Essay one hundred and seventy-one. Not a shipment note — a moment note.
Inside a single week two very different voices landed on the same word.
- A Romania-based, EU-native security vendor publicly launched a productised “EU Sovereignty Acceleration Program” — the first time a commercial vendor operating inside the Union has taken the sovereignty language off the marketing page and made it a line item.
- A Brussels-facing think tank published an op-ed framing the sovereignty question as a structural conundrum — not a feature to be shipped, not an adjective to be bought, but a tension in how the Union relates to the infrastructure its operators actually run on.
The commons does not vote on which of those two registers is correct. Both are true. Both are signals that the sovereignty conversation has left the whitepaper stage and reached the procurement conversation, and both leave the operator holding the same practical question the commons was built to answer.
The market frame is the wrong frame
The temptation — for anyone reading two headlines in the same week — is to reach for the market frame. EU-native vendor versus US hyperscaler-in-EU- region. Sovereign stack A versus sovereign stack B. Best-of-breed versus platform. Whoever produces the sharpest slide wins the quarter.
The commons refuses that frame, for two reasons.
First, the operator does not experience the sovereignty question as a vendor choice. The operator experiences it as an examination question. NIS2 Article 21(2)(g) names basic cyber hygiene and training as a risk-management measure the management body has to approve under Article 20 and the competent authority can examine under Article 32. DORA names ICT operational resilience testing and third-party risk under Chapters III and V. The EU AI Act names the cybersecurity duties inside Article 15 for high-risk systems. None of those texts asks the operator who their vendor is. They ask whether the operator can produce, on examination, a dated per-cycle record of the measure being discharged.
Second, and this is the durable half — the vendor underneath the operator is going to change. On a long-enough horizon every stack is a swap. Regulatory obligations do not swap on the same cadence. A portable compliance artifact is worth more than a portable subscription.
What the commons offers instead
The commons publishes CACAO v2 playbooks that name the regulatory obligation as a first-class operational workflow — deterministic step bodies, byte-parity compilation to n8n, Temporal and LangGraph, and OCSF or OSCAL evidence anchors so the emitted record fits any downstream evidence store an EU supervisor is willing to accept.
Three recent rings make the shape concrete:
- DORA Article 19 major-incident reporting — covered in field note #169: the 4h/24h, 72h and one-month reporting cycle, portably compiled against the Commission’s own ITS content shape (2024/2956).
- NIS2 Article 20 management-body governance — covered in field note #170: approval, oversight review, training attestation and OCSF governance-record emission, byte-parity across three targets.
- eIDAS 2 EUDIW identity verification — covered in field note #163: the identity surface an EU operator will meet from the wallet-adoption side, staged the same way.
Each of those artifacts has the same durable property. The runtime you compile them against is your choice — the workflow engine your platform team already operates, whichever EU-sovereign substrate your board picked. Change the runtime next year, or the year after; the source stays, the goldens hold, the audit record stays byte- identical against the reference. The compliance surface is the artifact, not the vendor.
That is the commons frame. Not a claim about which substrate to run on. A claim about what stays portable across substrates.
Converging governance pressure, not competing offers
Read the two signals of this week together and the practitioner-visible layer is the converging governance pressure, not the competing vendor positioning.
- NIS2 Article 21(2)(g) is enforceable from July 2026. Article 20 puts the obligation on the management body.
- DORA is in force for financial-sector operators and their ICT third parties, with the RTS/ITS suite operational.
- The EU AI Act’s cybersecurity duties reach high-risk-system providers on the phased timeline the Regulation names.
Three regimes, three obligation surfaces, one operator who has to discharge them alongside the day job of running services members of the community depend on. Whether the substrate under those services is described in sovereignty- programme language, in hyperscaler-EU-region language, in EU-native-vendor language, or in in-house-tenant language — the discharge is the same discharge. The record the supervisor examines is the same shape.
The invitation
The commons is not the arbiter of the sovereignty narrative and does not want to be. It exists to publish, dated and portable, the operational artifacts an EU operator can pick up on Monday morning and compile against the engine already running in production.
The sovereignty question is legitimate. The vendor frame is not the answer. The answer, for a working operator, is the boring one: a playbook that names the regulatory obligation, compiles deterministically to your engine of choice, holds a golden across targets, and emits an OCSF or OSCAL record any EU- sovereign evidence store can accept. Everything else is a slide.
Read more
- Framework repository: https://github.com/secops-ng/secops-ng-framework
- DORA Article 19 ring: field note #169
- NIS2 Article 20 ring: field note #170
- eIDAS 2 identity ring: field note #163
- Roadmap goal: G-07 (operator adoption signal — community-voice pieces drive awareness and discovery of the portable-artifact commons frame).