The initiative was driven by the realization that different departments within the university had their own interpretations of digital autonomy, making it difficult to align decision-making. Daaf helps shift the discussion from abstract concepts to concrete and measurable criteria, such as data portability, vendor lock-in, interoperability, and exit strategies.

The framework assesses applications based on three key aspects: the level of dependency on a supplier, the organization's ability to reduce that dependency, and the strategic importance of the application. This provides a nuanced view of actual vulnerability. A high degree of dependency does not necessarily represent a major risk if sufficient alternatives are available or if the application is not business-critical.

To achieve this, Daaf uses 22 indicators across eight dimensions. The assessment covers not only technical factors but also legal and organizational aspects, including contract terms, governance, and data accessibility.

The analysis results are then translated into four categories: optimal, manageable, attention required, or critical. This allows executives and IT leaders to quickly identify where action is needed. The framework goes beyond assessment by helping organizations develop a roadmap with concrete improvement measures.

During its development, the University of Utrecht learned that digital autonomy is much broader than an IT issue alone. Successful implementation requires involvement from the entire organization. The university also found that information about contracts, ownership, and systems is often fragmented, making a structured approach essential.