How to achieve digital resilience

Much of the industry's operational excellence is based on US technologies:

• SAP S/4HANA is often operated in the AWS cloud.
• E-commerce platforms such as Shopify or Salesforce Commerce Cloud manage D2C business models.
• Marketing and personalization solutions such as Adobe, Google, Meta Ads or Klaviyo make it possible to address customers in milliseconds.
• Even basic product information systems (PIM), CRM platforms or AI tools such as OpenAI (e.g. for content generation or forecasting) run on US infrastructure.

The entire chain - from innovation to sales - is digitalized, but not necessarily secure.

It should be borne in mind that this infrastructure was set up in this form for good reasons. It is the result of economic rationality - best-in-class tools, rapid availability, attractive price-performance ratios and global scaling options. But therein lies the dilemma. These advantages come at a strategic price: dependence on external control. In an increasingly fragmented world order, in which digital services are becoming an instrument of geopolitical power, seemingly neutral providers can become a means of exerting pressure.

Against this backdrop, the concept of digital sovereignty by design takes on a new urgency. When developing digital solutions, European companies should ensure that data and infrastructure remain under their control and independent of external entities. Just as physical supply chains are now also assessed according to resilience, digital architectures must meet the criterion of political controllability in future. After all, the failure of a PIM system, an email infrastructure or a cloud interface can cause more damage today than a late truck from Poland.

Parallel to the increasing uncertainty in the transatlantic alliance, the current customs debate is escalating. In this context, the EU points out that although there is a trade surplus with the USA in physical goods, the opposite is true in the digital services sector. The EU is therefore likely to target the five major American tech companies Alphabet, Amazon, Apple, Meta and Microsoft in response to Trump's tariffs. If the EU does this, it could prove to be a boomerang, as we Europeans are very vulnerable and dependent on the US in the digital space. A blockade of US companies would hit us hard.

Data flows are easy to disrupt - and difficult to redirect in the short term. Strategic early warning systems and scenarios are therefore needed to make digital dependencies visible throughout the company. So, while political decision-makers discuss digital agreements, data rooms and European cloud initiatives such as GAIA-X, companies are often left with the role of observer. The risk increases with every new service that is integrated into US infrastructure. The focus is shifting from simple GDPR compliance to genuine digital resilience - as part of corporate responsibility. CIOs and CDOs should recognize that data sovereignty should be the core strategic issue of digital strategy.

Of course, not every company can switch to European alternatives overnight or transform its entire tech landscape. Technological ideologies such as the eternal debate as to whether Apple or Microsoft is the better system will not help either. But what is possible - and urgently needed - is a new form of strategic questioning. Companies in the consumer goods industry should now ask themselves the following questions:

• Which applications are critical for our business model?
• Which of them cannot be substituted?
• Where are our single points of failure?
• What exit options are there - even in the worst case?
• Which investments in digital resilience will pay off in the long term?

The digital supply chain in the consumer goods industry is just as relevant today as the physical one - if not more so. And just like in logistics, you don't have to protect yourself against everything, but you should know what happens when things go wrong. The good news: if you start today, you will be prepared tomorrow. Not in reaction to current politics, but out of responsibility for your own future viability.

A german version of this article is also available. Click here to read it.