Resource Regions: Western Europe

Given all the geopolitical and economic upheavals so far seen in 2025, concerns about U.S. tech dominance, and fear of services from (non-European) IT providers being withdrawn as a result of government executive orders, the big question we keep hearing in Europe is “What is Plan B”?

I can answer that.

Firstly though, it should be noted that Europe’s interest in digital sovereignty has always been high. Now, as geopolitical tensions escalate and regulatory uncertainty deepens, many organisations on the continent see this as a strategic imperative.

But…

Geopolitical risk has typically been a low-ranking market driver for those seeking sovereign solutions in Europe. Sure, IDC’s 2025 Worldwide Digital Sovereignty Survey shows that this has climbed up the rankings, now attracting more than a quarter of responses compared to last year when it was slightly less and even coming bottom of the list of drivers as it has done so in the years prior to 2024.

What’s more revealing is that Europe now has a new top sovereign cloud market driver: protection against extra-territorial data requests.This reflects growing anxiety over foreign access to sensitive data and a clear signal that sovereignty is no longer just about compliance and control, but has a greater focus on autonomy.

The European provider’s response: “Plan B”

In what can be regarded as a largely unprecedented move, Europe’s service providers have reacted swiftly and have taken a proactive approach, joining forces to offer what they consider to be the “alternative” (and many also promote the idea of services, platforms and providers that can be labelled as “Made In Europe”).

Some examples here include EuroStack, which calls for a Europe-led digital supply chain spanning chips, cloud, AI and digital governance; virt8ra (pronounced virtoora), which is billed as Europe’s first sovereign edge cloud; and the EU-funded Sovereign European Cloud API (SECA) which is available to all European cloud providers for cloud infrastructure management.

These initiatives reflect a broader push to reclaim digital autonomy and reduce dependency on non-European tech giants.

The global cloud providers’ response: committed to Europe

The global cloud providers have not been standing still. And of course, none of them are about to walk away from their highly successful business operations in Europe.

In recent months, several big name providers, such as Google and Microsoft, have enhanced their sovereign offerings to emphasize how sovereignty and U.S. big tech can work provided the right controls and partnerships are in place.

And clearly, just as the global cloud providers are not planning to abandon Europe, Europe is not planning to abandon them.

For instance, despite all the media hype earlier this year around German authorities “ditching” Microsoft in favour of their own home-grown solutions (in June 2025, the German state of Schleswig-Holstein rolled out the OpenTalk videoconferencing solution, developed by Berlin-based Heinlein Support, across all state agencies), partnerships with U.S. providers continue to be announced.

These include the German Federal Office for Information Security’s (BSI) strategic cooperation agreement with AWS in the run-up to the launch of the AWS European Sovereign Cloud in Germany later this year.

Separately, the BSI has also teamed-up with Google Cloud to support the development and deployment of secure and sovereign cloud solutions for government agencies, including the German military that will use an air-gapped version of Google distributed cloud.

IDC’s response: Techxit? What techxit?

Despite their increased interest in sovereign solutions due to all the geopolitical turmoil, just 4% of European organisations say they plan to stop using cloud services and platforms from global public cloud vendors and only partner with local cloud providers.Thus, reports of ‘techxit’ – the prospect of U.S. providers being forced out of Europe for whatever reason – are greatly exaggerated.

Instead, the dominant strategy is staying “glocal”: combining global innovation with local control by using both global and local providers, and many organisations in Europe say they will continue to depend on global cloud vendors.

What’s more, the idea of a full-scale “techxit” remains impractical, given the deep integration of global technologies in European IT environments.

Of course, it would be naïve to think that buyer expectations have remained unchanged in 2025 – far from it.  The expanded interest in digital sovereignty in Europe is expected to account for a decrease in organisations using sovereign cloud from not only global providers but also their local counterparts, with managed providers seeing a slight increase. The changes here are not huge but significant enough for all providers to take not.

What all providers need to consider

To succeed in this evolving landscape, cloud providers must:

• Offer verifiable protections against extra-territorial data access
• Prioritize network sovereignty, including data in transit
• Invest in AI governance and compliance-first infrastructure
• Build regional partnerships to meet local expectations
• Embrace open standards to support interoperability and avoid vendor lock-in

So what is “Plan B”?

