Smart cities in Europe are entering a phase in which it is no longer enough to demonstrate technology through successful pilot projects. The challenge has become operational and strategic: ensuring that critical urban services are built on resilient digital infrastructures, with effective control over data, operational continuity, cybersecurity and capacity for evolution. Technological fragmentation, vendor lock-in, the lack of true interoperability and the difficulty of turning data into consistent public value are becoming central obstacles, particularly when scale, transparency and trust are required in increasingly demanding regulatory contexts.
At this point, European sovereignty ceases to be an abstract concept and becomes a practical necessity. The Strategic Technologies for Europe Platform STEP, in force since 2024, seeks to accelerate and direct European investment towards strategic technologies, strengthening industrial capacity and reducing critical dependencies. It aims to create the conditions for Europe to develop, produce and scale technology with reduced exposure to external risks and greater capacity for large-scale adoption. In Portugal, this ambition is gaining particularly visible traction, as STEP begins to be operationalised at national level, moving from the European framework to concrete funding and implementation instruments, notably through Portugal 2030, with thematic and regional programmes and calls explicitly identified as STEP. The existence of these calls, public information sessions and roadshows planned for 2026 demonstrates that the STEP label and its respective rules are being systematically applied within national mechanisms, bringing the European agenda closer to on-the-ground execution.
In parallel, and within the same timeframe in which STEP begins to translate ambition into execution, EuroStack, commissioned by Bertelsmann Stiftung and supported by European public policy and research organisations, was publicly presented as a proposal to structure European digital sovereignty through a common stack. In practical terms, it advocates a coherent set of interoperable, secure and portable layers and components capable of operating critical digital services with greater control and operational continuity. It promotes standards, reusable building blocks and a multi-vendor ecosystem, rather than isolated and proprietary solutions.
Within this framework, the criterion becomes straightforward: any smart city solution must demonstrate that it is operable, auditable and scalable, without technological lock-in and with data governance applicable in daily operations. It is this discipline, over the course of this decade, that will enable the consolidation of public digital infrastructures, support sovereign data sharing, responsible AI and operational Digital Twins, without compromising competitiveness or alignment with global standards.
In the field of smart cities, CCG ZGDV organises its work around six pillars, understood as priority capability areas for transforming dispersed initiatives into operable and scalable public digital infrastructures. These pillars are aligned with the momentum of STEP and the common stack logic advocated by EuroStack. They are not a universal model nor a normative taxonomy. They represent a pragmatic way of guiding investment and technological curation, ensuring that each project contributes to operational sovereignty, interoperability and trust, rather than reinforcing silos or dependencies.
These pillars help to make the discussion around smart cities more concrete and less rhetorical. Instead of yet another platform, the goal is to build mutually reinforcing urban capabilities that enable cities to operate with confidence. Distributed Urban Infrastructure and Trusted Connectivity is the unavoidable foundation. Without distributed infrastructure, robust connectivity and end-to-end observability, any ambition for real-time data, automation or digital twins remains limited to fragile demonstrations. It is at this level that it is determined whether a city can keep critical digital services operational, with redundancy and effective control over how systems degrade and recover when failures occur.
In practice, however, the second pillar, Cybersecurity and Operational Resilience for Urban Digital Systems, determines whether transformation is sustainable. The city is a vast attack surface, with long supply chains and multiple operators. Security ceases to be a checklist and becomes an operational function involving risk management, continuous evidence, hardening, updating, segmentation and audit readiness, with clear responsibilities between municipalities, utilities and suppliers. Without this, the smart city accumulates fragility and invisible dependencies, the opposite of the intended trust and sovereignty.
From there, a dimension must be addressed with clarity. Operational Urban Intelligence and AI Governance. Artificial Intelligence is already being used to address complex challenges in mobility, energy, maintenance, incident detection and operational response. The issue is that without governance, AI amplifies opacity and risk. It is not about building more models, but about ensuring data traceability, performance and bias monitoring, explainability where required, human oversight and capacity for intervention, including when intelligence is distributed at the edge. The objective is to enable automation with control and accountability, not merely apparent efficiency.
This ambition to operate critical services with continuity, resilience and governed AI collapses if cities continue to integrate on a project-by-project and bespoke basis. For this reason, Interoperability and Semantic Governance becomes a decisive front, even when it is politically less visible. Interoperability is not merely about APIs. It involves semantics, data contracts, information models and governance of evolution. It allows mobility, environment, energy and territorial systems to speak the same language, enables suppliers to change without collapsing integrations and prevents cities from becoming technological islands. This pillar is often the greatest multiplier of scale, as it drastically reduces the cost of integrating and reintegrating and transforms integration into a reusable asset.
In parallel, Data Governance and Trusted Data Sharing Ecosystems addresses what is done with data once a technical foundation for its movement exists. The principle is not indiscriminate access to data, but the creation of trusted ecosystems for sharing and reuse, including access policies, usage control, catalogues, data quality and provenance, trust mechanisms and federation between entities. This pillar enables the transition from delayed reporting to operational decision-making, and from isolated projects to inter-municipal and cross-sector collaboration with clear rules.
Finally, the pillar of Operational Digital Twins and Multi-City Replicability closes the cycle and reveals the maturity of the urban ecosystem. The objective is to transform use cases into capabilities that can be replicated across cities. An operational digital twin is not a 3D mock-up. It is a living system, connected to data, processes and decision-making, capable of simulating, predicting, testing scenarios and supporting daily operations.
The multi-city dimension marks the difference between an innovation that succeeds in one territory and a capability that responds concretely to the demands of European transformation, namely replicability with controlled cost and risk, comparability of results and alignment with standards. This requires packaging solutions, consistent metrics, reusable components and compliance profiles that allow an approach validated in one city to be adopted in another without starting from scratch, while preserving interoperability, governance and operational continuity.
The central idea is that these pillars are not a checklist to be fulfilled. They are a way of choosing priorities and avoiding two recurring traps. Technophilia driven by endless pilots and fragmentation through silos. By looking at smart cities through these pillars, it becomes easier to discuss what is missing, what unlocks large-scale replication and which interventions must be treated as public digital infrastructure, with operational continuity, governance and capacity for evolution.
Opinion piece by Nuno Soares, Senior Researcher in Software Engineering at the CCG/ZGDV Institute
