By Paul Allard, CEO, Persevere Consulting Inc. — March 31, 2026
Digital sovereignty has become a strategic priority for governments. A recent analysis by NextHop, "French Digital Sovereignty: Structural Dependencies and Governance Deficits (2014–2026)", sheds light on the challenges of France's trajectory. By confronting these lessons with Quebec's Policy Statement on Digital Sovereignty and IT Procurement, this article proposes a pragmatic roadmap for Quebec — and, by extension, Canada.
The French Lesson in Brief
The NextHop analysis synthesizes more than a decade of French initiatives and identifies four recurring challenges:
- Persistent dependence on global vendors
- Fragmented governance
- Difficulty industrializing a competitive sovereign offering
- Slowness in building robust operational capacity
Despite ambitious projects — so-called "sovereign" clouds, open-source promotion, public funding — France suffers from fragmented ministerial responsibilities, dispersed oversight, and a local market not yet mature enough to compete on cost/quality with hyperscalers.
Positive French Examples
It is important to highlight positive initiatives, such as the GendBuntu project of the French National Gendarmerie. This Ubuntu adaptation deployed an open-source operating system on 73,000 workstations across 4,300 sites, generating estimated savings of €9 million per year on license costs.
In another significant recent advance, 80,000 Assurance Maladie agents are now switching to state-developed digital tools — reducing dependence on private companies for essential public-service solutions. This shift marks a decisive step toward enhanced digital autonomy that should inspire other sectors and countries.
A Useful Reference: The German Example
Germany illustrates a pragmatic, regulatory approach to steering its ecosystem toward open and sovereign solutions. The federal government has mandated ODF (Open Document Format) as the preferred format for public administration and is pushing open source as the default option, while structuring a "Deutschland Stack" centered on national and open components.
This strategy combines normative prescription (formats, interoperability), open-source support, and the progressive construction of a local ecosystem. The German example shows that clear regulatory measures, combined with support programs, can accelerate the adoption of sovereign offerings while preserving interoperability.
The Public Demands Digital Sovereignty
Digital sovereignty is now a major reputational lever for public organizations. However, there is a gap between this public expectation — which demands an immediate break from technological dependence — and the operational reality where the vast majority of institutions remain dependent on foreign tech giants.
This tension is illustrated by the recent controversy surrounding Quebec's Ministry of Natural Resources and Forests, criticized for awarding a cloud contract to Amazon — a choice that appears to directly contradict a Treasury Board directive. The risk is twofold: beyond technical vulnerability, political credibility erodes when commitments to sovereign digital infrastructure clash with procurement practices that still favor foreign hyperscalers.
Why This Matters for Quebec
Quebec's Policy Statement adopts an approach close to French concerns: sovereign hosting (Quebec Government Sovereign Cloud — NGSQ), open-source promotion, deployment of a Modern Development Platform (PDM), and maximization of local economic benefits.
Quebec has real advantages — clean and competitive energy, university research centers, a growing AI ecosystem, 2 Turing Prize winners — that can support an effective sovereign strategy. However, the challenges observed in France serve as warning signals: without strong governance, clear prioritization, and coherent industrial instruments, policy risks translating into dispersed, costly, and unsustainable efforts.
Proposed Roadmap for Quebec: Six Priorities
1. Strong, Results-Focused Governance
Create an inter-ministerial steering body, chaired by the MCN, with a clear financial and operational mandate. This body will define priorities, allocate resources, and publish public KPIs — share of critical data hosted locally, number of services migrated to the NGSQ, average vulnerability remediation time — with quarterly reviews and annual audits.
2. Prioritize by Criticality and Phase Migrations
Classifying services and datasets by criticality level (confidential, sensitive, public) enables orderly prioritization: focus first on services essential to national security and citizen services, then expand progressively. This strategy avoids resource dispersion and enables rapid, tangible results.
3. Robust Procurement Conditions and Contractual Clauses
Require exit clauses, data flow traceability, prohibition on replication outside jurisdiction without authorization, audit rights, and key management on Canadian soil. These clauses must be accompanied by active support (tax incentives, grants, R&D co-financing, skills transfer) to enable the emergence of competitive local offerings — following the German logic of combining rules and incentives.
4. Industrialize the Local Ecosystem (Sovereign Stack)
Fund a "sovereign stack" composed of reusable modules (PDM), identity services, key management, containerized platforms, and sustainably maintained open-source components. Economically supporting open-source solution developers, operators, and local integrators avoids creating a "cobbled-together" offering unable to compete on maturity and security.
5. Build On-Site Operational Capacity
Beyond infrastructure, what is needed is: SOCs (Security Operations Centers) and CSIRTs (Computer Security Incident Response Teams) operated from Canadian territory, key management and encryption under Canadian jurisdiction, and locally required disaster recovery (DR) and business continuity (BCP) plans. So-called "sovereign" infrastructure is only credible if the government controls operations and incident response.
6. Pragmatic, Temporary, Conditional Incentives
Targeted incentives (grants for SME migration to the NGSQ, tax credits for open-source R&D, mentoring between large enterprises and SMEs) must be temporary and conditioned on measurable results (skills transfer, job creation, local market share). Temporary public procurement quotas or preferences can help reach critical mass, with a clear timeline.
Timeline and Success Indicators
- 0–6 months: Creation of the steering body, initial classification of critical assets, KPI publication.
- 6–18 months: Pilot migrations of most critical services to the NGSQ/CTI, first wave of sovereign stack funding, standardized contractual requirements.
- 18–36 months: Operational SOC/CSIRT, PDM modules in production, measurable growth of local offering.
Example indicators:
- > 60% of "critical" data under QC/CA jurisdiction within 3 years
- Average critical vulnerability remediation time < 30 days
- Annual net job creation in the qualified sovereign digital industry
Conclusion
The French experience shows that digital sovereignty is not decreed through isolated projects: it emerges from unified governance, a coherent industrial strategy, intelligent public procurement, and real operational capacity. The German example reminds us that a clear normative framework (open formats, open-source-by-default policy) combined with practical support can accelerate the transition.
Quebec has real assets and a structured Policy Statement; it must now transform these directions into rigorous execution: central governance, coordination with the local sovereign digital industry, criticality-based prioritization, coordinated contractual and financial instruments, industrialization of the local offering, and concrete operational capabilities.
Acting quickly, publicly measuring progress, and continuously adjusting strategy will avoid repeating the mistakes observed elsewhere and achieve credible, durable digital autonomy.
Disclaimer: AI contributed to the drafting of this article, but it was guided, reviewed and fact-checked by Persevere Consulting's human experts. The content is for general information purposes only and is not legal or management advice.