Three shifts are arriving at the same time (geopolitics, cyber and level-3 AI). Their combination creates a major rupture. The French state has been caught flat-footed by these simultaneous shifts and has prepared nothing.
Citizens find themselves alone in having to anticipate the consequences of a possible transatlantic decoupling, of the rising digital risk to their data, and of the rise of an AI that promises, this time with more evidence, to replace a large share of our intellectual tasks.
I was looking for a term to explain the coincidence of three subjects that have obsessed us since this newsletter launched and that seem to be converging in 2026. Each of them, taken alone, is disruptive enough. But the combination of the three creates a major rupture in the way we see the digital world. The term I have used to describe it is the Big Shift.
This newsletter attempts a first analysis of the situation as it unfolds in real time.
The geopolitical shift
The first thing on everyone's lips, especially since Trump's speech in Davos and his claims on Greenland, is the announced rupture between Europe and the United States. For us, it makes the idea of a digital and military decoupling unavoidable from now on. Let us set aside the military side, which is a very complex subject, and focus on the digital question and the announced degradation of our interdependencies.
MEP Aurore Lalucq, who chairs the European Parliament's economic and monetary affairs committee, no longer hesitates to say that our dependence on American financial systems is total. She points to the situation of the judges of the International Criminal Court, cut off from their entire digital lives. Is every citizen doomed to the same fate? Not a day goes by without an article on the subject in the mainstream press. This worry has clearly moved beyond the circle of specialists.
But can the pieces still be put back together?
A diplomat friend tells me that the process under way is probably beyond repair, even if Gavin Newsom, the current governor of California, or another Democrat returned to power. Because it is the core of trust that has been damaged.
On the sidelines of Davos and DLD, I saw people who have always been at the forefront of transatlantic alliances completely stunned. I also saw a few trying to chase after Donald J. Trump's entourage, without success.
Let's be clear: while the risk of the network being cut off for all Europeans remains low today, the risk of a price explosion is not, and we will have to prepare for it. And it is not impossible, as was done to Thierry Breton, that the cutoffs will be selective and target individuals or institutions.
Once again, we are at the very beginning.
Heading toward a cyberwar
The second thing is that we are entering a new kind of conflictual era, and that cyberspace has once again become a theater of war.
During the Venezuela operation, Trump and American generals hinted that "technical capabilities" had been mobilized ("Lights of Caracas were largely turned off due to a certain expertise we have"), which is a rare public indication of the use of offensive cyber capabilities in a military context.
The digital attack on a sovereign country by another sovereign country using cyber means is reminiscent of the Stuxnet operation in Iran.
We discussed it in a previous newsletter, along with the consequences of that precedent. After that operation, the Russians, the North Koreans, the Chinese and the Iranians concluded that "all the gloves were off".
The global architecture of state cyber operations has evolved toward more offensive and sophisticated capabilities, including DDoS (taking sites down), espionage, data exfiltration and sabotage.
Because this show of force also comes with a strategic disengagement from Europe that raises questions, at least by its timing.
- Within a few days, the United States, through a presidential memorandum of January 7, 2026, made official its withdrawal from the Global Forum on Cyber Expertise, the European Centre of Excellence for Countering Hybrid Threats and the Freedom Online Coalition.
- At the same time, CISA (more or less the equivalent of ANSSI, France's national cybersecurity agency) is limiting its protection effort to a small number of exploited vulnerabilities.
- In parallel, the National Vulnerability Database (NVD), the American public database that qualifies security flaws and is used worldwide to prioritize patches, is accumulating a massive backlog, due in particular to the government shutdown. Yet this database is a major source feeding European cybersecurity.
In other words, at the very moment cyber power is being displayed as an instrument of confrontation, the channels of cooperation and sharing with European allies are drying up. Or, to be more precise, are being privatized.
Remember that France, along with the United Kingdom, is now among the European countries most exposed to cyberattacks, according to several threat intelligence reports.
This situation is partly explained by the international context, with targeted attacks of state or para-state origin, but also by the rise of organized crime, driven by digital criminals who are younger and better organized than ever.
To this is added a factor more specific to the French case: the introduction, through the Interior Ministry's orientation and programming law (LOPMI), of a provision making compensation by cyber insurance conditional on filing a complaint within 72 hours of discovering the attack.
