The pendulum is swinging. NIS2 personal liability, the CLOUD Act sovereignty problem, 65% US cloud concentration, government ‘prefer open’ moves, and mature source-available platforms together make self-hosted the strategic default for serious European operators — while SaaS stays right for many. The thesis: own the data, the customers and the billing relationship, inside your own jurisdiction.
For fifteen years the arrow pointed one way: off-premises, into someone else’s cloud, as a service. For a specific and growing class of serious operator, that arrow has started to reverse — and for concrete reasons, not nostalgia.
For fifteen years the strategic default in enterprise software has been simple: rent, don’t own. SaaS won the argument on convenience, and for a great many businesses it still deserves to. But underneath the surface a number of independent pressures have started pointing the same direction, and for a specific kind of operator — the serious European one — the default is quietly inverting. The interesting question in 2026 is no longer “why self-host?” It is “why not?”
The pendulum has weight behind it now
Three forces have converged. The first is legal. The NIS2 Directive reached full effect across the EU in 2026, bringing audits and 24-hour incident reporting with it. Germany implemented it into national law effective December 2025 with no transition period; entities had to register with the BSI within a short window, with a deadline of 6 March 2026. Fines run up to EUR 10 million or 2% of annual turnover, and — the clause that changes boardroom conversations — management-body members can be held personally liable for culpable conduct. This is not theoretical. According to Reed Smith, Freshfields and related 2026 legal commentary, Germany’s BSI issued around 47 formal notices in Q4 2025 and levied an early significant fine of EUR 850,000 on a mid-sized cloud provider for inadequate incident detection and late reporting. A single incident touching personal data can trigger NIS2 and GDPR at once.
The second force is sovereignty. Three US-based firms hold roughly 65% of the European cloud market, and, as the European DIGITAL SME Alliance and others have noted through 2026, the US CLOUD Act lets US authorities compel US-owned providers to disclose data even when the servers physically sit in an EU data centre. The uncomfortable conclusion is that data residency is not data sovereignty. Choosing an EU region on a US provider’s console solves a compliance checkbox, not the underlying question of who can ultimately reach into your systems.
The third force is momentum in the public sector, which tends to lead where regulated industries follow. The Netherlands runs a “prefer open” policy for its public sector; Copenhagen has drawn up plans to exit US cloud dependence. When governments start writing exit strategies, private-sector risk committees notice.
What used to be the objection has been removed
Historically the honest reason not to self-host was that the software wasn’t ready — you would be assembling infrastructure by hand and maintaining it forever. That objection has weakened considerably. Source-available platforms have matured to the point where a full stack arrives as one coherent product. VBWD, for example, is a self-hosted SDK built on a single Python backend core that drives a Vue/TypeScript web front end plus native iOS and Android SDKs, with capabilities — payments, subscriptions, catalogue, CMS, booking, chat, native MCP — delivered as plugins that toggle on and off without a restart. It ships under BSL 1.1: free for commercial use while annual attributable sales stay below the value of 6.7 BTC per year, above which a commercial licence applies. The heavy lifting that once made self-hosting a staffing burden is increasingly done by the platform itself; on VBWD’s internal (and therefore hedged) benchmark, a one-million-product catalogue of complex items imports in about 40 minutes, which is the kind of number that used to require a dedicated platform team.
The thesis: own the relationship, not just the data
The strategic case for self-hosting is easy to state as a data-residency argument and easy to lose there. The stronger framing is broader: own the data, own the customers, and own the billing relationship. When your commerce and subscription logic runs on infrastructure you control, the customer is yours end to end — not intermediated by a vendor whose pricing, roadmap and terms of service you don’t set. That ownership is what converts regulatory pressure from a cost into an advantage. You are not scrambling to prove where your data lives; you already know, because it lives with you. And for a director now personally exposed under NIS2, “I can answer that precisely” is worth more than any convenience SaaS offers.
The honest caveat
None of this makes SaaS wrong. For a large share of businesses, pure convenience is the correct optimisation — someone else patches the servers, absorbs the on-call, and carries the operational weight, and that is a genuine value, not a trap. Self-hosting is emphatically not free; it trades convenience for control, and control is only worth acquiring if you actually value it and can carry the responsibility that comes with it — directly, or through a partner who does. A younger self-hosted platform also trades two decades of accumulated edge-case maturity for modern architecture, speed and auditability; for many that is the better trade, for some it isn’t. The point is not that everyone should switch. It is that the reflex of “obviously SaaS” no longer holds for the European operator who takes data, customers and personal liability seriously. That operator now has a real choice, and the burden of proof has shifted.
The longer argument, with the regulatory detail worked through, sits in our note on sovereign-by-default commerce for the NIS2 era.
If this maps to a conversation happening inside your own organisation, the useful next step is specific rather than generic: see your own workload on modern, self-hosted infrastructure. Request an enterprise installation and bring the numbers you’re trying to improve.
Sources: NIS2 analysis via Reed Smith, Freshfields and Lexology; cloud-sovereignty reporting via the European DIGITAL SME Alliance and OpenVPN (2026).
