The hard truth about digital sovereignty
Most enterprises are failing to translate talk into meaningful dependency mapping
Most organisations say they want greater control over their digital infrastructure, but this requires deep visibility and credible exit options. Most enterprises aren’t there. What’s the delay?
Research published recently by Capgemini suggests that whilst digital sovereignty is discussed more extensively and at higher levels than ever before, translating talk into action is rather more challenging.
The survey of 1,300 business and technology executives found that 93% of organisations have discussed digital sovereignty at board level, while 44% rank it as a top board priority. Nearly four in five are executing or building a strategy.
The greater profile of digital and data sovereignty reflects ever present anxiety about geopolitical disruption, supply chain concentration, regulatory pressure and dependence on a small number of technology platforms - most of which are US based.
Defining sovereignty
What constitutes sovereignty is not universally agreed. The UK, mainland Europe and APAC tend to associate sovereignty with risk mitigation and resilience, whereas US firms view it more through a compliance lens.
However, there is broad agreement globally that digital sovereignty cannot mean complete technological independence or, to put it another way, isolationism. A web of technology underpins global trade, finance, commerce - everything. Nobody is seriously suggesting unpicking it.
Two thirds globally therefore take a pragmatic approach and define digital sovereignty in terms of resilient interdependence, although this view is stronger in Europe (75%) than in the US (50%). Resilient interdependence is defined as tighter control of critical systems, data and suppliers, while still relying on external partners where full ownership would be too costly, slow or limiting.
Ambition versus reality
Having defined digital sovereignty as resilient interdependence, how far have organisations progressed in mapping dependencies and establishing how resilient they may or may not be? The answer is not as much you might expect given the prominence of the digital sovereignty narrative.
Capgemini’s Digital Sovereignty Index, covering 866 organisations across the US, Europe and APAC, found that 86% have significant exposure to foreign or externally controlled supply chains. However, only 14% have end-to-end visibility of dependencies across their wider technology ecosystem.
Paul-Henri Charrier, Director of Public Affairs and Strategic Partnerships at PaaS provider Upsun, drew attention to the gap between what businesses define as resilient interdependence and their lack of progress in the first steps to achieving it.
"Control and resilience should be the goal, and that depends on effective knowledge of the systems you rely on. The study shows only 14% of businesses have that knowledge. Step zero is taking inventory. You can't have a resilience strategy based on dependencies you've never mapped.”
More than a third (36%) of organizations report that transitioning away from a critical provider would take more than 12 months, while one in 10 say they have no viable alternative provider at all.
Cost remains a crucial part of sovereignty discussion. Fewer than half of those who contributed to the research are willing to pay a ‘digital sovereignty premium’ (of 23% on average).
The Capgemini research is mirrored by some Computing findings. When we asked enterprise IT leaders whether they were moving or considering moving workloads away from US or China-based cloud companies 17% had already done so, with a further 7% in the migration phase. 9% were still drawing up plans. This left more than two thirds of those responding either having rejected the idea of a migration, being so early in the process as to effectively make it meaningless or not knowing either way.
There was however some concern (expressed by approximately 40%) about dependence on a small number of cloud infrastructure or SaaS providers. You can see below what actions enterprises are taking to reduce that risk and most of these fit well into a resilient interdependence strategy.
Designing hybrid and multicloud architecture, and backup providers for critical systems as well as some exit strategies in the bag point to an acceptance that complete independence is neither feasible nor desirable.
Paul-Henri Charrier said: “Any business can only be as sovereign as the infrastructure it runs on and its underlying dependencies. The weakest layer sets the level. When only 57% of businesses prioritise cloud autonomy [as the Capgemini research found] the foundations simply aren't there.
“This becomes obvious when you consider that most companies take a year to leave a critical provider. The architecture, not the contract, is the constraint. The good news is that agentic AI, which is driving much of the concern around sovereignty, is also part of the solution: it makes deep replatforming dramatically faster and cheaper. Companies stuck in twenty-year-old dependencies finally have a way out, if they leverage these new solutions.”
Do enterprises trust ‘sovereign cloud’ services?
Fearful of a squeeze on their European revenues, most US cloud providers have set up sovereign clouds within the EU, with cloud infrastructure physically separated from their wider global cloud. The services are sold on the basis that data and operations remain within the relevant jurisdiction, allowing customers to remain compliant with legislation such as the EU Data Act or the GDPR.
But are these clouds truly sovereign? At best, it’s a moot point. Sovereignty (even if you define it as resilient interdependence) is about more than data storage or transfers or the location of infrastructure itself. Where is the underlying code base and knowledge of it located? Where do updates come from? How is security maintained? What happens in the event of an outage? Is it really feasible to think that the hyperscalers have managed to firewall all this functionality off from their global infrastructure or do they retain, as SVP and Europe Lead at sovereign cloud and AI provider Core42 Emma Cloney puts it, a “capacity for control?”
There was some interest in those Computing surveyed in Big Tech operated sovereign cloud services as you can see from the graphic below.
However, only 27% of enterprise tech leaders surveyed by Computing had some or a great deal of trust in sovereign cloud operators to keep data out of the hands of foreign governments.
The bigger picture
No conversation about enterprise sovereignty can occur in isolation of the sovereignty of national digital infrastructure.
US hegemony has been amplified by the increasing deployment of generative and agentic AI tools within enterprise – not just for productivity but also within operational technology. Matt Harris, MD of HPE, UK & I speaking at London Tech Week earlier this year made a persuasive case that as organisations turn to agentic AI tooling to support research, product development and decision making more broadly, we should stop asking where our data is stored and start asking who really owns the operational intelligence layer of numerous organisations.
AI has added another layer of complexity to an already complex infrastructure stack, but as Emma Cloney puts it, AI sovereignty is a function of the “capacity for control” of models and the underlying infrastructure. She explains:
“Sovereignty is fundamentally about whether a country retains the ability to choose where it deploys what model and if it can replace the technology that model depends on, “she says. “The criteria for sovereignty should be based on that capacity for control, rather than where one part of the AI infrastructure stack comes from.
“For example, Europe does not need to develop frontier models domestically in order to exercise meaningful sovereign control over AI. Sovereignty and self-sufficiency are two distinct aims. Beyond data residency, if Europe controls who manages infrastructure and keeps AI workloads under European jurisdiction, it gets closer to achieving AI sovereignty.”
For enterprises, then, digital sovereignty is less a destination than a discipline. Organisations need to know which dependencies matter, where control genuinely sits, and how quickly alternatives can be found if geopolitics, regulation or supplier failure forces the issue.
Resilient interdependence is a pragmatic path to sovereignty, but such a strategy requires deeper visibility of the dependencies already in place and credible exit options.