Of the organisations that faced a sovereignty issue over the past three years, 81 per cent had to provide formal proof of control. Although 82 per cent are confident they can do so, 26 per cent reach the highest level in a new index from IBM. AI-related problems are the most frequently cited challenge.
IBM published the research under the title Proof, Not Promises: The Digital Sovereignty Index. The Index maps the extent to which organisations retain control across four pillars: AI, technology, operations and data. The research also examines whether organisations can demonstrate that control when circumstances change or dependencies come under pressure. The study is based on an international survey of 2,003 senior decision-makers, supplemented by 25 interviews with policymakers, regulators and experts, insights from 17 customer representatives in five countries, and an analysis of 27 sources, including legislation, standards and academic research.
Of the organisations surveyed, 94 per cent faced at least one digital sovereignty challenge over the past three years. Examples include problems with AI vendors, conflicting regulations, supplier disruptions, export controls and data access issues. Of that group, 81 per cent had to submit formal proof of control to regulators, customers, auditors or internal stakeholders.
Six dimensions
The Index assesses organisations on six components. Accountability concerns who was responsible for what, while traceability concerns the ability to reconstruct what happened. Control is about proof that the controls in place worked, and intervention about response and recovery. Legitimacy measures whether organisations can explain decisions under critical scrutiny. Exit options concern demonstrating that an organisation can switch suppliers or restore its operations.
According to IBM, the problem usually lies not in a lack of control, but in the lack of an approach for demonstrating that control quickly under pressure. Only 33 per cent of respondents regularly test whether they can do so, for example as part of governance and control processes.
AI most frequently cited challenge
At 44 per cent, AI-related problems are the most frequently cited challenge. These include inaccurate AI outputs, limited explainability, model or vendor failures and shortcomings in governance. These are followed by formal audits or regulatory oversight (38 per cent), changes at key suppliers (35 per cent), problems with data access or transfer (33 per cent) and government restrictions such as export controls and sanctions (30 per cent).
Emmanuel Frenehard, Chief Digital Officer at Sanofi, argues that digital sovereignty is not a compliance checklist but part of how a business operates. As AI becomes further integrated into organisations, Frenehard says it is important for continuity to take its various aspects into account.
Confidence and practice diverge
On average, 82 per cent of respondents have a high to very high level of confidence in their ability to demonstrate digital sovereignty. Only 26 per cent reach the highest level of the Index. Organisations in that category are more likely to resolve their biggest sovereignty challenge without major disruption to operations: 52 per cent, compared with 22 per cent of organisations that are still building up their evidence.
Regular testing makes a difference here. Of the leaders, 63 per cent regularly or continuously test whether they can demonstrate sovereignty. Among organisations building up their evidence the figure is 29 per cent, and among those at an early stage it is 9 per cent.
The bottlenecks are mainly operational. More than half (56 per cent) cite the manual collection of evidence, or the time it takes, as an obstacle. A similar proportion (53 per cent) point to evidence being fragmented across teams and systems, reliance on third parties to supply data, and legacy systems or divergent standards. Half say that controls, recovery procedures and the ability to switch suppliers have not been sufficiently tested.
Jonathan Adashek, Senior Vice President and Chief Global Affairs Officer at IBM, says that executives must be able to show how they adapt, change their strategy or switch to another critical supplier when a business risk escalates into a sovereignty issue. According to Adashek, the next step is not more governance or regulation, but stronger proof that existing governance works. He cites testing the ability to switch, insight into critical dependencies and attention to the areas where loss of control has the greatest impact.
The full report is available at Proof, Not Promises: The Digital Sovereignty Index.
This article was originally published in Dutch on MSP Business. Read the original →
