This page could not be loaded. Check your connection, then reload the page.
Executive Summary
Digital sovereignty is no longer about good intentions; it is about whether organizations can actually put it into practice – and right now, almost nobody is prepared. Organizations are putting money toward sovereign technology, assigning managers to lead the effort, and setting up rules. However, very few can prove they could keep key services online if a cloud vendor, software supplier, or political crisis cut off their access. This gap between what companies plan to do and what they can actually achieve is now the main challenge in digital sovereignty.
The concept spans several core priorities at once: data residency and its governing laws; operational continuity during vendor or government disruptions; and control over where AI models originate and run. Organizations weigh these three differently by region and by industry. Most have already worked out where their data sits; what they are working on now is keeping the business running under their own control, and controlling the AI they use.
At the same time, production workloads continue to leverage US-headquartered hyperscalers. In fact, hyperscalers are the only environment expected to gain share over the next decade. That concentration does not make sovereignty less relevant. It makes operational readiness more important.
This divide between strategic intent and operational reality is the sovereignty readiness gap. Closing it requires shifting focus from where data resides to whether the enterprise can maintain independent control. Four capabilities decide that: a tested contingency plan for losing a critical vendor, a plan for losing support for an open-source dependency, a sovereignty risk framework applied to every supplier, and the ability to move a critical workload off a single cloud provider within 30 days. Only 2.9% of organizations hold all four. What buyers are buying to close the gap is narrower, i.e., a second source of support, commercially supported open source, and cross-environment portability. Moreover, digital sovereignty, though now a funded executive priority, remains short of daily operations in most organizations.
Respondents that consider digital sovereignty a critical priority: 66%
Organizations that have all four of the essential operational sovereignty capabilities: 2.9%
Share of production workloads that run on US hyperscalers today: 17.0%
Respondents that rate an alternative source of support and maintenance critical: 64%
About this study
Futurum surveyed 1,940 technology and risk decision-makers in 28 countries in July and August 2026, across North America, EMEA, Asia-Pacific, and Latin America, and six industries: financial services, public sector and defense, healthcare and life sciences, telecom and digital infrastructure, manufacturing, industrial, and energy, and retail, consumer, and transportation. Global numbers give the four regions equal weight for all analysis, with deeper insights as relevant for regions, industries, and beyond. Futurum also incorporated its proprietary ongoing research findings including forecasts and recurring buyer and decision-maker surveys, and conducted 12 in-depth interviews with CIOs, CTOs, CISOs, and other senior technology executives about sovereignty to incorporate deeper experiences and context into the analysis.
The sovereignty maturity ladder: where organizations stand on sovereignty All respondents · 46% at planning or earlier, 54% at piloting or beyond
| Category | All respondents |
|---|---|
| Not on our agenda | 4% |
| Exploring — researching requirements | 16% |
| Planning — building strategy or business case | 26% |
| Piloting — sovereign initiatives in flight to test strategy on a small scale | 21% |
| Deploying — launching sovereign initiatives to full organizational scale | 18% |
| Embedded in operations | 15% |
Source: n=1,940 respondents, normalized by region
Where production workloads run, today and in three, five, and ten years All respondents
| Category | US-headquartered hyperscaler cloud | Sovereign / in-country hyperscaler offerings | Regional or local cloud providers | Private cloud | On-premises infrastructure | Managed hosting or colocation |
|---|---|---|---|---|---|---|
| Today | 17% | 16% | 17% | 18% | 17% | 16% |
| In 3 years | 23% | 15% | 15% | 16% | 17% | 15% |
| In 5 years | 25% | 16% | 15% | 15% | 16% | 14% |
| In 10 years | 27% | 16% | 15% | 14% | 15% | 13% |
Source: n=1,940 respondents, normalized by region
Funded, Governed, and Not Yet Built
Digital sovereignty now commands dedicated budget and executive governance, yet only one in seven organizations has progressed past planning into daily operations. Risk mitigation drives the investment case: operational resilience, regulatory compliance, and data control consistently win internal funding over growth-oriented outcomes. Strategy ownership is split almost evenly between infrastructure and security leadership. The CISO or chief risk officer owns sovereignty strategy in 28.6% of organizations. A message built only for platform engineering teams therefore never reaches the person who owns the decision in close to three in ten cases.
