IBM finds an ‘overconfidence gap’ in enterprise digital sovereignty
IBM says most enterprises have faced a digital sovereignty challenge, but relatively few can consistently prove that they control their critical technology, data and AI operations. Its new Digital Sovereignty Index identifies an “overconfidence gap” as AI adoption increases.
- 94% of surveyed enterprises faced a sovereignty challenge in the last three years.
- AI-related issues were the most common individual challenge, reported by 44%.
- Only 26% reached IBM’s Leading Digital Sovereignty tier.
- Just 33% regularly or continuously test their sovereignty capabilities.
- The research surveyed 2,003 senior decision-makers across seven countries.
Most enterprises have faced sovereignty challenges
IBM’s report, Proof, Not Promises: The Digital Sovereignty Index, found that 94% of surveyed enterprises faced at least one sovereignty challenge during the last three years. These included AI provider failures, regulatory conflicts, critical vendor disruption, government restrictions such as export controls, and data-access issues.
Among the enterprises affected, 81% had to provide formal evidence of control to regulators, customers, auditors or internal stakeholders. IBM argues that this makes digital sovereignty a question of resilience, business performance and board-level accountability, rather than only a technology concern.
The Index examines whether organizations can retain and prove control across four areas: AI, technology, operations and data. It assesses six dimensions of control: responsibility, traceability, constraint, intervention, exit and legitimacy.
AI is putting sovereignty controls under pressure
AI-related issues were the most frequently reported individual sovereignty challenge, cited by 44% of respondents. The category included incorrect outputs, explainability problems, model or provider failures and governance concerns.
Other reported challenges included significant provider changes at 35%, data-access or transfer issues at 33%, government restrictions such as export controls, sanctions or foreign-jurisdiction issues at 30%, and formal audit or regulatory events at 38%.
“Sovereignty should expand future choices, not restrict them,” Jonathan Adashek, IBM’s Senior Vice President and Chief Global Affairs Officer, said in the report. He said boards need to show how they can adapt, change strategy or change a critical provider when a business issue becomes a sovereignty risk.
Emmanuel Frenehard, Chief Digital Officer at Sanofi, said, “Digital sovereignty is not a compliance checkbox, it’s a business reality”. He linked the issue to business continuity as AI becomes embedded across enterprises.
Confidence is ahead of regular testing
An average of 82% of respondents said they were very or extremely confident that they could provide evidence of sovereign control. However, only 26% of surveyed enterprises reached the Index’s Leading Digital Sovereignty tier, which measures more comprehensive and integrated evidence of control.
Only 33% of respondents regularly or continuously test their ability to demonstrate sovereignty. Testing was more common among Index leaders, at 63%, compared with 29% of enterprises still establishing evidence and 9% at the earliest stage.
Enterprises in the Leading tier were more than twice as likely to resolve their most testing sovereignty challenge without material disruption: 52%, compared with 22% of establishing enterprises.
IBM’s research surveyed 2,003 senior decision-makers at large enterprises in the United States, United Kingdom, Germany, France, Saudi Arabia, India and Japan. The research also included 25 interviews with policymakers and other experts, plus perspectives from 17 senior customer leaders. For users and enterprise buyers, the findings point to a practical focus on evidence, including testing recovery and exit arrangements and identifying critical dependencies before a sovereignty event occurs.