IDC has long maintained that a trusted ecosystem of partners is needed for sovereignty to work at scale, and we believe this should include a combination of using global and local providers.

For the global cloud players that means looking for the right regional and in-country partners to help boost local credibility and to deliver local services, local expertise and leverage local knowledge.

For the local service providers, it means partnering with global players to help deliver innovation and scalability.

And then the global SaaS providers need to be able to work across both to develop and deliver customized offerings within sovereign frameworks.

Europe’s vision for digital sovereignty is not about isolation — it’s about balance. The goal is to level the playing field, reduce dependency, and ensure that the continent can compete globally while retaining control locally.

Ultimately it’s about the sovereign aspect of digital self-determination and survivability and self-sufficiency. The latest geopolitical uncertainties indicate a recalibration of Europe’s cloud market, not a rejection of global providers.

So what’s Plan B? Our advice to organisations in Europe seeking sovereign solutions is to stick to Plan A.

For more information and to see what Rahiel is covering, look here: Digital Sovereignty. 

Got a specific question? Drop it in here.

The deadline for the transposition of the EU’s second Network and Information Systems Security directive (NIS 2) came and went in October 2024 with only a handful of member states having completed the task. As it became clear that this was not just a minor case of not submitting the paperwork on time, the European Commission (EC) swung into action, initiating infringement proceedings against 23 member states in November 2024, with those countries given until January 2025 to provide updates on their progress or demonstrate that they had achieved compliance. Only Belgium, Croatia, Italy, and Lithuania escaped the wrath of the Commission.

Changes

Through the first half of 2025 the picture gradually changed, although decisive numbers depend on the interpretation of what it means to be compliant. In May 2025, 19 member states were on the receiving end of another ultimatum from the EC. However, by July 2025, the list of countries that had enacted laws on the implementation of NIS 2 had swelled to 14 states, with Cyprus, Denmark, Finland, Greece, Hungary, Latvia, Malta, Romania, Slovakia, and Slovenia joining the first four countries noted above. Denmark, Finland, Hungary, Latvia, and Slovenia were the countries with the dubious honour of having transposed the directive but still making the EC’s naughty list. The nuance is that countries not only have to transpose the law, they also have to provide full notification of all applicable legislation to the Commission.

Note that EC saber-rattling is not confined to NIS 2: the Commission provides a monthly list of its infringement decisions and recent iterations have included calls around energy legislation, emissions trading, corporate sustainability reporting, and more.

It’s also worth looking at why some of the non-compliant states have not made the required progress. In several cases, the countries in question have gone through changes in government, often multiple times. In Portugal, the government has toppled three times in three years, most recently in March 2025. Germany’s elections in February 2025 meant that all pending legislation either had to be reintroduced or was put on hold. The collapse of the Dutch government at the beginning of June 2025 further set back a process that was already behind schedule.

Legislative processes are complex and any disruption can lead to delays both initially and then further down their carefully calibrated calendars.

Under pressure

What does this mean for all the organizations covered – or likely to be covered – by the Directive? How should a company with operations in 10 EU member states, for example, build its compliance strategy and roadmap if 5 of those member states have transposed the Directive and 5 have not? The legislation is already extensive and complex enough without such additional uncertainty layered on top.

Uncertainty impacts organizational planning. According to IDC’s 2025 EMEA Security Technologies and Strategies Survey, almost two-thirds of organizations covered directly by the legislation had not yet started compliance work, as of spring 2025. Allocation of dedicated funding is difficult under these circumstances, with 82% of organizations saying they had not seen any change in their security budget to address NIS 2 requirements. That does not mean no funding is available – but when the directive comes into force in their relevant markets, it may require reallocation of existing funds from other initiatives.

Of course, there are measures that can be taken that do not require technology investments, with 19% of organizations saying they have updated their security policies and processes in relation to NIS 2 requirements. Still, that is less than 1 in 5.

