Malta's public administration runs on a digital infrastructure built outside Europe. Government office automation is foreign. The state cloud is foreign. School systems are foreign. The platforms on which the State operates sit on infrastructure controlled from the United States. For two decades, that has been a procurement question. It is no longer one. It is a sovereignty question, and I want to make the case for the distinction.

In the early 2000s, Malta aligned its digital policy with the eEurope Action Plan. The government assessed open-source software for office automation and server operating systems. Pilot deployments were underway. The government then signed an enterprise-wide agreement with a leading global provider. The choice was framed as industrial policy. The objective was to anchor a major technology ecosystem in Malta, support a nascent ICT sector, and attract foreign investment.

The context mattered. The transatlantic relationship was stable. US technology providers were understood as commercial actors within that framework. Scale, integration, and reliability carried weight. The leading providers offered all three. The architecture itself was not contested ground.

That assumption was rational. Most European governments made the same choice for the same reasons.  Ireland built the most aggressive version.  Google, Meta, Microsoft, Apple - their European headquarters and operational centres are in Dublin. The Maltese position was a smaller version of the same pattern. Over time, that pattern produced a deeply integrated digital environment built on technologies developed and operated outside Europe.

That premise no longer holds. Not the technology. Not the contracts. The external environment within which those technologies operate is no longer stable in the way it was assumed to be.

The shift is visible in the behaviour of the United States. Tariffs have been used as an instrument of policy against European states throughout 2025. Sectoral measures hit the European Union as a bloc - steel, aluminium, automobiles, and other categories. Eight European countries faced pointed tariffs in pursuit of the annexation of Greenland, as Politico reported in January 2026.  The United States, with Israel, then launched military action against Iran in February. European NATO allies were not consulted.  As Politico reported on 24 April 2026, a leaked Pentagon email sets out specific retaliatory measures against allies who declined to participate.  The proposed suspension of Spain from NATO is one of them.

The relevance to digital infrastructure is direct. The infrastructure providers - Microsoft, Amazon, Google - operate under contract.  They have stated their commitment to honour those contracts.  EU data residency offerings now exist. Microsoft's EU Data Boundary, AWS's European Sovereign Cloud, and similar arrangements limit operational access.  Data is stored within Europe.  None of this changes the corporate jurisdiction of the parent company.  Under US law, including the CLOUD Act of 2018, US authorities can compel a US-incorporated provider to act on data regardless of where it is physically held.  The risk is not that the providers will not honour their contracts.  The risk is that the US administration may compel them to act in ways that override that commitment.

The mechanism is no longer theoretical.  As Politico reported in "The problem with Europe's Big Tech breakup" (20 April 2026), the United States sanctioned the International Criminal Court's Chief Prosecutor Karim Khan.  He reportedly lost access to his Microsoft account.  Months later, ICC Judge Nicolas Guillou received the same treatment. Judge Guillou described the experience as "a kind of civil death." The tools had not failed. The systems had been interrupted through the application of state power.

This is the distinction I want to name. The risk is not technical failure. It is jurisdictional exposure.  The capability exists. It has been exercised. It sits within a broader shift in how state power is being applied.

European states have begun to respond. The German state of Schleswig-Holstein has become the first European jurisdiction to exit the US stack fully. Fifteen million euros saved in licensing costs against nine million invested in the transition. Amsterdam is taking a slower three-stage path to 2035.  At the Berlin summit in November 2025, as Politico reported in "Germany wakes up to US tech dominance" (19 November 2025), Chancellor Merz and President Macron publicly aligned.  Dependencies, in Merz's phrase, are "being used for power politics."

Transition is complex. Systems are embedded. Skills are aligned to existing platforms. These are real constraints.  They are not a reason to avoid direction.  The argument that decoupling is too difficult to attempt is the one most likely to be made. It is also the weakest. Difficulty does not remove exposure.

It defines the scale of the task.

The premise that shaped Malta's digital architecture no longer holds. The European response is in its first chapter.  The architecture of European digital sovereignty is being drawn now, by Member States acting in coalition. Malta has the opportunity to take its place at that table. To help shape the architecture rather than inherit it. To act on the same timetable and as part of the same coalition as those who have begun.

The dependency is also extending into a new layer. Artificial intelligence is now reshaping what digital sovereignty means. That is the subject of a second piece.

David Spiteri Gingell is a Governance, Institutional, and Digital Transformation Consultant

This is the first of a three-part article. The remaining parts will be published over the next two weeks.