Bavaria’s Digital Strategy: Mia san Microsoft

With the new digital strategy, Bavaria wants to technically mesh state and municipalities more closely, reduce IT security risks, and build a uniform digital infrastructure. At the center are a central IT architecture, a stronger role for the State Office for Security in Information Technology (LSI), and a reorganization of the municipal IT landscape. However, the draft shows above all one thing: a strategic restraint towards European technology – combined with a high level of trust in American platform providers.

Centralization as a Security Promise

The starting point of the strategy is a real problem: many Bavarian municipalities are struggling with outdated systems, scarce IT resources, and increasing cyberattacks. The idea of a central operating structure therefore appears understandable. The AKDB is to be further developed into a statewide IT service provider, supplemented by a cloud model that processes data depending on the protection requirement in state data centers, with German providers like Ionos or Telekom Cloud, as well as with international hyperscalers.

This multi-level architecture is intended to combine efficiency, security, and scalability. At the same time, this creates a model in which European and state providers do occur but do not take on the supporting role. The operational infrastructure is market-oriented – and the market is still dominated by US platforms.

Proprietary Software as an “Economical” Solution

The justification of the Bavarian Ministry of Finance for the preferred use of proprietary software follows a familiar pattern: “off-the-shelf” solutions are said to be cheaper, faster to introduce, and easier to operate. Open source models, on the other hand, would need “more internal personnel” and could not be based on community structures alone.

This reasoning ignores essential aspects. Open source assumes independence but not self-development of complete systems. Europe has strong providers in the cloud, security, and administration sectors that offer more stable cost structures and strategic control in the long term. The recurring license increases of proprietary products – as with Esri or the Microsoft Enterprise licenses – show how quickly supposed cost advantages can flip.

The price comparison between Dataport OpenDesk and Microsoft 365 cited in the digital strategy is exemplary for this: a look at list prices says little about follow-up costs, binding effects, or the effort of future migrations.

Data Protection: A Balancing Act with a Narrow Corridor

Bavaria points out that an additional agreement with Microsoft was checked and approved. This is a necessary step – but one that does not disguise the structural dependency. When central administrative processes run largely via proprietary ecosystems, data protection becomes an issue that always moves within the technical framework of a provider. The state’s leeway remains limited.

AI Strategy: Investments with Contradictory Direction

Of positive note is the buildup of an own AI infrastructure with dedicated GPUs in the state environment. Thus Bavaria recognizes that sensitive data should better be processed within its own sphere of influence. At the same time, central generative AI services continue to be based on OpenAI within the Azure cloud. This counteracts the goal of sovereign data storage and again shifts critical value creation to international platforms.

A European Perspective is Missing

Bavaria’s digital strategy takes challenges seriously, prioritizes security, and tries to modernize overdue structures. But it misses an opportunity: the consistent buildup of a sovereign, European administrative IT. The path taken leads to stronger centralization – but not to more independence. Where Europe could strengthen its own competencies, Bavaria primarily takes over existing offerings from global technology providers.

Digitalization thus becomes the maintenance of international platforms instead of the development of own technological scope for action. The question of how Bavaria wants to secure digital sovereignty in the long term remains open.