb infrastructure), processor architecture (RISC-V via DARE and Codasip), and partnerships for manufacturing capacity (Korea, Japan, selectively Taiwan). This is what the alternatives section and partnerships section develop.

Both legs are necessary. Without regulation, the customer has no contractual leverage to switch. Without alternatives, there is nowhere to switch. The success of European digital sovereignty depends on the two moving together, in coordinated fashion, at sufficient scale.

Four theses

To close the policy argument:

First: complete self-sufficiency is neither achievable nor desirable. The matrix showed that no region — including the U.S. and China — is fully self-sufficient in 2026. The discussion must move from "how do we become independent" to "how do we structure dependencies so that they are not fatal." That is the difference between political slogan and feasible strategy.

Second: Europe holds globally rare industrial assets, but they are not invulnerable. ASML (100 % EUV) , Infineon/NXP/STMicro (automotive chips), SAP (enterprise ERP). These must be protected — but they are replaceable on a 5–10 year horizon if political will in competing regions consolidates. The emerging European industrial layer — Mistral (€11.7 bn valuation, $400M ARR in early 2026) , Helsing (defence AI, €12 bn valuation after €600m Series D in June 2025) , Wayve (autonomous driving), Codasip and SiPearl (processor architecture) — is real in 2026, but does not yet form a coherent counterpole.

Third: contractual and architectural discipline is more valuable than political declarations. None of the supply-chain incidents that this site references — Chinese solar inverters with undocumented communication components , the CrowdStrike outage that crashed an estimated 8.5 million Windows machines because no staged rollout was in place , the xz-utils backdoor delivered through social engineering of the maintainer process — would have caused the impact they did, had affected organisations had robust exit clauses, SBOM requirements, staged rollouts, redundancy, and tested business continuity. None of these requires a political decision in Brussels. They require discipline in procurement and IT architecture, which the organisation can choose to apply at any time.

Fourth: Europe has one undisputed advantage that is rarely discussed. Per capita, the EU has a higher concentration of AI specialists than the U.S. and roughly three times the concentration of China. European university systems — ETH, EPFL, TU Delft, KU Leuven, the French grandes écoles, German technical universities — produce engineering talent at a scale that is globally rare, and Europe's tech talent pool grew 4 % YoY to 4.6 million in 2025 per Atomico's State of European Tech. The redistribution-of-responsibility model — where the European alternative assumes customer competence rather than vendor competence — plays exactly to this advantage.

The strategic question for 2026–2028 is not whether Europe will catch up to the United States. That is not the right goal. The question is whether Europe structures its existing knowledge and industrial assets so that in the decisive layer of every technology stack it has either its own capacity or a reliable partner. That position does not require autarky. It requires discipline — contractual, architectural, partnership, regulatory.

Discipline is something Europe, unlike capital or geography, can choose.