Every year, French administrations spend approximately 1.5 billion euros with non-European software publishers. According to calculations by deputies on the parliamentary inquiry commission, one billion of that money could shift to open source today, without waiting for major legislative reform. This is not an energy bill, nor a debt incurred unwillingly. It is a voluntary purchase order, renewed year after year, with public funds, to the benefit of American suppliers that France says it wants to replace.
Among the fifty largest suppliers to the State, four out of five are American
Microsoft, VMware, and Oracle now occupy a central place in public information systems. Among the fifty main software suppliers to administrations, American players concentrate nearly 80% of purchases. In total, annual public spending on non-European solutions amounts to 1.5 billion euros.
This finding, established by the inquiry commission of the National Assembly published in July 2026, is not new. The national cloud strategy, launched in 2021 and meant to build a sovereign offering, consolidated the dominance of foreign infrastructure. Three years later, the same scenario repeats itself with artificial intelligence: the 109 billion euros announced in 2025 by President Macron to make France a “European leader in AI” rest on capital that is predominantly foreign—Emirati, Canadian, American, and Chinese.
The phenomenon is observable at all levels. The European cloud market reached 61 billion euros in 2024. European providers grew with it, to the point of doubling in size over the measured period.
Yet their share fell from 29% in 2017 to 15% in 2022, and has held around that level since. This decline is the result of faster growth by Amazon, Microsoft, and Google, which together account for 70% of the regional market. Europeans have more revenue in absolute value. They lost their relative weight, lacking investments capable of keeping pace with American hyperscalers.
Within the State, the situation is even more degraded. Only nine service providers today offer sixteen services qualified at the SecNumCloud level, and public procurement in cloud has reached only 52 million euros in 2024, a tiny fraction of the 3 billion euros in annual digital spending by the State. Two cloud infrastructures were furthermore developed by the State: Nubo (Ministry of Finance) and Pi (Ministry of Interior). Two infrastructures that prove costly (55 million euros invested over nine years) for use that is “far too low,” even by the ministries that created them.
The money spent to build an alternative remains marginal. State investment in these clouds is modest compared to the 350 million euros that OVHcloud alone devoted to its infrastructure in 2024. And OVHcloud itself bears no comparison to American hyperscalers.
Dependence is not only economic: it is legal
The problem is not merely a matter of market share. It is structural, and it worsens with geopolitics.
Since the American Cloud Act came into force in 2018, American authorities can demand access to data hosted by American companies, even if the servers are located in France or Europe. This risk is no longer theoretical: it reshapes the hosting choices of every organization that handles critical information.
The mechanism is simple to understand. The Cloud Act does not concern where the data is located. It concerns the company hosting it. If that company is subject to American law, its data, even stored in Europe, remains liable to end up in an American court proceeding.
In practice, for organizations in regulated sectors (healthcare, finance, public sector, defense), using a cloud falling under non-European jurisdiction represents a major legal, operational, and reputational risk. Storing French healthcare data with Microsoft, as the CNIL authorized in 2024, does not mean that data is beyond the reach of Washington authorities: even if the Council of State judged this risk acceptable in one specific case.
Stéphane Grumbach, research director at INRIA and author of The Empire of Algorithms (Armand Colin, 2022), posed the question more radically: algorithms constitute “a new mechanism for regulating society, which possesses the regulatory power of law, but also the executive power of implementation.” Delegating this mechanism to actors whose code, hosting, and governance one does not control is delegating part of public authority.
Vital functions of our economies, our administrations, our defense depend on digital solutions, primarily American, whose code, hosting, and governance we do not control. This concerns software, cloud infrastructure, cybersecurity, and technologies related to artificial intelligence. It is Gilles Babinet, France’s representative to the European Commission for digital affairs, who says this in 2025, without equivocation.
Public procurement law has neutralized the levers of strategic purchasing
Why does public money massively finance foreign suppliers, when stated policy is the opposite? The answer lies in the legal structure of public procurement.
Transposed with particular zeal into the public procurement code in 2019, the texts of the WTO Agreement on Government Procurement prohibit any industrial preference and deprive French companies of strategic outlets. The 200 to 400 billion euros in annual public procurement are thus managed within a legally neutralized framework, in which the logic of competition takes precedence over that of public authority.
The State now behaves as a buyer, not as a strategist: it outsources what it no longer knows how to design and purchases the dependence it claims to combat. The result is simple: public money finances the development of foreign digital giants.
Data from Ugap (the central public purchasing office) show that 79% of public software spending still went in 2025 to American publishers, compared to 81% in 2024, but with 20% growth in value year-on-year. The proportion barely drops; the total sum continues to swell. Administrations spend more in absolute value with American suppliers from one year to the next, while sovereignty rhetoric multiplies.
