# Funded, Governed, and Not Yet Built

**Nearly every technology leader calls sovereignty important and most have money set aside for it; far fewer have built anything yet.** Whether digital sovereignty matters is no longer in question. 66% of technology leaders call it a critical priority, and no respondent called it irrelevant. The money has followed. Most expect a major investment within a year, and spending is rising in every region. Delivery, however, is not growing: 46% of organizations have not moved past planning, and only 14.7% actually have sovereignty embedded in operations.

**How Relevant Digital Sovereignty Is Today**
*All respondents*

| Category | All respondents |
|--- |--- |
| Critical priority | 66% |
| Important consideration | 29% |
| Emerging interest | 5% |
| Not relevant | 0% |

*Source: n=1,940 respondents, normalized by region*

**Respondents that consider digital sovereignty a critical priority:** 66%

**Respondents that are likely to make a major sovereignty investment in the next 12 months:** 66.5%

Sovereignty spending is rising at an average of +8.4% over 24 months in every region: Latin America +11.1%, North America +8.1%, Asia-Pacific +8.0%, EMEA +6.6%.

## Regulation puts sovereignty on the agenda; other pressures fund it

Regulation is a major factor for putting sovereignty on the agenda. 47.4% say the regulatory environment in their region drives their roadmap to a great extent and, similarly, 46% describe the cultural pressure around it as high or very high, usually a board-level concern beyond IT. However, regulation does not, on its own, get the work funded.

What organizations expect back is protection: resilience, compliance, and control over their data lead the list, and every growth outcome trails every protective one. Sovereignty is primarily being funded the way General Data Protection Regulation (GDPR) compliance was funded, i.e., as a cost of doing business. The trend is visible across industries, with the manufacturing, industrial, and energy sectors leading in budget increases (43.1% planning to boost spending by more than 10%), ahead of the public sector and defense at 33.7%. Ultimately, the most successful funding justifications focus on maintaining continuity and control rather than driving expansion.

**Organizations expect protection from sovereignty, and growth trails**
*All respondents (respondents could select more than one)*

| Category | All respondents |
|--- |--- |
| Operational resilience or business continuity | 28% |
| Regulatory compliance | 28% |
| Greater control over data and IP | 26% |
| Long-term technical autonomy or cost predictability | 25% |
| Customer trust or brand differentiation | 23% |
| Independence in AI development | 20% |
| Speed and agility for growth or innovation | 20% |
| Access to new markets or customers | 18% |

*Source: n=1,940 respondents, normalized by region*

Buyers still see upside: 43% call sovereignty a significant competitive differentiator, and 14% call it a compliance cost only.

## Every additional jurisdiction adds complexity

Sovereignty rarely comes down to one country's rules. Most large organizations operate in several countries, often in several regions, and every jurisdiction they add brings its own set of rules, its own conditions for market access, and often its own infrastructure and vendor landscape. Trends run by region, but the countries inside a region can still need very different things; Canada and the United States are the clear example. Local jurisdictions inside a country can add rules of their own. The more distinct sets of rules and requirements an organization has to work around, the more complex sovereignty becomes, and regulation is only part of it. Which markets an organization can serve, what infrastructure exists there, and which vendors can operate there all change from one border to the next. Each added jurisdiction is one more place where vendors must be evaluated, business must be adapted, and readiness must be proven.

## Planning is further along than delivery

46% of organizations have a sovereignty mandate and a budget, but have not yet run anything. Organizations with sovereignty embedded in how systems are chosen, contracted, and run are the target state the rest of the market is working toward, but the gap is significant, and progress is slow.

**The sovereignty maturity ladder: where organizations stand on sovereignty**
*All respondents · 46% at planning or earlier, 54% at piloting or beyond*

| Category | All respondents |
|--- |--- |
| Not on our agenda | 4% |
| Exploring — researching requirements | 16% |
| Planning — building strategy or business case | 26% |
| Piloting — sovereign initiatives in flight to test strategy on a small scale | 21% |
| Deploying — launching sovereign initiatives to full organizational scale | 18% |
| Embedded in operations | 15% |

*Source: n=1,940 respondents, normalized by region*

Program maturity brings governance and money with it: organizations deploying sovereignty or with sovereignty embedded are more likely to expect a major investment and to increase spend. For a leader, the useful question is which program maturity stage an organization is in. Organizations still planning should know that their current planning will dictate how fast they overcome this gap. Organizations piloting or deploying should check whether their pilots include a tested exit and a second source of support. Section 3 demonstrates how few pilots include an exit plan.

**Mature organizations are accelerating.** 81% of organizations that are deploying or have embedded sovereignty expect to make a major investment within 12 months, versus only 60% of all other organizations; 72% of mature organizations are increasing spend over 24 months, against 62%.

**Organizations that have sovereignty embedded in operations:** 14.7%

## Ownership is split; security holds it nearly as often as infrastructure

Sovereignty is a board-level decision about which vendor dependencies an organization accepts. Some dependence is unavoidable, but a dependency with no tested way to migrate is different. For critical systems and customer-facing services it is one the board should approve knowingly. Those systems cannot degrade because a supplier or government changes terms, and identifying them is leadership's job, beyond IT alone.

