On the second day of QCon London 2026, Martin Kleppmann opened his keynote with a graph, not of system throughput or latency, but of European cloud market share. AWS, Azure, and Google Cloud together hold roughly seventy percent of the European market. The largest European cloud providers sit at about two percent each.
In other words, Europe is completely dependent on US cloud services.
Kleppmann, an Associate Professor at the University of Cambridge and author of Designing Data-Intensive Applications (the second edition, co-authored with Chris Riccomini, is being released this month), spent next fifty minutes making the case that this dependency is a risk worth engineering against not with panic, yet with practical technological choices that shift power back toward users and away from single providers.
He grounded the risk in recent events. Last year, US sanctions on the International Criminal Court in The Hague resulted in the chief prosecutor losing access to his Microsoft-hosted email. Microsoft denied suspending services but confirmed it had been in contact with the ICC "throughout the process that resulted in the disconnection of its sanctioned official." The ICC migrated off Microsoft services shortly after.
Two weeks before the keynote, Iran attacked three AWS data centres in the UAE with drones, severely damaging at least one. The region was still showing disrupted services on the AWS dashboard as of the day before the talk. And Kleppmann pointed out that hosting data in European regions doesn't solve the problem either: Microsoft has stated it would comply with US legal requests for EU citizen data stored in the EU, regardless of EU law.
His argument wasn't that a conflict between the US and Europe is likely. He stressed that the probability is still small. But it's no longer zero, and the impact of a sudden lockout would be enormous. That makes it a risk worth mitigating under what he called "technological sovereignty," a buzzword, he acknowledged, that says nothing about how to actually achieve it.
He proposed three concrete technological directions.
Multi-cloud and commoditisation: For back-end services, Kleppmann argued that the ability to switch providers is what matters, and that commoditization through de facto standards is the best path to get there. He pointed to the S3 API for object stores, Kubernetes for deployment, the Kafka protocol for streaming, and the Postgres wire protocol for databases as emerging standards that enable switching even without formal standardization bodies. He compared this to Joseph Whitworth's 1841 standardization of screw threads, which unlocked interchangeability across manufacturers during the Industrial Revolution. The trade-offs are real: increased cost, operational complexity, and being stuck with lowest-common-denominator features. Kleppmann argued that commoditized services are vastly preferable to expecting everyone to self-host.
Life is too short to be a sysadmin, unless you really like that, or unless it's your job.
The AT Protocol and Bluesky: For social media, Kleppmann described the AT Protocol underlying Bluesky, which he has advised on since early 2022. The protocol was designed around "credible exit," the principle that if a provider goes bad, users can switch without losing their username, social graph, or posts. Each user's data lives in a personal repository (analogous to a Git repo) hosted on a personal data server (PDS), and anyone can run a PDS. A relay aggregates events from all repositories into a firehose, and AppViews build indexes on top of it.
Every component can be run by competing providers. The user directory (PLC directory) remains centralized, but with cryptographic integrity protections and the option for community forks if it misbehaves. Bluesky is also taking the core protocols to the IETF for formal standardization, giving up corporate control in the process. There are now forty-three million users and a growing ecosystem of non-microblogging apps, blogging, social coding, video sharing, and book reviews, all built on the same protocol. For a deeper technical dive, Kleppmann pointed to the architecture paper he co-authored.
Local-first software: For collaborative tools, Kleppmann described local-first software as the combination of the best of Google Sheets (rich data, real-time collaboration, usability) with the best of Git (version control, branching, multi-provider hosting, files on your own machine). The core shift: the user's local copy of data becomes primary, with cloud services reduced to sync and backup. This minimizes the role of centralized servers, makes provider switching trivial, and even enables peer-to-peer sync.
The approach grew out of research into CRDTs (conflict-free replicated data types) and the open-source project Automerge, which Kleppmann co-created in 2017. The term "local-first" was coined in a 2019 essay that has since sparked a movement, with conferences, startups, podcasts, and a documentary with the Local-First Conference returning to Berlin in July 2026. Kleppmann noted that local-first works well for file editing and productivity tools but is not suited to systems that manage physical resources, such as bank accounts, where a centralized, authoritative source remains appropriate.
The connecting thread across all three, he said, is that commoditization and decentralization shift the balance of power. Dependency creates leverage, whether it's a country's gas supply or a company's cloud provider, and the engineering choices we make determine who holds that leverage.
Kleppmann concluded:
Using technology to give back power to the users enables greater freedom and changes the balance of power. That's maybe something for you to think about in your own work.