Language
Replacing an outdated DAM in Europe is now also a matter of data control, a topic the European debate sums up with the term digital sovereignty. Before switching systems, it’s worth checking five concrete points: where content is physically hosted, who can access it, whether every action leaves a verifiable trace, how the transition from the old system to the new one works, and what the vendor puts in writing on these topics.
The European regulatory framework, from the GDPR to the Data Act and the tech sovereignty package proposed by the Commission in June 2026, keeps these topics firmly in focus, particularly for organizations managing digital assets and product data distributed across multiple channels.
An outdated DAM rarely shows its age through a slow interface. It shows its age when someone asks where the data is hosted and nobody in the company can answer with any certainty.
On June 3, 2026, the European Commission presented the European Technological Sovereignty Package, a set of measures to strengthen Europe’s capacity in semiconductors, artificial intelligence, cloud and open source. It includes the proposed Cloud and AI Development Act, which would introduce a single EU-wide framework for assessing the sovereignty of cloud and artificial intelligence. As these are proposals, the final text is still to be defined.
For organizations managing digital assets, this translates into very practical questions during contract renewals and procurement processes: where the servers are located, who administers them, and what access guarantees are in place.
The first question to ask when looking to replace a DAM concerns data residency: where the servers are located and, if data leaves the European Economic Area, on what legal basis the transfer to third countries takes place.
The rules on transfers to third countries are set out in Chapter V of the GDPR (Articles 44 and following): a transfer is normally based on an adequacy decision by the European Commission (Art. 45) or, failing that, on appropriate safeguards such as standard contractual clauses (Art. 46). The European Data Protection Board (EDPB) complements these rules with interpretive guidelines and practical guidance.
A generic GDPR compliance declaration says little. The GDPR requires relying on vendors that offer sufficient guarantees (Art. 28) and being able to demonstrate compliance (Art. 5(2)): that is why clear contracts, well-defined operational responsibilities, and certifications issued by independent third parties matter, such as ISO 27001 for information security and ISO 27018 for the protection of personal data in cloud services.
Modernizing asset management starts from a specific point: making explicit the permissions that were previously left to memory or trust. A mature system assigns a precise identity to every user, defining what each person can view, edit, or share for every asset and every folder. It’s the difference between “anyone in the company can access everything” and “I know exactly who can do what.”
Traceability goes hand in hand with this: every publication, edit, or share needs to be recorded in a queryable log, not reconstructed from memory during an audit. The same principle applies to AI-generated content, where you need to know what was produced, by whom, and when. We cover this in our in-depth piece on the AI Act.
Platforms like THRON build both of these layers as native parts of the architecture: an identity and access management system covering users, partners, and applications, alongside an activity log that is always available for review. THRON is also certified ISO 27001 and ISO 27018 by independent third-party bodies and operates in compliance with the GDPR.
A legacy custom DAM tells a familiar story: years of bespoke customizations, often built by people who no longer work at the company, with little or no documentation to show for it.
Two references help give shape to this demand for evidence: control A.8.15 of ISO/IEC 27001, dedicated to event logging (the so-called logs), and the GDPR accountability principle (Art. 5(2)), which requires being able to demonstrate compliance. In both cases you need evidence that is already prepared and consistent over time, before anyone asks for it.
These systems accumulate a silent debt: they work fine until someone asks you to prove their compliance. The moment that request arrives, usually from a client, an auditor, or a regulatory authority, is the worst possible time to discover the gaps.
Before signing a new contract, it makes sense to ask your vendor some direct questions. The Data Act, applicable since September 12, 2025, points the same way: for cloud services, software as a service (SaaS) included, it sets out rules protecting customers who switch vendors and abolishes switching charges from January 12, 2027. Here are some questions to have ready:
Organizations that come to these questions with ready answers turn control over their data into a competitive advantage, in a market where clients and partners increasingly ask for guarantees on these topics.
The right time to switch, without paying twice
Run your current DAM alongside THRON and migrate at your own pace: in the first year, you only pay 30% of the subscription fee.
Knowing and being able to demonstrate where data is stored, who accesses it, and with what guarantees it is processed, rather than relying on a vendor’s generic compliance statement.
Often access metadata: who viewed, downloaded, or modified an asset. Without a structured log, this information may not exist at all.
It depends on the volume of assets and the extent of any undocumented customizations. A system that connects via API to the existing one allows you to proceed in phases, on the organization’s own timeline.
That’s useful information in itself: without logs, reconstructing what happened in the event of an incident or audit becomes significantly more difficult.
No, if the new system runs alongside the existing one. There are transition paths designed specifically to avoid carrying two full costs in parallel during the switchover.