This measure, sharply criticized by many cybersecurity specialists when it was adopted, is not meant to prevent attacks but profoundly changes reporting behavior, mechanically increasing the number of complaints and the statistical visibility of incidents.
To recap: we have never had so many cyberattacks, the United States is moving up a level with offensive attacks, and it is cutting off our access to databases and cooperation spaces. This coincidence is no accident, and it may well define the first building blocks of the EU-US decoupling.
Level-3 AI
The third shift, you obviously know it, is generative artificial intelligence, which keeps getting better and better.
Beyond the battle between the various players, their audience choices and their pricing models, which we described in a previous newsletter, this year sees the move from levels 1 and 2 to the arrival of level 3.
This level 3 was officially announced by Dario Amodei, co-founder of Anthropic, Demis Hassabis and Elon Musk.
We are moving to the super-pro stage, with monthly costs that are going to explode but also with the execution of tasks that are increasingly reliable and complex. The buzz around Claude Code, but also the feat of ChatGPT 5.2 writing an entire browser, shows that the target is now the top of the market and subscribers who pay more.
In absolute terms, it means that the $200 plans will start to be adopted more widely, and that the $20 plan will become the new low end.
My bet is that the free tier will quickly get enshittified (ads, sexbot offers) as early as February.
The weak signals of this Big Shift
The early warning signs of this Big Shift are already showing up in the news.
- The Orange TV outage that coincided with the AWS outage shows that this dependence is often where you least expect it.
- Does it mean that cutting off US services would cut off our television and our telephone?
- Were we too quick to dismantle the copper networks (I think so)?
As we had anticipated, the techniques of the war in Ukraine are spreading to the rest of the world. In Iran, for example, where Russia is using the Starlink-jamming know-how it acquired in Ukraine.
The increasingly open layoffs at consulting firms and IT services companies, and the fall of every software stock, are also happening in anticipation of a world where building software and executing certain tasks are no longer valued as they used to be.
Faced with this, the state is unprepared.
We have no clear geopolitical doctrine, we have no AI doctrine that is not a copy of what the US players are doing, and on cyber the question has already been settled: the focus is on a small number of players because the resources are too thin for the immensity of the task. So citizens are on their own.
Because the state is no longer able to protect its citizens from this triple threat.
We realized it during Covid, and we are going to realize it again with the Big Shift. Beyond the choice of people and the absence of vision, there are also structural questions that will have to be challenged.
A system too centralized to move quickly
France is one of the rare countries where the digital ecosystem and the digital economy are so dependent on the state.
- It is Bpifrance (the public investment bank) that supplies capital to the investment funds, but also to startups.
- It is the state that, through a set of programs (French Tech, France 2030, the national investment plan, the AI and cyber plans), sets the tempo but also decides who will get its help and who will have to look elsewhere.
It is a tropism unique in Europe, and it explains why companies "do not complain" and why the business press is often very consensual, to the point of repeating the same talking points.
In the end, it is more or less always the same people we hear from, who publish books on digital or AI and who explain to the French what to do and what not to do.
Except that this system is reaching its limits. Because it has failed to take into account the different views held by a growing number of people. "Move along, nothing to see here" can only work for so long.
One of my fundamental breaks with the current French Tech system is well known: for me, innovation is not just doing what looks rational on paper, but daring to do what is irrational or impertinent. A startup is a counterculture. Otherwise you create a digital SME, and you do not "change the world," you conform to it.
The problem today is that it is no longer tech that is changing the world, but geopolitics.
In this new context, the old recipes no longer work.
And people are panicking.
- How many startups are built on SaaS models whose valuations are crumbling?
- How many startups and large companies have their technical architectures built on geopolitical quicksand?
Companies are not ready
Many CIOs are in the process of pulling out of certain American data centers, I was told, but very discreetly.
These days I meet people every day who ask me: "But how do we stop using this or that product?" You can sometimes sense in the conversation a form of panic that has accelerated in recent weeks. Especially among consultants who specialized in selling Microsoft, Google and Amazon cloud and classic SaaS solutions, and who are discovering that the need for digital sovereignty makes their expertise totally inadequate.
In 2025, "digital sovereignty" meant, from an operational point of view, "reducing your exposure to geopolitical risk."
