Digital sovereignty in practice: analyzing the EU’s NIS2 directive

Abstract This study examines how the EU’s Network and Information Security 2 (NIS2) Directive embodies principles of digital sovereignty. First, we address a significant gap in the literature by identifying five core principles of digital sovereignty through a literature review. While not exhaustive, these principles serve as a framework for examining the operationalization of digital sovereignty in policy. We apply this framework to analyze whether these principles are reflected in NIS2 Directive, employing a mixed-methods approach. Our methodology combines quantitative content analysis using advanced natural language processing techniques with qualitative interpretation. Our findings reveal a moderate overall reflection of digital sovereignty principles in the NIS2 Directive, with Digital Governance Authority emerging as the most prominently embodied principle. This analysis provides crucial insights into the EU’s approach to implementing digital sovereignty within its cybersecurity policy framework. Notably, we observe that the principle of Balancing Openness with Sovereignty received the lowest score among the identified principles, suggesting an area for potential further development in the EU’s approach to digital sovereignty. These findings contribute to the ongoing discourse on digital sovereignty by providing a concrete example of how it is being implemented in policy. The study’s significance extends beyond policy analysis, offering a foundation for assessing the economic implications of digital sovereignty initiatives, and evaluating regulatory impacts on market dynamics, investment strategies, and competitive landscapes in the digital economy.