France Is Moving 2.5 Million Desktops to Linux. The Data Behind Them Still Sits on AWS.

In April 2026, France's interministerial digital authority, DINUM, told every government ministry to submit a plan for moving desktop computers off Windows and onto Linux. The number attached to that instruction was roughly 2.5 million machines. Six weeks earlier, a consortium of European software companies had forked OnlyOffice into a new project called Euro-Office, framed explicitly around the same goal: digital sovereignty. Denmark, the German state of Schleswig-Holstein and the Austrian armed forces have made comparable moves over the past eighteen months. Read together, 2026 looks like the year Europe finally acted on a dependency problem it has talked about for a decade. Read layer by layer, all five moves changed exactly one thing: the software running on the desktop.

What actually moved

• France: DINUM instructed every ministry to plan a Windows-to-Linux migration across an estimated 2.5 million desktops, with implementation timelines due by autumn 2026.
• Denmark: several ministries began replacing Microsoft's desktop office suite with open-source alternatives starting in mid-2025.
• Germany: the state of Schleswig-Holstein completed a state-wide replacement of Microsoft Office with LibreOffice.
• Austria: the armed forces finished a full exit from Microsoft's office software.
• Europe-wide: Nextcloud, IONOS and Proton, joined by Eurostack, XWiki, OpenProject, Soverin, Abilian, BTactic, OpenXchange and Office.eu, forked OnlyOffice on 27 March 2026 and shipped a stable release, Euro-Office, on 9 June, marketed explicitly as a sovereign alternative to Microsoft 365's desktop apps.

Every one of these is a funded, staffed migration, not a press release with no budget behind it. But notice what's constant across all five: an employee's screen changes. What happens to the file five seconds after they hit save does not.

The desktop is the cheap layer, and it still isn't cheap

Swapping an office suite is a procurement line and a training programme. Swapping the cloud contract behind a ministry's email, identity and document storage means renegotiating agreements that, in most European public administrations, still run through a Microsoft Enterprise Agreement or an AWS or Azure reseller, wired into Active Directory and single sign-on integrations built up over fifteen or twenty years. The desktop is the layer with the fewest dependencies attached to it, which is exactly why six different governments and consortia picked it first.

It's also the layer that has already gone wrong once, expensively, in Europe. Munich spent thirteen years, from 2003 to a nominal 2013 completion, migrating around 15,000 municipal desktops to a custom Ubuntu-based distribution called LiMux. In November 2017 the city council voted to reverse the migration and return to Windows, citing compatibility complaints from external partners; the projected cost of that reversal was about €49.3 million, covering licences and hardware for more than 30,000 workstations. France's 2026 plan covers roughly 150 times as many desktops as Munich's original project. If the layer everyone agrees is the easy one can produce a €49 million U-turn at a fraction of that scale, that's a reason for humility about how quickly the harder layers move, not a reason to skip past them.

The layer nobody's forking

European cloud spending still runs overwhelmingly through the same three American companies that dominate the rest of the world. Recent market tracking puts AWS at roughly 28-29% of the European cloud infrastructure market and Microsoft Azure close behind at around 27%, with Google Cloud near 15%; the five largest providers together hold about 51% of the region. None of the five moves above touch this layer.

Amazon has answered the sovereignty pressure directly, standing up a dedicated European Sovereign Cloud entity, based in Brandenburg, Germany and staffed by EU residents, which began operating in 2025. Microsoft and Google have built comparable EU-resident entities for Azure and Google Cloud. What none of the three changed is ownership: each sovereign entity remains a subsidiary of a US parent company. Legal scholars are split on whether that structure is enough to keep a US court order issued under the CLOUD Act from reaching data these entities hold; the companies maintain it is. A Cloud Security Alliance research note published this year takes the more cautious position, arguing that the concentration itself, three companies holding the majority of a continent's compute regardless of the legal wrapper around any one region, is the risk regulators should be pricing in.

Concentration risk isn't abstract, and it isn't unique to Europe. On 3 September 2026, a regional failure inside Microsoft Azure's East US infrastructure took ChatGPT, Claude and Grok offline at the same time for about 90 minutes, generating more than 37,000 outage reports, three chatbots marketed as competitors, briefly dependent on the same cloud backbone. A European sovereign-cloud entity built on the same hyperscaler's architecture inherits a version of that correlated-failure risk along with everything else it inherits, sovereignty branding included.

Digital sovereignty has three meanings, and 2026 mostly moved one

Most coverage of Europe's 2026 sovereignty wave treats sovereignty as a single property a system either has or doesn't. It's really three separate questions, and they move at different speeds.

• Data residency: where the bytes physically sit. Largely solved already — every major hyperscaler has offered EU-based regions for years.
• Legal jurisdiction: which country's courts, subpoenas and intelligence-collection laws can compel access to that data regardless of where it sits. Barely addressed by any 2026 initiative; still governed by the nationality of the parent company holding the infrastructure, not the postcode of the data centre.
• Operational control: who can patch, audit, throttle or shut off the software, and whether that entity ultimately answers to a European regulator instead of a foreign one. This is what a Linux desktop and a forked office suite actually buy, and only at the application tier.

The initiatives making 2026's headlines sit almost entirely in the third bucket, on the one tier where operational control is cheapest to demonstrate.

Europe's 2026 sovereignty scorecard, by layer

Rows three through five aren't unmovable. OVHcloud and Scaleway are cloud providers that are European-owned outright, not just European-hosted, and both already sell public-sector-grade infrastructure. What's missing isn't the alternative, it's public contracts large enough to move their combined market share out of the single digits. The same is true of identity: European alternatives to Entra ID and Google Workspace exist in smaller form, but no government has yet run a 2.5 million-seat migration through one of them the way France is now doing for desktop Linux. Semiconductors are the hardest row on the table: the EU Chips Act has pushed European fabrication capacity up from a low base, but Europe's share of global chip output is still a low single-digit percentage, and the machines running Euro-Office or Linux desktops will keep shipping with TSMC- or Samsung-fabricated silicon inside them for the foreseeable future, whatever operating system boots on top of it.

What the next check-in should measure

The practical test for any organisation evaluating a vendor's sovereignty claim in 2026 isn't which country the logo is registered in. It's which of the three problems, residency, jurisdiction or operational control, that vendor's contract actually solves, and whether the other two are quietly assumed away in the small print. France's ministries will know by autumn whether their Linux plans survive contact with two decades of Active Directory dependencies. The cloud contracts sitting underneath those same ministries aren't up for renewal on the same timeline, and as of September 2026, nobody's forking those yet.