Up the hill backwards

Delays in transposition of the legislation may lead some organizations to consider that time is on their side and there is little need to press ahead with preparations for compliance. Until a European law has come into force, there is no legal basis to enforce compliance. Nevertheless, there are legal principles that caution against taking this approach.

The so-called doctrine of effectiveness principle created by the European Court of Justice in relation to EU laws puts obligations on EU member states to act in certain circumstances. It may seem like there is little incentive to pursue such cases but bear in mind that NIS 2 aims to build cyber resilience in critical and important entities, in the face of ever-increasing cyberattacks. So, when a major cyber incident disrupts operational capability in a critical vertical, after the initial impact has been contained and services restored, investigations and audits will follow. In that situation, there is no guarantee that the principle of effectiveness will not be invoked, if it is deemed that an in-scope organization failed to take appropriate measures to manage the risk.

Most member states have set up registration mechanisms through which in-scope organizations have to provide certain information such as designated personnel, contact details, IP ranges, and more. The designated authorities in each member state are required to compile those lists of critical and important entities and share the number of entities, along with the sector and subsector breakdown, with the EC and the NIS 2 Cooperation Group. These coordinated actions serve a broader function of enabling the EU’s supranational cybersecurity operational bodies to track and address major incidents that may transcend national borders and lead to impacts spreading across sectors and countries. Consequently, even in member states that have not completed transposition it is crucial that in-scope entities fulfill the registration requirements for their organization.

The area of incident response also bears scrutiny. Article 23 of the NIS 2 directive details incident reporting obligations, which include an initial alert that must be made within 24 hours of becoming aware of the incident, full notification within 72 hours, and a final, detailed report within one month. Even before full transposition, member states themselves are required to run Computer Security Incident Response Teams (CSIRTs) that are obliged to support in-scope entities in case of an incident. Subject to the findings of those cases, compliance demands could be applied retroactively or specific requirements imposed with compressed deadlines to address key issues.

It’s no game

Despite delays in transposing the legislation, the NIS 2 directive is moving inexorably towards being enforced across the EU and even beyond, when we take into account international companies with operations in EU member states or companies that are suppliers to in-scope organizations. According to IDC’s survey, 41.1% of organizations said that despite not being in-scope for NIS 2, they are still facing compliance requests from some of their partners that are covered by the directive. Individual countries continue to make progress: in Finland the legislation came into force on April 8^th 2025; in Slovenia on 19^th June; and in Denmark and Estonia on July 1^st. Cyber incidents and the risk of extended legal actions make a very strong case for all in-scope entities to prioritize achieving NIS 2 compliance. And even if the auditors aren’t watching you – maybe the cybercriminals are.

To learn more about how European organizations are preparing for NIS 2 compliance, visit IDC’s European Security Technologies and Strategies page. If you have a specific query about NIS 2, drop it in this form.

Mark will be speaking at IDC’s CISO Xchange, which takes place 9-11 November in Marbella, Spain.

At the 2025 NATO Summit in The Hague a few weeks ago, member states pledged to allocate 5% of their annual GDP to core defense requirements and defense- and security-related expenditures by 2035. This represents a significant departure from the alliance’s longstanding 2% benchmark, particularly given that the current average defense spending among NATO members only marginally meets the 2% target.

European nations constitute the majority of NATO’s members. And since the onset of Russia’s invasion of Ukraine, several Eastern European countries—such as Poland—have substantially increased their defense budgets. Nevertheless, many European allies remain below the alliance average, rendering the new 5% objective highly ambitious. The United States continues to lead in defense investment, with expenditures approaching $1 trillion in 2024— double the combined defense spending of Europe and Canada — and has been an advocate for heightened commitments among NATO.

The new target of 5% of GDP is structured to address both immediate military needs and broader security challenges, with an ideal split of spending among 2 categories:

3.5% of GDP: core defense requirements

• Purpose: This portion is dedicated to traditional military expenditures.
• Coverage: Includes funding for active personnel, acquisition and maintenance of weapons systems, military equipment, R&D, and operational readiness.

