By Janus Boye

On stage at CloudFest 2026, where AI and digital sovereignty reshaped the conversation.

The conversations shaping the future of the web are shifting.

At CloudFest last month in Germany, with its sheer scale, that became easier to see. Two topics stood out across almost every conversation: AI and digital sovereignty.

AI is no longer discussed as experimentation. It is shaping expectations, roadmaps, and investment decisions. At the same time, digital sovereignty is moving from policy discussions into practical concerns about dependency, control, and local alternatives.

This is where attention is, and where budget is flowing.

Yet something more fundamental is changing. The real shift is structural. It concerns who controls the systems we depend on, how ecosystems are governed, and where value is created. In open source, initiatives like FAIR point to new ways of organising shared responsibility, and new ways to create and capture value within the ecosystem.

CloudFest was new to me this year, and hard to ignore. The conference takes over an entire theme park, Europa Park, with thousands of people moving between sessions and conversations.

What stood out, however, was not just the size, but the direction of the conversations. The same pattern kept resurfacing across sessions, hallway discussions, and informal exchanges.

The signals are already there, if you look in the right places.

The shift is happening right now

My usual lens is digital experience and the application layer. At CloudFest, it became clear that the forces shaping that space are now defined further down the infrastructure stack.

AI and digital sovereignty dominated conversations, showing up in almost every session and across the exhibition hall.

AI is raising expectations around speed, automation, and capability, while sovereignty is introducing limits around where data lives, which providers can be used, and how dependencies are managed.

Taken together, they are reshaping how decisions are made.

From my session on The WordPress Marketplace in Context. I used the private photo to illustrate hw LEGO moved from wooden toys to plastic toys

Organisations are being pulled towards more powerful, integrated platforms, while at the same time needing to retain control and reduce reliance on them. In practice, this changes how solutions are designed, evaluated, and selected.

What used to be framed as feature or platform choices is now influenced earlier in the process. Infrastructure, compliance requirements, and AI capabilities define what is viable before traditional comparisons even begin.

The shift is not just visible in conversations. It is visible in how priorities are set and how investments are made.

From scale to control

For a long time, the industry has optimised for scale. The focus has been on reach, performance, and efficiency, with platforms competing on features, ecosystems on breadth, and organisations on how quickly they can deliver.

That logic is now being challenged.

At CloudFest, conversations repeatedly returned to questions that were not primarily technical. Which dependencies are acceptable? Where does control actually sit? What happens when infrastructure or platforms change direction?

Digital sovereignty brings these questions into day-to-day decisions. It introduces constraints that cut across architecture, procurement, and governance.

Two topics stood out across almost every conversation: AI and digital sovereignty.

What used to be a question of capability is becoming a question of control.

For organisations, this changes how platforms are evaluated and how risk is understood. For agencies, it changes how solutions are positioned and where differentiation comes from. The criteria are no longer only functional, but structural.

Power is moving down the stack

One of the more consistent patterns is a change in where decisions are actually being shaped.

If you have followed the industry over the past decade, much of the conversation has been framed in terms of CMS categories such as DXP, headless, composable, and more recently agentic. These remain useful labels, but they describe only part of the system.

At CloudFest, it became clearer that they describe only part of the story.

In practice, the decisive layer is moving down the stack. Infrastructure, hosting platforms, and increasingly AI capabilities are shaping what is possible, what performs, and what integrates. Infrastructure is no longer a passive container, but an active and opinionated participant in how systems behave.

One way to think about this is the transition from the Deutsche Mark to the Euro. The visible change was the currency. The more important change was where control moved. A similar pattern is emerging here. The visible layer still looks familiar, but the decisions that shape outcomes are being made elsewhere.

This has a direct implication. Lock-in has not been removed. It has shifted.

Decisions that appear to be made at the CMS or application level are often constrained by choices made earlier in the stack. Those constraints are less visible, but more influential, and they increasingly determine which options are viable in the first place.

A recurring question throughout the week: what happens to the open web under these shifts?

Ecosystems under pressure

These shifts are exposing structural weaknesses in CMS ecosystems such as WordPress, Drupal, and TYPO3.