Ownership in practice is less settled than that. While nearly every respondent indicated a primary owner exists for digital sovereignty, 21% report active internal disagreement about direction or ownership. Where it is settled, the CIO or CTO holds it most often and the CISO or chief risk officer nearly as often, so security owns sovereignty almost as often as infrastructure does. Interestingly, C-level survey respondents were significantly more likely to attribute sovereignty ownership to the CIO or CTO (45%) than any other respondent levels from managers and architects through SVPs (27%–37%), indicating that senior executives disagree with the rest of their business on who actually owns sovereignty responsibility.

21% report active internal disagreement about direction or ownership for sovereignty.

**Who Owns Sovereignty**
*All respondents*

| Category | All respondents |
|--- |--- |
| CIO / CTO | 35% |
| CISO / Chief Risk Officer | 29% |
| Shared across IT, risk and legal | 11% |
| Chief Data or AI Officer | 10% |
| Legal or compliance | 8% |
| Business unit leader | 7% |
| No clear owner | 0% |

*Source: n=1,940 respondents, normalized by region*

> Responsibility for location of data and control of assets, from a tech point of view, is generally in one person. It's not always the CDIO, but often is the case. It's very clear that's my responsibility to advise the board on and make sure we do the right things.
> — *CDIO, enterprise healthcare organization in EMEA*

## Maturity splits sharply by region, but not industry or size

North America is furthest along, building sovereignty inside a familiar jurisdiction, with only 33% of organizations not yet piloting sovereignty programs. Asia-Pacific and Latin America both sit in the middle (46% and 43% respectively not yet started with pilots).

**Regional maturity: North America leads, EMEA lags**
*All respondents · 37.7% of EMEA organizations are still at planning, against 15.2% in North America*

| Category | Piloting or beyond | Regulation drives to a great extent |
|--- |--- |--- |
| North America | 67% | 56% |
| EMEA | 38% | 31% |
| APAC | 54% | 49% |
| LATAM | 57% | 54% |
| All respondents | 54% | 47% |

*Source: n=289 / 470 / 979 / 202 / 1,940 respondents*

North America's lead stems from industry regulations and supplier concentration rather than region-wide rules. US technology leaders view heavy reliance on US cloud providers as a concentration risk rather than a legal issue. Consequently, they focus on building resilience within their home region rather than having any plans to leave it. While North America leads in program stage (67.1% piloting or beyond) and demand for secondary support (72%), only 21.5% can relocate a workload within 30 days, reflecting progress in planning rather than execution capability.

EMEA's position reflects a different sequence of priorities. The region tackled data residency early through GDPR, treating location as a resolved issue. However, operational continuity remains largely unaddressed. As a result, EMEA scores lower on making sovereignty decisive at renewal (31.7%) and requiring secondary support (52.1%), even while sharing high concern levels. Broad local definitions also make pilots larger undertakings. EMEA is not lagging in priority, but in solving operational continuity.

Within EMEA, Mainland Europe is furthest behind: only 34% have started piloting sovereignty programs, against 43% in the United Kingdom and 46% in the Middle East.

Across markets, maturity ranges from 23% in Italy and 29% in the Netherlands, Belgium, and Luxembourg to 70% in Hong Kong and 69% in Singapore.

**Sovereignty maturity varies sharply by subregion and market: inside EMEA, Mainland Europe is furthest behind**
*All respondents*

| Category | Piloting or beyond |
|--- |--- |
| Middle East (Saudi Arabia, UAE, Qatar) | 46% |
| United Kingdom | 43% |
| EMEA overall | 38% |
| Mainland Europe (Germany, France, Spain, Italy, Benelux) | 34% |

*Source: n=101 / 68 / 470 / 299 respondents*

**Sovereignty maturity varies sharply by subregion and market: piloting or beyond, by market**
*All respondents*

| Category | Piloting or beyond |
|--- |--- |
| United States | 69% |
| Canada | 64% |
| UAE / Qatar | 47% |
| Saudi Arabia | 44% |
| United Kingdom | 43% |
| Germany | 38% |
| Spain | 38% |
| France | 37% |
| Netherlands / Belgium / Luxembourg | 29% |
| Italy | 23% |
| Hong Kong | 70% |
| Singapore | 69% |
| Thailand | 68% |
| Indonesia | 67% |
| New Zealand | 63% |
| Malaysia | 54% |
| India | 53% |
| Australia | 53% |
| China | 49% |
| Taiwan | 48% |
| Philippines | 38% |
| South Korea | 35% |
| Japan | 34% |
| Argentina | 75% |
| Colombia | 74% |
| Chile | 59% |
| Brazil | 53% |
| Mexico | 47% |

*Source: n=165 / 129 / 51 / 50 / 68 / 88 / 40 / 76 / 55 / 40 / 60 / 116 / 57 / 58 / 57 / 59 / 113 / 114 / 57 / 58 / 58 / 55 / 114 / 24 / 23 / 29 / 77 / 49 respondents*

These figures reflect self-reported answers, but local definitions of a "pilot" vary. For instance, a US firm running on-premises systems alongside a domestic hyperscaler may consider that a sovereignty pilot, whereas a Spanish or Italian firm facing stricter residency and supply-chain rules might not. These variations highlight how local expectations differ and demonstrate that digital sovereignty must be defined locally to be effective.

Interestingly, neither the respondents' industry, role, nor organization size has any consistent, meaningful effect on sovereignty maturity as reported in the survey.

**What to Do About It**

Find out which stage you are actually at, not which you report. If your program is funded but has never run anything, you are in the 46% at planning or earlier, and the next decision is which single workload to test first.