The Sovereignty Gap: Why European Organisations Are Investing Before They Are Ready
Digital sovereignty has moved from a specialist concern in IT and public policy to a topic discussed in boardrooms. Geopolitical tensions, dependence on foreign technology providers, new European regulation and growing reliance on artificial intelligence have made control over digital infrastructure a business issue.
The direction is clear. Organisations want more control over their data, technology and critical services. However, recent research suggests that many are still working out what this means in practice, who should be responsible for it and how much they are prepared to invest.
This creates a gap between sovereignty as a strategic ambition and sovereignty as an established organisational capability.
Digital sovereignty has reached the boardroom
The Capgemini Research Institute’s 2026 report, based on a survey of 1,300 executives worldwide, indicates that digital sovereignty is now receiving attention at the highest levels of organisations. According to the report, 93% of organisations have discussed the topic with their boards.
This does not necessarily mean that digital sovereignty has become a clearly defined business priority. Board-level discussion can range from a general response to geopolitical developments to detailed decisions about infrastructure, suppliers and operating models.
The findings nevertheless indicate that sovereignty is no longer limited to the concerns of infrastructure architects, security teams or public-sector policymakers. It is increasingly connected to business continuity, risk management and long-term technology decisions.
Operational resilience is one of the strongest motivations. Eighty per cent of the organisations surveyed by Capgemini identified it as a reason for pursuing digital sovereignty. Other motivations include reducing dependency, improving auditability, maintaining flexibility and retaining long-term control over artificial intelligence.
This emphasis on resilience is important. Organisations are not necessarily pursuing sovereignty because they want to operate every part of their technology stack independently. They are concerned about whether they can continue operating when a supplier, jurisdiction, platform or geopolitical relationship changes.
Investment is moving faster than formal strategy
The growing attention is also reflected in spending plans.
Capgemini reports that 79% of organisations are either executing a digital sovereignty strategy or developing one. Thirty-six per cent already have a strategy in place, while 65% have allocated formal budgets to digital sovereignty-related activities.
The budgets are not always separate sovereignty programmes. In many cases, investment is included in IT modernisation, risk and compliance work or broader investment programmes. This is understandable because sovereignty-related decisions often overlap with existing infrastructure, security and cloud transformation projects.
However, it also makes it more difficult to determine how much an organisation is actually investing in sovereignty and what outcomes it expects from that investment.
The Nordic picture is somewhat different. Vivicta’s 2026 study, which surveyed 320 respondents in Finland, Norway and Sweden, found that 70% expect investment in digital sovereignty to increase over the next 12 months. In Finland, the figure was 74%.
At the same time, only 46% of Nordic respondents said that their organisation has a formal and explicit digital sovereignty strategy. Forty-two per cent address the topic implicitly, while 12% have no strategy at all.
These findings should not be read as contradictory. Organisations can invest in relevant technologies, review suppliers and introduce new controls without having a single document called a digital sovereignty strategy.
The difference matters, though. Investment can address immediate risks, while a formal strategy should help an organisation make consistent decisions across business units, workloads and technology generations.
Without that broader framework, sovereignty can become a collection of separate initiatives rather than a coherent organisational capability.
The readiness problem is more than a missing document
It would be easy to interpret the gap between investment and formal strategy as a governance problem. Some organisations may indeed need clearer ownership, objectives and decision-making processes.
The situation is likely more complex.
Digital sovereignty cuts across several areas that are traditionally managed separately. Data governance, cybersecurity, cloud architecture, procurement, legal compliance, business continuity and AI governance all contribute to an organisation’s level of control.
A company may have strong data classification but limited control over the infrastructure hosting its systems. It may have contractual protections but depend on a provider’s proprietary services. It may have a cloud exit plan but lack the technical capacity or alternative suppliers needed to execute it.
This makes sovereignty difficult to assess through a single maturity score or a simple question about whether an organisation has a strategy.
The Capgemini report illustrates the breadth of the issue by identifying several dimensions of digital sovereignty. Data and cybersecurity are the most frequently mentioned, followed by cloud, software, AI, hardware, connectivity and energy.
The inclusion of energy is notable, even though it is less frequently prioritised than data or cybersecurity. Infrastructure dependencies are not limited to ownership and jurisdiction. They can also involve access to electricity, physical facilities, networks and the resources required to operate digital services.
A useful assessment therefore needs to look at the dependencies that could affect a particular organisation, rather than assuming that sovereignty has the same meaning for every company.
Few organisations can control everything
One of the most significant findings in the Capgemini study is that 59% of respondents consider full digital sovereignty unrealistic.
This reflects a practical constraint. Modern organisations depend on international technology ecosystems, specialised suppliers and global infrastructure. Attempting to control every component can be expensive, slow down innovation and create new operational responsibilities.
As a result, many organisations are considering more selective approaches. Some focus on building core capabilities internally while collaborating with external partners. Others rely on ecosystems and consortia. A smaller group primarily builds in-house, while some organisations continue to depend largely on external partners and shared platforms.
The relevant question is not necessarily whether an organisation is fully sovereign. It is which dependencies it considers acceptable, which it considers critical and what options it retains if circumstances change.
This is where the distinction between sovereignty and independence becomes useful.
An organisation may deliberately depend on an external provider for a non-critical service while maintaining control over its most sensitive data, key operational processes and ability to change suppliers. Another organisation may accept the same provider for ordinary workloads but require different arrangements for systems supporting essential services.
