FAQ: How to bring sovereignty to digital trust? 7 key questions answered

Digital sovereignty is becoming a practical issue for a growing number of companies in the European Union. Against a backdrop of new geopolitical realities and pressure on global supply chains, many are looking for European alternatives for essential software. The need for action is particularly urgent when it comes to trust services that enable identification, authentication, electronic signatures, and more. We have compiled the 7 most important questions that companies should now be able to answer:

How is digital sovereignty defined?

According to Wikipedia, “digital sovereignty […] is the concept that a state, organization, or individual should possess meaningful control over the digital infrastructure, data, hardware, and software upon which it depends.” The European Commission frames it as Europe's capacity to act independently in the digital world by developing and controlling key technologies, data, and infrastructure while reducing reliance on non-European providers. Importantly, this does not mean technological isolation or complete self-sufficiency. The focus is more on reducing critical dependencies and remaining resilient when geopolitical, economic, or technological conditions change.

Why does it matter now?

In recent years, geopolitical tensions have increased significantly, while many technology sectors remain highly dependent on US or Chinese suppliers. As a result, European companies are looking for alternatives. The EU has also addressed this situation by taking initial practical steps to foster greater autonomy in the tech sector. The Commission presented its Technological Sovereignty Package on 3 June 2026, covering semiconductors, cloud and AI, open-source technology and the digitalization of the energy system. In April 2026, the Commission awarded a €180 million contract for sovereign cloud services for EU institutions under its new Cloud Sovereignty Framework, and it ran a consultation on safeguarding EU data sovereignty until 15 September 2026.

What are its implications for digital trust?

Sovereignty and trust are closely linked but not the same thing: sovereignty is about who controls digital infrastructure, where data is stored and processed, and which laws apply; trust is about whether users, businesses and governments can depend on a service to be reliable, transparent and accountable. Heavy dependence on providers outside Europe can weaken trust by raising concerns over jurisdiction, data access, cybersecurity and supply-chain disruption. But sovereignty alone does not automatically create trust either: a European-owned provider still has to prove it protects data, maintains strong cybersecurity and operates transparently. In practice, sovereignty and trust reinforce each other in a cycle: sovereignty creates the conditions for trust, and trust is what makes sovereign infrastructure usable and sustainable.

What are the risks for companies in terms of lacking sovereign trust services?

For example, a European company relying on an overseas provider for signatures, seals, certificates, and digital identities can be caught out if geopolitical tensions lead the provider's home jurisdiction to compel cooperation with its authorities (comparable to the US CLOUD Act), creating a conflict with the provider's European obligations. Even though the trust service stays under European supervision, part of its control structure and infrastructure sits outside EU jurisdiction, limiting what European authorities can do about it.

Consequences range from customers doubting the confidentiality of their data to restricted access to critical systems or unavailable software. In the most extreme case, the provider may be unable or unwilling to keep serving European customers.

Are there any mandatory requirements?

Although there is no explicit EU sovereignty legislation in place yet, trust service providers operating in Switzerland and the EU are already subject to clear regulations and mandatory audit procedures – eIDAS in the EU and ZertES in Switzerland – with liability clearly defined. Several newer requirements add to this baseline: under the so-called “eIDAS 2.0” (Regulation (EU) 2024/1183), every EU member state must offer a certified EU Digital Identity Wallet by the end of 2026, with mandatory private-sector acceptance following from the end of 2027. The NIS2 Directive makes cybersecurity risk-management and incident-reporting obligations mandatory for trust service providers regardless of their size, and its Article 24 specifically encourages essential and important entities to use qualified trust services.

What are the key technical components of a sovereign infrastructure that uses Digital Trust services?

The main criteria that define a sovereign TSP are:

transparent European ownership and control structure
jurisdictional independence, i.e. clarity on which jurisdictions could legally compel the provider to disclose information or alter its services
local infrastructure and operations, including knowing who generates, stores and controls the cryptographic keys
supply-chain transparency across cloud providers, hardware, software and subcontractors
strong cybersecurity backed by recognized certifications and independent audits
credible continuity and exit arrangements for geopolitical disruption, sanctions or supplier failure
long-term strategic resilience, since a trust service is typically used for many years and sovereignty should be assessed as an ongoing dependency risk rather than a one-off procurement check

How can Swisscom help you build sovereign infrastructure?

Swisscom Trust Services is a qualified trust service provider under both eIDAS and ZertES, and a wholly owned subsidiary of Swisscom, Switzerland's leading telecommunications company – giving it a transparent, Swiss/European ownership and control structure. It supports organizations across Switzerland and the EU with electronic signatures, electronic seals, timestamps and digital identification, helping partners implement cross-border digital business solutions without media disruption while ensuring full digitization and legal compliance. Its embedded remote signature platform, Smart Registration and Signing Service, lets partners quickly implement user-friendly e-signature and e-seal processes tailored to industry-specific requirements, while the included Multiple Authentication Broker supports registering authentication methods and identifying users without additional audits.

Want the full picture? Download our new whitepaper on sovereignty in trust services for free!

Customer success stories

Customer success stories

FAQ: How to bring sovereignty to digital trust? 7 key questions answered

How is digital sovereignty defined?

Why does it matter now?

What are its implications for digital trust?

What are the risks for companies in terms of lacking sovereign trust services?

Are there any mandatory requirements?

What are the key technical components of a sovereign infrastructure that uses Digital Trust services?

How can Swisscom help you build sovereign infrastructure?

Latest Blog Articles

FAQ: How to bring sovereignty to...

Why sovereignty is crucial for real...

A valid digital signature alone is...

The true cost of manual back-office...