Respondents that are likely to make a major sovereignty investment in the next 12 months: 66.5%
Organizations that have sovereignty embedded in operations: 14.7%
More from the interviews
The Workloads Are Not Leaving
Technology leaders project that their production workloads will increasingly run on US hyperscalers over the next decade, while the share running on sovereign and in-country offerings, regional providers, private cloud, managed hosting, and on-premises infrastructure holds flat or shrinks. That does not mean sovereignty has failed: organizations are pursuing it inside the estate they already run, rather than replacing that estate wholesale, by seeking more control over risk, support, governance, and workload movement.
The paradox is that consolidation can make the readiness gap more consequential. Organizations most concerned about dependence on US-headquartered providers still expect US hyperscaler use to grow, and those that say they are bringing work back in-house project a steeper increase in US hyperscaler share than other organizations. In practice, many buyers are treating contingency as insurance around a concentrated operating model rather than building a genuinely independent alternative.
Buyers' projections reflect only the options they can see today, and Futurum's outlook is less linear: regulation is becoming more region-specific and enforceable, sovereign and in-country cloud offerings are becoming more operationally distinct, and local providers and telecom operators are expanding their role in cloud and AI supply. The likely result is a more fragmented set of deployment and supplier options than respondents' long-term forecasts imply, so leaders should treat their provider strategy as an assumption to test regularly as those options change over the decade.
Share of production workloads that run on US hyperscalers today: 17.0%
Respondents that say it is extremely important that sovereignty comes from the vendors they already use: 41.3%
More from the interviews
Worry Without the Ability to Act
Nearly nine in ten organizations fear being cut off by a supplier or a government, but the risk named most is being unable to leave, not foreign government access to data. Few hold the full set of capabilities needed to respond, as current strategies prioritize compliance and planning over operational readiness. Moving a critical workload takes most organizations months, and the largest, most exposed enterprises are the least able to do it quickly. That reframes what counts as protection: if the risk buyers name first is being unable to leave, then the relevant property of any technology is whether somebody other than its original supplier can keep it running.
Respondents that are at least moderately concerned about a supply-chain kill switch: 87%
Organizations that could move a critical workload off one cloud within 30 days: 24%
More from the interviews
What Buyers Will Actually Pay For
Readiness is bought as support and portability. A second source of support and maintenance is more important to buyers than any other requirement for readiness, including data location. Open source underpins most sovereignty strategies and has become the preferred way to avoid lock-in at the software layer, but it does not remove the need for vendor support: organizations are highly concerned about running unsupported packages and place a premium on a credible alternative source of maintenance. Notably, organizations with a support contract are the ones looking hardest for a second maintenance source. Support is being treated as a contingency requirement, not a procurement formality.
Portability remains unmet: a requirement buyers name but have not yet bought. Sovereignty has become decisive in a large share of infrastructure renewals and is now considered in most. But buyers who have made it decisive are no more able to move a workload than anyone else, and reliability, not data location, is what they say makes a vendor sovereignty-ready.
Respondents that rate an alternative source of support and maintenance critical: 64%
Organizations that give open source a role in their sovereignty strategy: 87.1%
More from the interviews
AI Turns Sovereignty Into a Purchase Decision
AI is where sovereignty becomes an immediate operating decision. Just over half of organizations call sovereign AI capability critical to their AI strategy, and almost as many say the same of independence from a single AI accelerator vendor, an aspiration more than an available choice today. AI commitments are made faster than the platform, data governance, and infrastructure choices needed to support them, so organizations recreate the cloud sovereignty readiness gap in AI, only sooner. Buyers choose models by workload; where they commit, open-weight models they can run themselves outrank proprietary frontier models, and private cloud leads as the place to run sensitive AI. Three in ten are already repatriating or migrating AI workloads to private or local infrastructure within 24 months. What organizations say they prefer and what they deploy still differ, so control has to be a firm requirement for sensitive workloads rather than a general preference. Agentic AI raises the stakes: a leader planning it for a regulated process should decide the required level of control over inference, data access, tools, and observability before choosing a model.
Respondents that call a sovereign-AI capability critical: 51.9%
Respondents that call independence from a single AI accelerator vendor critical: 49.7%
More from the interviews
What To Do Next
Closing the gap starts with testing the exit against a clock, and writing that exit into the contract at the next renewal, with a second source of support identified in advance. From there, organizations should prefer open, commercially supported software wherever being trapped is the risk; build an inventory that reaches the encryption keys and open-source components underneath; assess every supplier, and make the assessment include a way out; settle who owns sovereignty and report it to the board as a risk; revisit the decision to consolidate every year; and, especially for large organizations, don't delay while risks are growing.
Organizations that could move a critical workload off one cloud within 30 days: 24%
Organizations that have none of the four essential operational sovereignty capabilities: 24.6%
More from the interviews