The decision depends on the organisation’s risk profile, regulatory obligations, resources and business priorities.
The cost of control is becoming a management question
Digital sovereignty can create additional costs. Alternative providers may have smaller geographic footprints, fewer integrated services or less favourable economies of scale. Moving away from a dominant platform can also involve migration work, retraining and changes to operating processes.
The Capgemini study suggests that organisations are prepared to consider these costs, but not without limits. Forty-nine per cent of respondents said that they would be willing to pay a premium for digital sovereignty. Among those willing to pay, the average accepted premium was 23%.
The same respondents also identified conditions that influence their willingness to make this trade-off. Vendor choice, performance and the pace of innovation remain important. Seventy-one per cent identified sufficient vendor choice as a non-negotiable requirement, while 62% highlighted performance and 47% the pace of innovation.
This suggests that sovereignty decisions cannot be reduced to a question of choosing European providers over non-European ones. Organisations still expect technology to meet business requirements.
A provider may offer a favourable jurisdictional arrangement but fail to meet performance, availability or functionality requirements. Conversely, a technically capable provider may introduce dependencies that the organisation considers unacceptable in the long term.
The practical decision is therefore about the relationship between control, cost, performance and flexibility.
An organisation needs to understand what it is buying with a sovereignty investment, which risks the investment reduces and which new limitations it may introduce.
Confidence in control remains limited
The Nordic findings raise another concern: organisations are investing in sovereignty while many remain uncertain about their actual level of control. Only 29% of respondents in the Vivicta study reported high confidence in their control over critical data. This is a more direct measure of organisational confidence than the existence of a strategy or the size of an investment budget.
The result does not prove that most organisations lack adequate safeguards. Confidence is subjective, and the survey does not establish whether the respondents’ organisations would fail specific technical or legal assessments.
It does indicate, however, that many organisations do not have a high level of certainty about their control over critical data.
That uncertainty can arise for several reasons. Organisations may not have complete visibility into subcontractors and technical dependencies. They may be uncertain about where data is processed, which legal regimes could apply or how quickly they could move a workload to another provider.
They may also have different levels of control across different systems, making an organisation-wide answer difficult.
This is one reason why sovereignty should be examined at the level of actual services and dependencies. A general statement that a company uses a European cloud provider says relatively little about the control arrangements of an individual application.
From broad ambition to explicit decisions
The research points towards a more practical way of approaching sovereignty. Organisations do not necessarily need to pursue the same target or adopt the same operating model.
They do need to be explicit about their choices.
For each important workload, leadership should be able to explain what must remain under organisational control, which dependencies are accepted and what would happen if a provider became unavailable or unsuitable.
This does not require every organisation to produce a detailed sovereignty plan for every system immediately. It does require a way to distinguish between critical and non-critical dependencies and to connect technology decisions with business consequences.
The Vivicta study provides an indication that some organisations are moving in this direction. Seventeen per cent of respondents already apply different sovereignty levels to different workloads, while another 17% have not yet assessed their sovereignty requirements. Critical-sector organisations were more than twice as likely to use a differentiated workload approach as other organisations.
A workload-based approach is not automatically the right answer for every organisation. It can, however, provide a more realistic basis for decision-making than treating sovereignty as a single organisation-wide condition.
It also makes trade-offs easier to discuss. A company may decide that some services require strict control over data and infrastructure, while others can use standard international platforms with appropriate contractual and security safeguards.
The important point is that these decisions should be deliberate rather than simply inherited from existing suppliers and architectures.
What the findings tell us—and what they do not
The surveys show that digital sovereignty is gaining attention, that investment intentions are increasing and that many organisations are developing strategies or related initiatives.
They also show that formal governance and confidence in control have not progressed at the same pace everywhere.
The findings do not establish that organisations with formal strategies are necessarily more secure or more sovereign than those without them. Nor do they show that one national market or operating model has solved the problem.
Survey responses reflect how organisations perceive their own situation. They are useful for identifying trends, priorities and areas of uncertainty, but they cannot replace a detailed assessment of an organisation’s technology, contracts, processes and dependencies.
This distinction is particularly relevant when comparing countries or sectors. Differences in strategy adoption may reflect organisational size, regulatory exposure, industry structure or different interpretations of digital sovereignty. They should be treated as signals for further investigation rather than definitive measures of performance.
The next phase is about making sovereignty operational
Digital sovereignty has clearly become a topic that organisations need to address. The more difficult question is how to translate broad concern into decisions that can be evaluated and maintained.
The current evidence suggests that many organisations are still in this transition. They are discussing sovereignty at board level, allocating budgets and reviewing technology dependencies, but not all have established formal strategies or a high degree of confidence in their control over critical data.
That is not necessarily a failure. Sovereignty is a complex and evolving issue, and organisations are responding to different risks and constraints.
It does mean that investment alone is not enough. Organisations need to understand what their investments are intended to control, which dependencies they are willing to retain and how they will know whether their decisions have reduced business risk.
The central question is no longer simply whether digital sovereignty matters. It is whether an organisation can demonstrate where it has control, where it remains dependent and why those dependencies are acceptable.
Questions for readers
-
Does your organisation have a formal digital sovereignty strategy, or is the topic addressed through separate IT, security and procurement initiatives?
-
How much confidence do you have in your control over critical data and services?
-
Are sovereignty requirements defined separately for different workloads, or do they follow a single organisation-wide policy?