Fragmentation, inconsistent quality, and overwhelming choice are not new. What is changing is how directly they affect outcomes, and how visible they have become.

Different ecosystems are responding in different ways. WordPress has historically prioritised openness and scale, enabling a vast library of plugins for almost everything, but placing more responsibility on those assembling solutions. TYPO3 has taken a more curated approach, with a smaller and more tightly vetted set of extensions.

Drupal combines stronger governance with flexibility, but faces similar pressures as complexity increases. The recent push around Drupal CMS reflects an attempt to offer a more structured, yet still flexible, experience for marketers.

The underlying problem is the same, but the experience of working within each ecosystem differs significantly.

These differences shape how solutions are assembled, how quality is ensured, and how risk is managed.

This is already visible in how agencies operate. The traditional model of selling hours is under pressure, as assembling solutions across fragmented ecosystems becomes harder to standardise and scale. In response, there is a move towards value-based positioning, increased verticalisation, and a clearer focus on differentiation.

At the same time, expectations are rising. Clients expect coherence, reliability, and integration across increasingly complex stacks, regardless of how fragmented the underlying ecosystem may be.

The gap between how ecosystems are presented and how they function in practice is becoming harder to manage. Managing that gap is becoming a central part of the work for both organisations and agencies.

In some ecosystems, this is now leading to more explicit efforts to coordinate, curate, and take shared responsibility. This is where initiatives like FAIR begin to make sense.

Real collaboration is emerging: FAIR in practice

Alongside these pressures, a different approach is beginning to emerge.

At CloudFest, one example was the FAIR Package Management for TYPO3 project.

FAIR proposes a model where responsibilities such as validation, signing, and distribution are not centralised in a single place, but coordinated across participants. This allows organisations to work with curated subsets of extensions while still benefiting from the broader ecosystem.

For more background, see this piece from CMS Critic:
All’s FAIR in Love and War: New FAIR Package Manager Aims to Bring Peace to the WordPress Ecosystem
(June 2025)

At its core, this addresses a familiar challenge. As ecosystems grow, the question is no longer just what is available, but what can be trusted and how that trust is established. Who validates extensions? How is quality ensured? How do you maintain consistency across a distributed ecosystem?

The project itself emerged from the CloudFest hackathon and was recognised with an award, reflecting both the relevance of the problem and the level of interest across the community.

The initiative builds on earlier work in the WordPress community, where many of the same challenges around scale, trust, and dependency have been playing out for years. As one description puts it, the ambition is to bring more “peace” to ecosystems shaped by fragmentation and competing approaches.

This goes beyond tooling. It changes how responsibility is organised across the ecosystem.

FAIR points to new ways of organising shared responsibility, and new ways to create and capture value within the ecosystem. It makes explicit what has often been implicit: that coordination, curation, and trust require structure.

It is still early, but it addresses a growing and visible need. As ecosystems become more complex, informal coordination is no longer sufficient.

Infrastructure is no longer neutral

A recurring theme throughout the week was the changing role of infrastructure.

Infrastructure used to be understood as a supporting layer that hosted, scaled, and delivered. Increasingly, it shapes outcomes.

Hosting platforms, edge networks, and AI layers influence architecture, performance, and integration patterns. They also influence which ecosystems gain traction, and which approaches are viable in practice.

At CloudFest, this showed up repeatedly. Infrastructure is no longer just hosting the web. It is shaping which platforms succeed.

Control is not disappearing. It is concentrating in layers that are often less visible to those making decisions at the application level.

This is also where digital sovereignty becomes practical. Questions about where data lives, which providers can be used, and how dependencies are managed are no longer abstract. They are increasingly determined by infrastructure choices.

This creates a structural disconnect. Responsibility for outcomes often sits with teams working higher up the stack, while control is exercised elsewhere.

For organisations, this raises a practical question: if control moves down the stack, where should attention and governance follow?

These are the kinds of conversations that are beginning to shape the future of the web.

Learn more

CloudFest is a big thing. It does not create these shifts, but it makes them easier to observe. For more in the big topic of digital sovereignty, see this recent post: Digital Sovereignty 2026: Some Assembly Required

If you are interested, you can download my CloudFest presentations:

The conversation also continues in our peer groups and at our conferences.