Find the right AI use cases before investing in development.
Connect AI to your existing systems and workflows.
Build autonomous AI agents that automate complex tasks.
Design and develop AI solutions tailored to your business.
Build secure, scalable AI systems for enterprise environments.
Legacy software modernization →
Upgrade outdated systems for better performance, security, and scalability.
Make informed technology decisions before investing in development.
Validate your product idea with user and business insights.
Define the right scope to launch faster and reduce risk.
Confirm your idea is technically viable before you build.
Capabilities
Want to start a software project with us?
Book a time with our technology experts →
We brought young developers together to explore the future of AI agents. More editions are coming soon.
*updated October 2026
Most CTOs I talk to have a rough idea of how dependent their company is on individual cloud providers.
That “rough idea” is exactly the problem.
This self-test walks you through four layers with concrete questions, so you and your team can assess your digital sovereignty in a structured way, instead of relying on gut feeling.
I run DECODE’s German office in Düsseldorf, and in client projects I regularly see how architecture decisions made five years ago turn into serious strategic risks today.
The test below is deliberately technical and practical. It’s not a compliance checklist, it’s a tool for the people who actually make architecture decisions.
Key takeaways
Digital sovereignty means your company can decide for itself which technology it uses, how it switches providers, and who has access to its data, instead of being locked into staying with a single provider.
The self-test covers four layers:
Cloud use alone isn’t the problem: dependency only becomes a strategic risk once switching providers is no longer realistic, because too much proprietary technology is built in.
Digital sovereignty means your company can decide for itself which technology it uses, how it switches providers, and who has access to its data, instead of being locked into staying with a single provider.
It’s about freedom of choice and the ability to act. Not giving up technology or cutting ties with US providers entirely.
The numbers show how closely this topic is now tied to day-to-day business. 90% of German companies now use cloud services, up from 81% a year earlier.
62% say they could no longer operate without cloud solutions. Sovereignty and cloud use aren’t mutually exclusive, but uncontrolled dependency and sovereignty are.
In practice, four layers determine how sovereign a company really is:
These are the same four layers we assess in every sovereignty check, and the self-test below covers each of them.
The self-test takes you through one layer at a time, with five questions per layer. Ideally, work through it together with your architecture or infrastructure team.
Answer each question as things actually are today, not how you’d like them to be. “Not sure” counts as no: if you can’t answer a question today, that’s a gap in itself.
At the end, you’ll see your score for each layer and the warning signs that point to high dependency.
Your result
Score by layer
Warning signs
A quick orientation, not an audit. "Not sure" counts as no, because a question you can't answer today is a gap in itself. Your answers stay in your browser. The Cloud Analysis looks at all four layers in depth.
Answer each question with yes or no, as things are today. "Not sure" counts as no. Count your warning signs (the questions marked with a flag) to see where you stand.
1. Infrastructure and operations
Where your workloads run, who operates the data center, and who has physical and administrative access.
2. Technology and stack
Which technologies keep your options open, and which lock you into one provider.
3. Data
Where your data is stored, which laws apply, who can access it, and who controls the encryption keys.
4. Governance
Contracts, audit rights, accountability, and an exit plan that holds up.
How to read your result
Cloud dependency becomes a risk the moment you no longer have a real alternative, not simply because you use a provider.
The difference between “we use AWS” and “we’re stuck with AWS, because switching would take months and cost millions” determines whether you can still negotiate or whether you’re just paying.
AWS, Microsoft Azure, and Google Cloud together hold 70% of the European cloud infrastructure market, a figure that held steady through 2024 and 2025.
At the same time, the European cloud market grew by roughly 24% in 2025, to more than €75 billion.
The market is growing fast, but the concentration around three hyperscalers hasn’t changed.
Dependency on US technology in Germany rose noticeably in 2025, it didn’t fall.
96% of German companies can no longer operate without importing digital technologies from abroad, and 89% of those see themselves as dependent, 51% of them “strongly dependent.”
That figure stood at 41% as recently as January 2025.
Trust is falling at the same time: 67% of companies source digital technology and services frequently from the US, yet only 38% trust the US as a technology partner.
To me, that gap between usage and trust is the real signal that sovereignty is no longer a theoretical topic. It’s a question boards and supervisory boards are actually asking.
Regulations are changing too. The EU Data Act requires cloud providers to progressively reduce switching fees between providers and eliminate them entirely by January 2027. Switching rights have already been enforceable since September 2025.
On top of that, Germany’s NIS2 implementation law has been in force since December 2025, bringing roughly 29,500 companies under the supervision of the BSI (Federal Office for Information Security), with fines of up to €10 million or 2% of global annual turnover for non-compliance.
Vendor dependency rarely costs you where you’d expect. The obvious costs are license fees and cloud bills.
The hidden costs show up when a provider’s proprietary services get built so deeply into your architecture that switching means starting over.
I’ve seen this often in modernization projects: a system built pragmatically on a single hyperscaler service years ago can’t be migrated without huge expenses a decade later, even though the business has clearly outgrown that infrastructure.
Yesterday’s decision becomes today’s constraint. That’s exactly what this self-test is designed to surface.
The most important first step is not just answering the questions in this test, but mapping the gaps to specific systems and contracts.
A warning sign on question 5, for example, translates into a concrete task: document exit clauses for every hyperscaler contract, rather than treating “more sovereignty” as a vague goal.
From our work with clients modernizing legacy systems or rebuilding cloud architectures, a few patterns have proven especially effective:
These steps can’t be implemented in a weekend, but you can start on them right away.
In the end, the difference between a company with few warning signs and one with many usually comes down not to budget, but to how consistently architecture decisions have been made over the years.
No.
Mid-sized companies are often more exposed, since they often lack a dedicated IT department managing a broad set of providers, and more often rely on a single platform.
Often yes, in the short term, because multi-cloud strategies and modular architectures take extra effort.
In the medium term, costs usually fall, because you regain negotiating leverage with providers and avoid hidden migration costs.
No. Sovereignty means freedom of choice.
Many digitally sovereign companies will still use US hyperscalers, but they’ve deliberately prepared alternatives and exit strategies should they become necessary.
If you’ve just worked through this test and hesitated on several questions, you’re not alone.
Most of the companies we work with discover gaps in exactly these spots, gaps that built up over years and can’t be closed overnight.
At DECODE, we help companies build architectures that preserve freedom of choice instead of limiting it.
That ranges from multi-cloud architectures that avoid vendor lock-in from the start, to gradually retiring proprietary legacy systems without putting your ongoing business at risk.
Our team in Düsseldorf and Zagreb has the architecture and contract experience behind this self-test. We write the code and run the migration ourselves.
And if you want to explore how we can help you be more digitally sovereign, feel free to reach out.
Miki leads our German branch, DECODE Services GmbH. He was born in Croatia, grew up in Germany, and brings a unique blend of both cultures to his work. With 30+ years of experience in both hardware and software, Miki’s built everything from early Android apps to enterprise-grade IoT systems. He’s one of the original contributors to Android’s developer community and has spoken at - and helped organize - droidcon conferences across Europe. These days, he’s deep into AI and IoT, working closely with industry leaders and helping them build innovative solutions. When he’s not working, you’ll probably find him hiking, mountain biking, or cooking a delicious meal with his family.
How to build security into your AI development workflow without slowing your team down. Controls, processes, and policies that actually work in practice.
Poor documentation costs engineering teams up to $2M a year. Here's what's actually driving that number and how to fix it without slowing your team down.
A practical guide to legacy software modernization for CTOs. Compare approaches, understand costs, and learn how to structure programs that actually succeed.
