European Digital Resilience Index: September 2026

Date: September 30, 2026
Report version: 2.1
EDRIX version: 2.0
Press release: EDRIX September 2026: Germany Back in First Place, France Falls Five Places, and Europe's Top Websites Keep Moving to US Infrastructure

Executive summary

The European Digital Resilience Index (EDRIX) scores the 27 EU member states on four pillars computed from public data: developer ecosystem, grassroots adoption, private-sector resilience and public-sector resilience. This September 2026 edition is the second under EDRIX 2.0 and the first measured with the same pillars as the previous one, so it is the first that can be compared quarter on quarter. See Methodology for the data sources and the normalisation steps.

Three findings stand out:

• Germany returns to first place at 7.59, ahead of Finland (7.40) and Austria (7.38). The three leaders sit within 0.21 point.
• Almost every rank change comes from the private-sector pillar, which rates the web hosting, email and DNS of the 500 most-visited domains of each national TLD. France (7th to 12th), Croatia (10th to 13th), Luxembourg (12th to 9th) and Latvia (11th to 8th) all moved on that pillar. Portugal (20th to 24th) is the only one that moved on another pillar: its public-sector score fell from 5.56 to 2.78.
• Europe's high-traffic websites keep moving to non-EU providers. Among the 12,567 domains measured in both June and September, we counted about three moves to a non-EU provider for every move back.

Headline findings

Austria's score is almost unchanged (7.43 in June); Germany and Finland passed it. Below the top five, a middle band from 6.23 (Hungary) to 4.24 (Denmark) holds 14 countries: Hungary, Poland, Latvia, Luxembourg, Czech Republic, Sweden, France, Croatia, Netherlands, Cyprus, Slovakia, Bulgaria, Romania and Denmark. Ranks 6 to 12 are separated by 0.32 point, so a single official website changing provider can move a country by several places. Eight countries score below 4.0: Belgium, Lithuania, Spain, Ireland, Portugal, Greece, Italy and Malta. Portugal joined that group this quarter.

The full ranking with every pillar is on the home page. Each country has its own page.

What changed since June

Nine countries moved two places or more:

Pillar scores are min-max normalised across the 27 countries, so one country's change shifts the others slightly. Three measurement changes also apply this quarter. The private-sector sample is renewed from the latest top-1M list. The IP geolocation and ASN database was updated. More email security gateways (Proofpoint, Mimecast) and US transit operators are now classed as non-EU. Recomputed with June's scoring rules, France would rank 11th instead of 12th: the measurement changes explain only a small part of the movement.

Migrations across the EU line. For the 12,567 high-traffic domains measured in both editions, we counted every site that changed servers and, in doing so, crossed the line between an EU and a non-EU provider:

The drift is sharpest in Romania, Bulgaria, Greece and Estonia.

Five structural observations

1. The Czech Republic still leads on domestic private-sector hosting. The .cz sample keeps a perfect 10/10, with MasterDC, VSHosting, CASABLANCA INT, CESNET and Seznam.cz as the leading domestic hosts. Slovakia (9.72, with SWAN, VNET and WebSupport) and Hungary (9.25) follow. Even there, 32% of the measured .cz domains are hosted by non-EU providers.

2. Poland keeps the EU's highest sovereign browser share, 25.32% (Firefox + Opera combined) against 24.36% for Germany and 20.47% for Austria. Both leaders lost about half a point since June.

3. Four countries keep a perfect 10/10 on public-sector resilience: Austria, Croatia, Romania and Slovenia, unchanged since June. Every surveyed official domain (head of state, government, capital city) is EU-hosted and operated by an EU provider. Finland improved (6.11 → 7.22); Portugal fell to 2.78 after Lisbon's city website moved to a US provider. The other 22 countries have at least one official site on non-EU infrastructure.

4. The Netherlands paradox persists. The Netherlands has the EU's highest per-capita developer density (5.66, normalised to 10.0) and a private-sector score of 4.25, among the eight lowest in the EU. Of the 489 measured high-traffic .nl domains, 58% are hosted outside the EU, 56% on US-controlled providers: Cloudflare (19%), Amazon (13%), Akamai (10%), Microsoft (6%) and Google (3%). For email, the non-EU share reaches 72%. The domestic hosting that remains is led by SURF, Signet, Your Hosting and LeaseWeb. The country has the talent to host its businesses at home. Most of them are hosted abroad.

5. Ireland's paradox is structural. Ireland ranks seventh on developer ecosystem (6.84) and scores zero on private-sector resilience. Of the 489 measured .ie domains, 80% are hosted outside the EU, 75% on US-controlled providers and 3% on UK providers. Dublin hosts the European data centres of AWS, Google and Microsoft, so Irish domains often run on Irish soil under US control. The index scores by the company that owns the network, so this shows up as low sovereignty even though the bytes stay in Ireland.

How to read the index

EDRIX is a 0–10 composite, the arithmetic mean of four pillar scores, each itself min-max normalized across the 27 member states. A country scores 10 only by leading the EU27 in every pillar; a country scores 0 only by trailing in every pillar. Movement of less than 0.2 points between editions should be treated as noise. Movement above that is a real signal, to be examined per pillar.

The four pillars read as follows:

• Developer Ecosystem: density of the country's GitHub developer community relative to its population.
• Grassroots Adoption: combined Linux share on desktops and laptops and Firefox + Opera browser share among human visits.
• Private sector resilience: sovereignty rating of the web hosting, email and DNS of the 500 most-visited domains in the country's national TLD (excluding non-EU-owned brands).
• Public sector resilience: sovereignty rating of the country's official domains (head of state, government, capital city).

See Methodology for the underlying data sources, the normalization steps, and the methodology-history section that documents what changed between EDRIX 1.0 and 2.0.

Editions and archive

Each edition is archived as published, with its press release:

Comparisons with the 1.0 edition are valid only after applying the retroactive corrections documented in the methodology page. The ranking history of every country, including the studies of 2010, 2020 and 2023 that preceded the EDRIX, is on the timeline.