1.5% of GDP: defense and security-related investments

• Purpose: This segment is allocated to areas that support and enhance national and alliance security beyond conventional military assets.
• Coverage: Encompasses investments in critical infrastructure (such as energy grids, transportation networks, and communication systems), network defense, and resilience against hybrid threats.

Direct ICT Spending Impact

Core defense Spending: A larger budget is expected to drive more funding for defense organizations and spark a ripple effect in ICT spending. According to IDC Worldwide ICT Spending Guide Enterprise and SMB by Industry, aerospace and defense ICT investments in Europe will top $11 billion in 2025—about 1% of the region’s total ICT expenditure.

Military modernization efforts are focused on upgrading command, control, communications, computers, intelligence, surveillance, and reconnaissance (C4ISR) systems, strengthening cyber defenses, integrating artificial intelligence for battlefield operations, and enhancing encryption to secure communications and protect against cyber threats. However, this category will likely represent only a small portion of the overall 3.5% GDP allocation to core defense requirements.

Assuming the 3.5% target equates to approximately $665 billion, it is expected that initially less than $20 billion will be directed towards digital modernization and related technologies. This restrained allocation stems from several pressing priorities:

• Many NATO members must rearm and modernize legacy military equipment, much of which is outdated or exceeded its operational life.
• There is an urgent need to rebuild naval fleets and replenish armament supplies, particularly after significant stocks were transferred in support of Ukraine.
• Substantial investment in unmanned aerial systems (drones), which are increasingly central to modern warfare, will also consume a major share of the available resources.

Therefore, while digital modernization is strategically important, the immediate proportion of defense spending dedicated to these initiatives will be modest in comparison to the broader requirements of re-equipping and reinforcing conventional military forces. Over time, this share may increase as foundational rearmament needs are addressed and digital technologies become further integrated into military operations.

Indirect ICT spending impact

Defense and security-related investments: Efforts are focused on securing critical infrastructure from both cyber and physical threats, enhancing national and international cybersecurity through advanced tools, investing in IoT and digital twin technologies for real-time monitoring, and promoting post-quantum cryptography and secure digital identities. However, the most significant portion of spending in this area will be dedicated to fundamental cybersecurity measures and the development of sovereign data and cloud capabilities. Much of this investment will address foundational requirements, such as fortifying existing networks, implementing robust data protection protocols, and ensuring compliance with national security standards.

While initiatives involving emerging technologies—such as post-quantum cryptography—are important for long-term resilience, these areas are likely to attract only limited funding initially. The focus will remain predominantly on basic cybersecurity infrastructure and sovereign data management until Europe further develops a robust innovation base in the defense technology sector. Heavy investment in more advanced and experimental digital solutions will depend on the establishment of this foundation and the maturation of European defense-driven technological ecosystems.

Induced ICT spending impact

This growth will create new opportunities for core defense solutions and benefit related industries, fueling wider momentum in the Defense Ecosystem. This momentum has therefore set off significant induced ICT spending, especially among major European defense contractors. As these companies prepare to deliver more advanced and diverse products and services, the demand for innovative IT solutions and digital transformation initiatives has surged. This effect spans not only traditional leaders such as Leonardo, Dassault, and Rheinmetall, but also extends to BAE Systems, SAAB, Indra, Thales, and Airbus, among others.

The current environment provides a strong opportunity for the European defense industry to enhance its position in the global market. By accelerating investments in areas such as digital platforms, cybersecurity, cloud infrastructure, and advanced analytics, the sector can differentiate itself while building greater resilience and competitive strength. Examples of current IT and digital transformation-related initiatives include:

• Development of secure, sovereign cloud platforms for defense applications and data management.
• Deployment of AI-driven command and control systems to improve operational decision-making and mission effectiveness.
• Launch of pan-European projects to promote interoperability, digital sovereignty, and cybersecurity across defense networks, often supported by the European Defence Fund and broader EU digital policy frameworks.

These initiatives foster a more interconnected and technologically advanced defense ecosystem, ensuring that European contractors can respond to evolving demands and capture new growth opportunities in a global context

NATO’s new 5% GDP spending target signals a major shift for Europe’s defense sector, promising record investment in military capabilities and key enabling technologies by 2035. However, long-term commitment is uncertain, as future governments may redefine priorities.

