By Annika Nevaste Cyber attackers increasingly exploit supply chains as the weak underbelly of European business. Securing supply chain resilience is now critical. Mercurial world leaders, geopolitical tensions and growing reliance on non-EU technology providers are pushing digital sovereignty to the top of the agenda for the EU and European business leaders. The EU relies on non-EU countries for over 80% of digital products, services, infrastructure, and intellectual property. Excessive dependencies on non-EU actors in critical technologies pose risks to European sovereignty and resilience.[i] The EU has already taken steps to strengthen cyber security regulations, but supply chains still represent a poorly understood source of vulnerability. While digital sovereignty has risen up the policy agenda, the greatest and least understood threat lies in the cybersecurity risks embedded in global supply chains. These are risks that cannot be addressed through regulation alone. And for many organizations, those risks sit just out of sight, buried deep within supply chains they assume are secure. Securing EU sovereignty In recognition of growing risks to EU sovereignty, the block has set a clear objective to strengthen capacity, resilience and security by reducing strategic dependencies, preventing reliance on foreign actors and single service providers, and safeguarding critical technologies and infrastructure[ii]. However, the most critical vulnerabilities do not sit inside European systems. They sit within the supply chains those systems rely on. The EU has taken steps to strengthen cybersecurity through frameworks such as the NIS2 Directive and the Digital Operational Resilience Act (DORA), which impose stricter requirements for supply chain security and third‑party risk management, including the assessment of supplier vulnerabilities and the mitigation of risks associated with providers in high‑risk third countries. Complementing these measures, the Cyber Resilience Act aims to enhance the baseline security of digital products placed on the EU market. Although these