The European Union spends 264 billion euros annually, principally on proprietary American software and services. In contrast, the budget announced for the European open source strategy is one billion euros over seven years. Free software already represents approximately 10% of the European software and digital services market. The gap between words and budgets measures the real ambition.
Making Public Money Conditional on Code Control
The National Assembly’s inquiry commission put a concrete lever on the table: make open source mandatory in public procurement for administrations and public enterprises by January 1, 2030. And the European Commission sketched the same trajectory: its regulation on public procurement of cloud and artificial intelligence (called CADA) introduces a principle of “open source first” and an obligation: all software bought with public money must be made available for reuse, according to the principle “public money, public code.”
The lever is not a preferential rate, nor a bonus, nor an additional label. It is a change in who decides: public procurement law today creates an obligation of technological neutrality that de facto forbids any industrial strategy. Making open source enforceable in public procurement means changing the legal architecture of the State’s digital spending: who decides the criteria, on what basis a supplier is chosen, and what “economically advantageous value” means when one integrates the costs of dependence and extraterritoriality.
Concretely, the National Assembly proposes an obligation for open source in public procurement by January 1, 2030 (including AI tools), with institutions and dedicated funding for the maintenance of critical components. The report makes open source and digital commons the infrastructure of a sovereignty policy, no longer merely an alternative to encourage.
The budget at stake is identified. Administrations would spend at least 1.5 billion euros annually on non-European software, of which one billion could shift to open source today. This billion is not an investment to find: it is spending already inscribed in budgets. The question is who it benefits: French and European digital ecosystems, or actors whose extraterritorial jurisdiction we undergo elsewhere.
The architectural change is known: after this shift, each euro spent on licenses conditions the existence of a supplier on which the State can exercise public control. The alternative is to continue financing, with public funds, the dependence one claims to reduce.
Sources
[1] Court of Audit, “The Sovereignty Challenges of Civil State Information Systems,” report, October 31, 2025, https://www.ccomptes.fr/sites/default/files/2025-10/20251031-S2025-1479-Enjeux-souverainete-des-SI-civils-de-l-Etat.pdf (accessed 10/10/2026).
[2] National Assembly, Inquiry Commission on Structural Dependencies and Systemic Vulnerabilities in the Digital Sector, report no. 3054, July 8, 2026, https://www.assemblee-nationale.fr/dyn/17/rapports/cenum/l17b3054_rapport-enquete (accessed 10/10/2026).
[3] Synergy Research Group, quarterly data on the European cloud market, series 2017–2024, cited in various sectoral sources (Usine Digitale, IT Social, 2022–2024).
[4] ARCEP, “The State of the Internet in France, Annual Report 2025,” volume 3, July 2025, https://www.arcep.fr/uploads/tx_gspublication/ARCEP-RA2025-TOME_3-Norme_A.pdf (accessed 10/10/2026).
[5] ARCEP, Annual Report 2026 (press release), https://www.arcep.fr/fileadmin/cru-1789736418/user_upload/42-26-version-francaise.pdf (accessed 10/10/2026).
[6] CNLL / National Council for Free Software, “European Open Source Strategy: The Commission Raises Its Level of Ambition,” July 2026, https://cnll.fr/news/oss-strategy-2026/ (accessed 10/10/2026).
[7] Stéphane Grumbach, The Empire of Algorithms: A Geopolitics of Control in the Age of the Anthropocene, Armand Colin, Objectif Monde collection, May 2022.
[8] Gilles Babinet, “The Digital Economy and AI: New Issues of Sovereignty and Geopolitics,” Financial Economics Review, no. 160, 2025/4, https://shs.cairn.info/publications-de-gilles-babinet–142681 (accessed 10/10/2026).
[9] Council for AI and Digital Affairs, “Digital Sovereignty: The Urgency of Organizing Public-Private Cooperation and Digital Commons,” report, 2026, https://www.conseil-ia-numerique.fr/files/uploads/2026/Souverainete%CC%81%20nume%CC%81rique_De%20l’urgence%20d’organiser%20la%20coope%CC%81ration%20public%20prive%CC%81%20et%20communs%20nume%CC%81riques.pdf (accessed 10/10/2026).
[10] DINUM (Inter-ministerial Directorate for Digital Affairs), “The State Accelerates Its Cloud Transition and Turns to Sovereign European Offerings,” 2026, https://www.numerique.gouv.fr/sinformer/espace-presse/etat-transition-cloud-offres-europeennes-souveraines/ (accessed 10/10/2026).