This shift opens the door for technology providers—whether established contractors or innovative startups—to play an essential role in shaping the continent’s security future.

For technology providers, the key imperatives are clear:

• Make the defense market a top priority. With traditional defense budgets swelling and new funding streams available, tech vendors – especially those historically focused on enterprise or civil solutions – should prioritize defense within their broader industry strategies. Consider how your technology – especially AI-driven solutions for logistics, scheduling, or intelligent automation – could be adapted for military use. With rising defense investment and a growing need for innovation, now is the time to explore how your products can address emerging defense challenges and open new markets.
• Embrace broader collaboration: Leverage increased funding and European Union support for joint ventures and R&D initiatives to accelerate adoption and scale innovation across national boundaries.
• Drive dual-use innovation: Develop technologies that bridge defense and civilian markets, maximizing addressable opportunity while supporting national security objectives. In doing so, it is essential also to consider the spillover effects beyond pure core defense spending in adjacent sectors.

The path forward demands agility, innovation, and collaboration, but the rewards – in terms of both market opportunity and societal impact – are substantial.

To learn more about how ongoing geopolitical dynamics are shaping IT spending strategies, visit IDC’s Digital Economy Strategies page.

Rethinking CRM and Embracing Agentic AI: Towards a New Era of Customer Experience

According to IDC research, 77% of consumers currently prefer to buy products and services through a mix of digital channels, and customer expectations relating to personalization, immediacy and cross-channel consistency are only becoming more demanding. Customer journeys are not linear, and consumer engagement is expected to become increasingly contextual, not just at the initial stages of the journey but also in terms of customer support — from sales and marketing to customer service.  To meet these demands, organizations are reimagining traditional customer relationship management (CRM) systems, which involves actively implementing AI in multiple ways. As part of this, exploration of agentic AI is ramping up.

The Evolution of CRM: from Systems of Record to Systems of Action

Customer relationship management has evolved beyond merely storing contact details and tracking interactions. CRM platforms need to be designed or re-designed following a omnichannel and cross-functional approach to customer data collection, enabling profile reconciliation through data integration from various sources such as online purchases, in-store transactions, social media interactions, and customer service incidents. This integration should ensure a comprehensive and unified view of customer data, allowing organizations to gain valuable insights and provide personalized experiences. By consistently providing personalized and meaningful interactions, companies can foster loyalty, resulting in increased customer retention and positive word-of-mouth referrals. Modern CRM systems must be dynamic, real-time, and deeply integrated across the entire customer journey, encompassing marketing, sales, service, and support. Key shifts in CRM thinking include:

• Real-Time, Contextualized Data: Modern CRM platforms need to reflect customer data in real time, providing contextual and intent-driven insights that empower every function within the organization.
• Cross-Functional Collaboration: Effective CRM now requires multiple departments to work together, breaking down data silos to ensure a comprehensive view of the customer.
• Automation and AI Integration: AI-enhanced automation is foundational, enhancing customer service, streamlining operations, and ensuring consistency across channels.

IDC Insight: Organizations are rethinking CRM through collaborative, AI-enhanced approaches that connect data across functions and eliminate silos.

Agentic AI: Bringing Intelligence to Unstructured Work

Organizations are already gaining experience in leveraging AI in multiple ways to serve customers — from proposing next-best actions to making sense of documents and knowledge articles, analyzing customer sentiment and more. Agentic AI represents a new frontier here, and pulls AI capabilities towards task and workflow automation. Unlike traditional rule-based systems, where workflows and processes are designed statically up-front, the emergence of AI agents is starting to show how organizations can bring more nuanced automation capabilities to less structured, unpredictable environments. AI agents are therefore conceptually a great fit for complex service scenarios that can come into play at critical moments in the customer journey. At IDC, we see three waves of AI agents playing out:

1. Knowledge Agents: Enhance decision-making by integrating relevant information into workflows
2. Action Agents: Execute tasks (including taking actions in external systems) and assist in decision-making processes
3. Orchestration Agents: Coordinate entire workflows, based on goals and insights into patterns of past behavior and positive outcomes

IDC Research: 41% of organizations say they are already investing in AI agents, recognizing their value in case management and service operations where flexibility and responsiveness are critical.

