The Deutschland Stack and the EU Sovereign Infrastructure Turn

Sovereign European digital infrastructure replacing US tech dependencies

Germany and France are building parallel sovereign infrastructure stacks that explicitly exclude American vendors. Germany's Deutschland Stack mandates ODF over OOXML and puts open-source development as the default. France is migrating 2.5 million government workstations off Windows to Linux. Both share the same premise: depending on foreign-controlled infrastructure is a strategic risk, not a cost optimisation problem.

The Deutschland Stack: Architecture, Not Aspiration

The Deutschland Stack is not a policy paper or a consultation exercise. It is the German federal government's formal sovereign technology platform, backed by the coalition agreement "Verantwortung fur Deutschland" and coordinated between the Digital Minister, the Federal Chancellery, and the Chancellor. It defines the standards governing how all federal public administration builds, procures, and manages digital systems, with concrete implementation targeted by 2028.

The architectural principles are explicit. "Made in the EU first." Reduction of lock-in effects. Open interfaces and local data storage. Open-source development as the default. These are governance criteria, not aspirations. The Stack defines a layered model for classifying standards, technologies, products, and projects, and it is being built iteratively through two public consultation rounds conducted between October 2025 and February 2026.

The first consultation established strategic alignment and consolidated evaluation criteria. The second round focused on pragmatic implementation conditions and whether prioritised technology fields are supported by the right standards. Feedback is currently being incorporated, with an updated Stack planned for spring 2026.

The ODF Mandate: What "Made in EU First" Looks Like in Practice

Buried in the Stack's technical specifications, under the pillar "Semantic technologies and real-time analysis," is a short line with outsized consequences. The document mandates exactly two document formats: ODF and PDF/UA. OOXML, Microsoft's format, is not on the list.

This is not a preference or a fallback. ODF and PDF/UA are the standard formats. The decision reverses years of risk calculus. Previously, the risk of moving away from the market's most widely used format was considered greater than the risk of staying. The Deutschland Stack inverts this: the greatest risk to interoperability and sovereignty lies with the proprietary format, not with the transition away from it.

The significance extends beyond document formats. If Germany's sovereign stack excludes OOXML, every supplier serving the German public sector must support ODF. Other EU member states building compatible infrastructure now have a reference point. The Document Foundation, which stewards ODF through LibreOffice, argued in its comments to the European Commission that the burden of proof lies with those advocating lock-in, not with those advocating open standards. Germany's Stack agrees.

France: 2.5 Million Devices, Seven Technology Categories

France's sovereign infrastructure turn operates on a different scale but the same logic. On 10 April 2026, DINUM, the Interministerial Digital Directorate, announced that 2.5 million civil servant workstations across central government, regional offices, and public agencies will migrate from Windows to Linux between 2026 and 2030.

The migration covers seven technology categories, not just the operating system:

Category	Current	Replacement	Timeline
Desktop OS	Windows 10/11	Linux (distro TBD)	2026 - 2030
Collaboration	Teams, Zoom	Visio (Jitsi-based)	By 2027
Productivity	Microsoft 365	LibreOffice	2027 - 2029
Endpoint security	US vendors	French/EU solutions	2027 - 2028
AI platforms	Azure AI, OpenAI	French sovereign AI	2027 - 2030
Databases	SQL Server, Oracle	PostgreSQL, MariaDB	2027 - 2029
Virtualisation	VMware, Hyper-V	Proxmox, KVM	2028 - 2030

The estimated cost is EUR 1.5 to 3 billion over five to seven years. Annual Microsoft licensing costs alone are estimated at EUR 500 to 800 million. Once fully migrated, the French government expects annual savings of EUR 300 to 500 million.

David Amiel, France's Minister of Public Action and Accounts, framed the imperative directly: "We must regain control of our digital destiny. We can no longer accept a situation in which we lack control over our data and infrastructure while remaining dependent on decisions made by foreign companies."

The Geopolitical Context

Both the Deutschland Stack and France's migration were catalysed by the same forces. Trump's "Liberation Day" tariffs in April 2025, which imposed 25% duties on tech components, made the economic argument for European alternatives. The US CLOUD Act, which allows American law enforcement to compel data access from US-headquartered companies regardless of data centre location, made the legal argument. The 2024 CrowdStrike outage, which crashed 8.5 million Windows devices globally, made the operational risk argument.

ANSSI, France's cybersecurity agency, reported a significant increase in cyberattacks targeting Windows infrastructure during 2024 and 2025. Germany's Schleswig-Holstein, already 80% through a 30,000-workstation migration off Microsoft, recorded EUR 15 million in licensing savings in 2026 alone.

The direction is structural, not cyclical. As Europe's broader shift away from US tech demonstrates, what started as cost optimisation has become a sovereignty requirement.

The AI Layer: Where the Stack Meets Reality

France's migration plan explicitly includes AI platforms in its seven categories of dependency to eliminate. Azure AI and OpenAI are listed for replacement with "French sovereign AI" between 2027 and 2030. This is the layer where the sovereignty problem is most acute and where the Stack's principles are hardest to apply.

Most EU companies building with LLMs route prompts through US-headquartered API providers. Under GDPR Article 45, the Court of Justice of the EU has already found US surveillance law to provide inadequate protection. The Schrems II (C-311/18) ruling invalidated the Privacy Shield for this reason. The same legal framework that makes OOXML unacceptable for government documents makes US-governed AI inference unacceptable for government data.

The Deutschland Stack's criteria of "trustworthy, sovereign, interoperable, and European-compatible" apply to AI infrastructure just as they apply to document formats. An AI inference provider must be EU-incorporated, operating EU data centres, under EU legal jurisdiction, and must not retain prompt data. These are not optional attributes. They follow from the same sovereignty logic that excludes OOXML and mandates open-source.

For engineering teams evaluating AI providers, the assessment mirrors what the Deutschland Stack requires of every technology in its layers. Which jurisdiction governs data access? Can the provider be compelled by a foreign government to disclose prompt data? Is the subprocessor chain transparent? Is there a fallback if the primary provider is disrupted?

ozeye's architecture addresses these questions directly: EU-only inference with every provider vetted for EU incorporation and EU data centres, zero data retention across the network, and multi-provider fallback routing that eliminates single-provider dependency and the concentration risk that DORA Article 28 requires financial entities to manage. The full subprocessor list provides the supply chain transparency that sovereign AI strategies demand.

Two Stacks, One Direction

Germany is building a sovereign technology platform from the standards layer up. France is replacing seven categories of foreign-controlled infrastructure across 2.5 million devices. Both are operating from the same principle: if the infrastructure is not under your jurisdiction, it is not under your control.

The Deutschland Stack's ODF mandate shows what that principle looks like when applied to document formats. France's AI platform replacement timeline shows what it looks like when applied to AI. The next two years will determine whether the AI layer can follow the same trajectory as the desktop layer, or whether the dependency on US inference providers proves harder to break than the dependency on US office software.