--- title: Why European Boards Now Prioritise Local Security Providers Over Tech Giants description: European IT boards now prioritise compliance and data sovereignty – driving demand for EU-based security, risk management and regulatory expertise author: Dr Marina Nani (Editor-in-Chief) date: 2025-10-02T12:48:18.000Z updated: 2026-02-26T17:55:11.537Z canonical: https://www.sovereignmagazine.com/article/why-european-boards-now-prioritise-local-security-providers-over-tech-giants image: https://cdn.nanimediahouse.com/6f7e0e1e-2913-48e4-a814-6a4eff269dfb.jpg categories: EU Focus content_type: Analysis region: Switzerland publication: Sovereign Magazine --- IT decision-makers across Switzerland and Europe no longer treat compliance as an afterthought. Regulatory fit now sits at the heart of how they choose suppliers and design their security architecture. New research reveals that 48% of CIOs and CISOs now explicitly demand European-based security providers, while nearly three quarters of C-level executives say that frameworks like NIS2, DORA and the [Cyber Resilience Act directly shape their security investments](https://www.sovereignmagazine.com/article/compliance-frameworks-take-centre-stage-as-cyber-security-mandates-tighten) and vendor choices. The boardroom conversation has changed completely. Where technology leaders once focused primarily on features and costs, they now lead with questions about data residency, audit readiness and regulatory alignment. ## Regulatory Pressure Moves Centre Stage According to a survey of 371 IT and security decision-makers across Germany, the UK, Austria and Switzerland, 43% of all organisations now say EU frameworks directly drive vendor selection and security spending. Among C-level executives, this figure jumps to 72%. ‘The sovereignty debate has left the back office and entered the boardroom,’ said Daniel Gerber, Chairman of the Board at Open Systems. ‘We’re seeing a decisive change: compliance is no longer a final checkpoint, but a driver of strategy, architecture and supplier shortlists.’ These regulations demand more than tick-box exercises. [NIS2 requires comprehensive risk management](https://digital-strategy.ec.europa.eu/en/policies/nis2-directive) for critical infrastructure operators, including incident reporting within 24 hours and supply chain security assessments. [DORA mandates that financial services firms](https://www.eiopa.europa.eu/digital-operational-resilience-act-dora_en) implement ICT risk management frameworks and conduct annual resilience testing. The [Cyber Resilience Act](https://digital-strategy.ec.europa.eu/en/policies/cyber-resilience-act) requires cybersecurity-by-design for any product with digital elements sold in the EU. For companies operating across multiple jurisdictions, this creates a complex web of requirements that extends far beyond traditional IT security planning. ## The Boardroom Demands Control The survey findings reveal a significant attitude change among senior executives. While only 25% still consider vendor lock-in a key concern, 55% now prefer European-based providers. This represents a complete reversal of traditional procurement priorities. Regulatory trust and audit readiness now outweigh fears about vendor dependency. Companies want partners who can demonstrate immediate compliance with European frameworks rather than promising future certification. This preference reflects practical concerns beyond regulatory requirements. [European companies are increasingly switching](https://blog.anynines.com/europan-companies-switching-local-cloud-providers/) to local providers due to conflicts between GDPR requirements and US laws such as the CLOUD Act, which compels US companies to provide access to data even when stored in the EU. The Schrems II ruling, which invalidated the EU-US Privacy Shield, continues to influence procurement decisions. Many organisations prefer fully EU-based providers to avoid potential data access by US authorities and the legal ambiguities this creates. ## What Security Buyers Want From Providers The changing requirements extend beyond simple data residency. Security leaders are demanding what Markus Ehrenmann, CTO of Open Systems, describes as platforms that ‘combine EU-hosting, zero-trust control and out-of-the-box audit readiness’. Services have become as important as technology. Companies need consulting expertise combined with operational support, particularly for organisations without internal capacity to manage incidents, changes or compliance reviews. The survey identified specific provider requirements: – Transparent data processing with clear documentation of where security data is processed – Real-time visibility through dashboards and APIs – Immediate audit capabilities without lengthy preparation periods – Help with architecture design tailored to each organisation’s structure and risk profile Beyond technical capabilities, buyers want realistic planning for migration and system changes. The complexity of hybrid and multi-cloud environments means organisations need partners who can bridge the gap between compliance requirements and operational reality. ## Where Organisations Still Struggle Despite increased focus on compliance, execution gaps remain significant. The survey identified hybrid-cloud environments as the primary challenge, followed by skills shortages in network and security operations, incident handling capabilities and multi-cloud security management. These challenges are driving specific IT projects. Survey respondents listed the top three initiatives currently driven by new regulations: – Security operations and incident/audit handling (45%) – [Data transparency and processing improvements](https://www.sovereignmagazine.com/article/your-smartphone-isn-t-yours-here-s-how-soverli-is-changing-mobile-security) (37%) – IT/OT convergence and operational technology security (36%) The growing pressure on OT security affects multiple sectors. Among industrial companies, 48% cite this as a pressing need, while 44% of finance and healthcare organisations are addressing operational technology security requirements. [The European MSSP market](https://www.mordorintelligence.com/industry-reports/europe-managed-services-market) was valued at approximately $51.08 billion in 2024 and is expected to grow to $59.35 billion by 2025, with local European MSSPs gaining market share by offering tailored, region-specific services. ## New Demands on Providers The regulatory environment places new demands on security providers beyond traditional technical capabilities. Transparency has become critical – companies need clear documentation of how and where security data is processed, whether it remains within the EU and how it can be accessed. Organisations want help with realistic planning rather than just technical products. This includes architecture design that works with existing technology deployments and is tailored to each organisation’s structure and risk profile. The survey findings indicate that providers must offer ongoing operational support, particularly for organisations without internal capacity. This extends beyond installation to include incident management, change control and compliance review support. Real-time monitoring capabilities are now expected as standard, with drill-down analysis and API access for integration with existing security operations centres. ## Boardroom Impact Boards are now spending to ensure their security is not only technically sound but also fully compatible with European regulation. This represents a wider trend for IT procurement across the region, where [regulatory alignment has become a primary selection criterion for sovereign technology](https://www.sovereignmagazine.com/article/what-does-sovereign-tech-actually-mean-for-europe). [Data sovereignty laws in over 100 countries](https://www.csoonline.com/article/571179/data-sovereignty-laws-place-new-burdens-on-cisos.html) are compelling European companies to re-evaluate their IT strategies and vendor choices to reduce legal and operational risks. Security spending decisions now involve legal, compliance and risk management teams alongside IT departments. Procurement processes have lengthened as organisations conduct detailed regulatory assessments of potential providers. Local European providers stand to benefit most from this change, particularly those who can offer both technical capability and [regulatory expertise](https://www.sovereignmagazine.com/article/why-the-gaming-industry-s-next-big-winners-will-be-those-who-master-local-rules). The combination of regulatory pressure and skills shortages creates opportunities for providers who can deliver integrated solutions rather than standalone products.