The Role of Platforms in Enabling AI and CRM Synergy

CRM systems are increasingly pivotal in the integration of customer data and AI across organizational value chains, serving as a foundational element for collaboration between IT and business units. Agentic AI, in this context, acts as a transformative accelerator, converting insights into actionable strategies and enhancing decision-making processes at scale. Organizations wanting to implement AI quickly, safely, and securely into CRM practices and capabilities will benefit from platforms that provide:

• Managed Access to Enterprise Data: Secure, broad access to corporate knowledge, documents, and data is essential for AI systems to function effectively.
• Integrated Automation Tools: A unified platform combining AI with existing automation capabilities reduces complexity and accelerates time to value.
• Scalability and Agility: Platforms can help organizations quickly adapt to changing market conditions and customer needs without extensive customization.

Trend: In the context of modern CRM strategies, AI is most effective when integrated into a platform that spans front-, middle-, and back-office functions, enabling seamless customer experiences and operational efficiency.

Measurable Impact: What Organizations Are Achieving

Organizations embracing AI and modern CRM strategies are witnessing significant results:

• Escalations reduced by approximately 90%
• Case resolution time decreased from 7 hours to 2 hours
• Customer satisfaction increased from 80% to 99%
• 17% reduction in staff needed to handle more cases
• 7% increase in billable utilization

These outcomes highlight the transformative potential of combining CRM modernization with AI and point towards an exciting future powered by agentic AI.

The Bottom Line

Organizations that rethink CRM as a real-time, AI-powered system of action — and embrace agentic AI to handle complex, unpredictable work — are better positioned to deliver exceptional customer experiences. This approach not only enhances satisfaction and loyalty but also drives operational efficiency and business agility.

AI is quickly changing the workplace, but not everyone is reaping the rewards. Office workers are seeing the perks of AI, while those on the front lines are lagging due to a lack of training and resources. This gap could lead to a two-tier workforce, where some people with AI skills excel while others find it tough.

Many frontline jobs involve a lot of manual and repetitive tasks. Automation and AI are great tools to help shift workers’ focus from boring tasks to more interesting ones. So, it’s no shock that found that 63% of frontline workers are using AI tools in their jobs. Unfortunately, just 18% of employees have access to AI from their companies, which has led 45% to seek out free or personal AI tools for their work. This creates serious security risks for companies.

While frontline workers generally view AI less favorably than office staff, nearly half believe it could enhance their work experience. Generational differences are notable though, with 55% of Gen Z frontline workers expressing excitement about AI, compared to just 27% of baby boomers.

Frontline workers frequently also feel more anxious about AI, mainly because they’re worried about job security, feeling powerless against new tech, and thinking that human input in decision-making is dwindling. IDC’s survey shows that just 48% of frontline workers think AI isn’t a threat to their jobs. On the flip side, 20% feel they are at serious risk, with the remainder unsure. Getting to know AI tools better can help ease these worries for frontline workers and turn skeptics into skilled AI users.

More than 2 billion frontline workers play a crucial role in keeping our planet running. Their jobs are tough and often risky, involving 10- to 12-hour shifts in different settings. AI is changing the game for these workers by automating tasks, offering real-time insights, and giving them more power. AI isn’t just for office work anymore; it’s now making waves in most industries, including those with large numbers of frontline workers.

To move forward, tech providers and tech buyers must rethink what expertise means in today’s AI era. They must help frontline workers understand how AI tools can enable them to handle complicated tasks even with little prior experience. Our research suggests that companies can — and ought to — expand their view on who can get involved in AI-driven initiatives. By doing so, they can leverage the complete potential of their workforce and make sure that everyone is part of the AI transformation, ultimately boosting the return on investment for current and future AI projects.

Listen to Meike on the latest webcast, “Important Workplace Insights to Drive AI Sales in Europe”