France Is Turning Digital Sovereignty Into a Three-Year Buying Conversation

France has created a three-year forum between the state and its digital industry to shape what government buys, tests and learns. The Digital and AI Pact, signed on 10 September, covers cybersecurity, artificial intelligence and cloud services. It will be led by the interministerial digital directorate, DINUM, as that body develops into the state’s reference authority for AI and digital services.

The pact starts from a strategic concern: government depends on technologies whose data handling, operational control and legal exposure may sit outside France or Europe. Its response is not a single procurement or a list of approved products. It is a recurring process for identifying state needs, mapping domestic and European capabilities, defining standards and testing solutions before they are deployed.

That distinction matters. Sovereignty is often described through ownership or origin. Public digital capability depends on more: whether a service can be operated, audited, secured, repaired and replaced under conditions the state can control. A French headquarters is relevant, but it does not by itself establish control over code, infrastructure, support, data or upstream dependencies.

Demand definition comes before supplier support

The pact’s most promising feature is that it begins with government demand. Public institutions can weaken a domestic market when each buys separately, describes needs differently or asks suppliers to meet incompatible security requirements. A common view of priority capabilities can create a clearer route from product development to public use.

The initial working groups are concrete: collaborative office software, AI-assisted penetration testing and software for securing critical infrastructure. These subjects expose different problems. Office tools must work across large organizations and everyday workflows. Penetration-testing systems must be trustworthy even when they simulate hostile behavior. Critical-infrastructure software must perform under operational constraints where failure can interrupt essential services.

Testing those products with public users can reveal gaps that a generic industrial strategy misses. It can show where interfaces fail, where security claims cannot be verified, where migration costs are prohibitive and where a promising tool lacks the support capacity required for national deployment.

The procurement boundary is essential

The French government states explicitly that participation does not prejudge public-procurement procedures or grant privileged market access. That safeguard is more than legal hygiene. The pact will lose credibility if co-development becomes a closed route to contracts, or if sovereignty criteria shield weak products from competition.

The harder task is to translate what the groups learn into requirements that can be competed fairly. Specifications should describe the operational outcome the state needs: control over sensitive data, verifiable security, continuity of service, portability, incident response and freedom from unacceptable extraterritorial dependence. They should not be written so narrowly that only a participant in the conversation can bid.

The pact is open to French firms that meet conditions on headquarters, industrial capability, extraterritorial legal dependence and alignment with sovereignty objectives. Those filters define who may join the work. Procurement still has to determine which solution offers value, security and performance.

A digital industrial base needs more than prototypes

France wants to create a digital industrial and technological base analogous to the defense industrial base. The comparison is ambitious. Defense capability rests on long-term demand, specialist skills, protected knowledge, testing institutions, supply-chain visibility and the ability to maintain equipment for years. A similar digital base will need dependable revenue and operating depth, not simply successful demonstrations.

The three-year duration gives the pact time to develop that evidence. Its groups can be changed or stopped if results do not justify continuation. That creates a useful discipline, provided the criteria for success are visible. Government should report which needs were defined, which standards were produced, what was tested, why products advanced or failed, and whether any solution could compete through normal procurement.

The pact has created a conversation with a route toward deployment. It has not yet created sovereign capability. That will emerge only when public organizations can choose secure, interoperable products that work at scale and can be sustained by firms able to survive beyond the pilot. France’s next digital dependency will be reduced through purchasing power and operating competence, not through the language of sovereignty alone.