But it is in AI that the tension is even more palpable.
A consultant recently confided to me that he is trying to accumulate as many experiences and positions as possible because, in the coming year, he thinks everyone will be able to produce work at his level, and that his context and experience are the only things that will set him apart.
For fifteen years, digital transformation was conceived essentially as a tooling problem.
Companies piled up software on the assumption that modernization meant more interfaces and more platforms. According to several studies (Okta, Zylo), the average company uses between 100 and 300 applications, generating data silos, high operational complexity and a heavy dependence on purely instrumental skills. A complexity that borders on the sublime.
This model, in which value rested on mastering the tools (knowing how to configure, integrate, maintain, train), is now hitting its limit with AI. AI is collapsing the cost of producing software and making the creation of interfaces trivial, which mechanically devalues the associated skills.
At the same time, these very interfaces, paid for at a premium, are becoming an obstacle for intelligent agents, which work more efficiently on raw data and structures than on screens designed for humans.
The critical skill is therefore moving: it is no longer in technical execution or in handling tools, but in the ability to orchestrate, structure and formulate intentions that automated systems can act on.
If you take the two trends together, digital sovereignty and agentic AI, not only is our state-funded ecosystem not ready, it finds itself in maximum friction with these new trends.
And we do not have enough time to come up with the answer.
The state turns in on itself
Faced with this triple disruption, instead of bringing people together and motivating them, the state continues to divide and to turn in on itself.
We are living in two parallel worlds.
- On one side, Macron gave a good speech in Davos, with a lucid assessment, which even his harshest critics concede.
- On the other, he has planned nothing to protect the French, and no mobilization exists for the moment.
There are in France at least one hundred thousand people who could start working today on France's digital sovereignty and resilience.
The big digital sovereignty jamboree taking place on Monday, January 26, 2026 will tell exactly the same story and make the same recommendations as last year. We observe, we measure, but we do not act.
The only thing we have managed to make sovereign so far is our inertia.
To add to this almost toxic environment, the political situation does not help. There is an exodus of expertise from ministerial offices, with everyone trying to find a job before the dissolution, or even the presidential election.
In reality, nobody wants to be at the controls anymore at the moment when things are about to get more serious and the hard part begins.
Another blow for the DGE at Bercy
At the European level, France has just lost a battle it had been fighting for years. The EUCS scheme, the European cloud certification framework, has just been published without a single sovereignty criterion.
Nothing France defended with SecNumCloud (ANSSI's security certification for cloud providers) was retained: no immunity from extraterritorial laws, no control over capital ownership.
The European Commission has ruled: EUCS will be a security standard, period. The CCIA, the lobby of the big American tech companies, publicly welcomed the decision. As for sovereignty, each member state is on its own.
Bercy, which hoped to impose its model on Europe, now finds itself isolated with a framework that nobody wants to adopt at the continental scale. And the most likely scenario in France now is stacking: EUCS, SecNumCloud, ISO 27001. Three regulatory layers that will weigh everyone down without solving the underlying problem.
Because the SecNumCloud market is worth only a few tens of millions of euros. Years and resources have been spent on a label that Europe rejects and the market ignores.
2026 looks more and more like the end of a reign
Without overall direction, the whole range of developers, integrators, operators and assorted IT services firms find themselves alone, with no direction. And because in 2026 money has to come in, they will swallow their pride and position themselves in the only two profitable sectors: AI and sovereignty.
Obviously, many have an enormous amount of catching up to do, and you will need to be careful in choosing your consulting firms.
And what about the citizens?
This is the real blind spot of the state's digital policy. We are alone in the face of the Big Shift.
Is it up to us to prepare and to define a resilience policy, both personal and within our companies?
That is what I intend to do here.
The first thing we are going to tackle is the question of decoupling. The next newsletter will be titled Taking Back Control of Your Digital Life (Before the Big Shift).
It will be the first in a series of newsletters that takes stock of the strategy to adopt, personally or professionally (freelancers, small SMEs, tradespeople).
Obviously, you will be able to take part, because I am thinking about a national digital resilience initiative, and I am going to need you.
In the news
For our paying subscribers, a few additional readings this week that shed light on the issues in this newsletter:
Read the full article
Sign up now to read the full article and get access to all articles for paying subscribers only.
