The โbuild, not buyโ point is right, but only for core mission software: the systems an agencyโs actual purpose depends on. If that capability is bought from a foreign vendor, the agency is effectively renting its own muscle.
For everything else, building in-house is not sovereignty. It is usually waste. Agencies should not be writing their own analytics tools, email servers, or generic back-office software just to feel independent.
That layer should be bought, but bought carefully: European or open-source where possible, with open formats, export rights, and the ability to fork or self-host if the vendor changes direction.
So it is not one rule. It is two layers: build the software that is your core capability, and procure the rest in a way that avoids lock-in. Both are part of keeping capability in Europe.