Survey of 2,100 leaders finds wide gap between sovereignty awareness and readiness

From awareness to readiness

The survey covers eight markets in Europe and Asia. It follows a study from a year earlier that measured awareness of data sovereignty among industry, research and government experts. According to the blog, last year's work gauged awareness, while this year's measures readiness.

The authors describe a "stark gap between awareness and readiness." Sovereignty as a priority is not in question, they say, but operational preparedness is another matter. One figure stands out: 93% of respondents say data management is critical to sovereignty, yet the authors say most organisations have not laid that foundation.

The blog points to fragmented, sprawling data estates as a long-standing concern among customers. AI did not create the problem, it says, but has made the risks unsustainable as organisations deploy frontier AI models and data pipelines that move data across jurisdictions by default.

Regulation is moving from privacy to control

The post lists a growing set of frameworks. Beyond the GDPR, it cites the EU's broader data strategy, the European Technological Sovereignty Package and the Digital Operational Resilience Act (DORA). India's Digital Personal Data Protection Act phases in through 2027, and ASEAN's Digital Economy Framework Agreement (DEFA) heads for signature in November. In the survey, 55% of leaders say they cannot keep pace.

The authors say the focus of regulation is shifting. Older rules asked privacy questions such as consent, processing and breach notification. Newer ones probe control and resilience: who can be compelled to hand over data, whether a service can be withdrawn, and how dependent an organisation is on foreign providers. These are inventory questions, the blog argues, that an unmapped estate cannot answer.

Its proposed answer is one accurate data map that can serve every regulator. Leaders ranked visibility and control over data access at the top when assessing cloud sovereignty, alongside encryption, compliance and AI governance. The authors say the prioritisation is right but the execution is lacking.

Pragmatism over residency

The blog calls data residency "a passive proxy for sovereignty" and says true sovereignty means visibility, governance and ownership of the data estate regardless of where it sits.

The survey suggests respondents are pragmatic:

• 85% would give up advanced features to use a local or sovereign provider.
• 87% prioritise local or sovereign environments for high-risk AI workloads.
• Only 20% cite concentration risk on overseas providers.
• 39% say sovereign AI adds operational complexity.

The authors expect the AI build-out to be a balance of sovereign and public infrastructure, with the most sensitive workloads pulled into sovereign environments. They cite one global design customer building sovereign versions of its SaaS tools, segmenting customers through encryption and a dedicated compute boundary.

Five steps to sovereignty by design

The post recommends what it calls "sovereignty by design," shifting from national to corporate sovereignty based on an organisation's own risk appetite. Some data needs sovereign environments, it says, while much can stay with global cloud and SaaS partners. Its five steps are:

• Achieve visibility and control: know what data exists, where it resides and who can access it.
• Tier by risk, not by category: define the "Minimum Viable Company," the smallest set of services, data, applications and staff needed to keep operating through a disruption, then rank data and applications by strategic value and legal exposure.
• Build a sovereign AI foundation: prioritise sovereign environments for sensitive, high-risk AI data and workloads.
• Let the board own it: only 19% say their strategy is board-driven, 36% struggle for executive buy-in and 56% lack the skills to execute.
• Make procurement and sovereignty one conversation: judge providers on jurisdictional control and plan exit paths, data portability and key custody terms early.

What it means for organisations

The findings point to a gap between stated priorities and practical capability, especially in governance and skills. The authors argue that treating sovereignty tactically, one regulation at a time, leaves organisations scrambling. With a data-centred strategy, they say, organisations can meet changing regulatory demands quickly and accelerate AI initiatives because the data is understood and ownership is clear. The report is promoted by a storage vendor, so its conclusions reflect the company's own view.