This page could not be loaded. Check your connection, then reload the page.
Worry Without the Ability to Act
Organizations fear being cut off, but struggle to move critical workloads quickly, and nothing has made a dent. Most organizations are worried about a provider cutting them off, and only 24% could move quickly if one did. As governments place greater strategic weight on control of critical technologies, dependence on providers governed by a single jurisdiction is becoming a more material operational risk. The US decision in June 2026 to suspend access to a leading US AI provider's most capable models turned that scenario into a precedent. Yet, even organizations with mature sovereignty programs say that they cannot act quickly if they were cut off.
Respondents that are at least moderately concerned about a supply-chain kill switch: 87%
The risks buyers fear most are the ones that trap them
87% of organizations are at least moderately concerned about a supply-chain kill switch (a vendor or government shutting off hardware or software they depend on), and 81% about depending on US-headquartered providers for critical workloads. Asked which risks concern them most, buyers put vendor lock-in and exit difficulty first; foreign government access to data, the risk sovereignty usually brings to mind, ties for third. What buyers want is the ability to leave, which is a procurement and architecture problem more than a data-residency one. That points to a specific answer. If the risk buyers name first is being unable to leave a supplier, then the relevant property of a technology is whether anyone other than its original vendor can keep it running. Open source is the only category where that is structurally possible, and buyers have already chosen it: it has a role in 87.1% of sovereignty strategies and is foundational to 37.1%. What they have not necessarily secured is the support underneath it: 55.8% are extremely concerned about running unsupported packages, the highest level of concern recorded on any item in this study, and 52.1% call commercial support for the open source they run critical.
Sovereignty risks organizations name as their greatest concern All respondents (respondents could select more than one)
| Category | All respondents |
|---|---|
| Vendor lock-in or exit difficulty | 32% |
| Regulatory fines, sanctions, or embargo | 30% |
| Foreign government access to data | 27% |
| Supply-chain disruption or hardware embargo | 27% |
| Sudden loss of a key vendor | 27% |
| Unsupported open-source vulnerabilities | 24% |
Source: n=1,940 respondents, normalized by region
The ability for [a country or vendor] to actually…to invoke a kill switch and lock us out of our data is very real. — CDIO, large public agency in EMEA
Only 2.9% of organizations hold all four capabilities needed to act
Four capabilities enable an organization to respond if a supplier cuts it off: a formal, documented, and tested contingency plan for vendor disruption; a plan for open-source software that can no longer be supported; a sovereignty risk framework applied to every supplier; and the ability to move a critical workload off a single cloud provider within 30 days.
Each capability is insufficient on its own. A contingency plan does not ensure workload portability. Portable workloads do not resolve an unsupported software dependency. A supplier-risk framework does not help if the organization cannot execute an exit. Taken together, the four provide a practical minimum test of whether a sovereignty program can operate under disruption. Only 2.9% of organizations meet that test. At the other end, 24.6% have none of the four capabilities. The gap is not simply one of policy maturity; it is a gap in operational readiness.
For leaders, the self-assessment is straightforward. Organizations that hold three of the four capabilities have identified part of the problem but still have a critical exposure. Those that hold one or none should begin with a full inventory of critical workloads, cloud providers, software dependencies, support arrangements, administrative access, and contractual exit rights. The objective is not to document every risk. It is to establish the minimum conditions for keeping critical services running when a dependency fails.
Few organizations hold all four capabilities sovereignty requires All respondents
| Category | All respondents |
|---|---|
| Formal, documented, and tested contingency plan for a critical vendor being cut off | 41% |
| Formal plan for open-source software that loses its support | 40% |
| Risk framework applied to every supplier, not only the critical ones | 32% |
| Could move a critical workload off one cloud provider within 30 days | 24% |
Source: n=1,940 respondents, normalized by region
Few organizations hold all four capabilities sovereignty requires: how many of the four organizations hold All respondents
| Category | All respondents |
|---|---|
| None | 25% |
| One | 34% |
| Two | 24% |
| Three | 14% |
| All four | 3% |
Source: n=1,940 respondents, normalized by region
Organizations that have all four of the essential operational sovereignty capabilities: 2.9%
Organizations that have none of the four essential operational sovereignty capabilities: 24.6%
Neither worry nor a mature program produces the ability to leave
Worry does not predict capability. A tested contingency plan is barely more common among organizations extremely concerned about a kill switch than among organizations not concerned, and even they are no more able to move a workload within 30 days. Program maturity shows the same pattern: organizations with sovereignty embedded in operations hold a tested plan far more often than organizations that have not put sovereignty on the agenda, yet the two groups' ability to move a workload within 30 days barely differs. Worry and maturity both buy governance, not readiness: a program's plans improve well before its ability to exit does.
Worry and maturity buy plans, not exits All respondents
| Category | Has a tested contingency plan |
|---|---|
| Not concerned | 41% |
| Moderately concerned | 39% |
| Extremely concerned | 45% |
| All respondents | 41% |
Source: n=258 / 805 / 877 / 1,940 respondents
Worry and maturity buy plans, not exits: portability and risk framework, extremely concerned vs. everyone else All respondents
| Category | Could move a critical workload in 30 days | Applies a risk framework to every supplier |
|---|---|---|
| Extremely concerned about US dependence | 24% | 34% |
| Everyone else | 28% | 27% |
| All respondents | 24% | 32% |
Source: n=734 / 1,206 / 1,940 respondents
Worry and maturity buy plans, not exits: tested plan and 30-day portability by sovereignty maturity All respondents
| Category | Formal, tested contingency plan | Could move a workload within 30 days |
|---|---|---|
| Not on our agenda | 40% | 23% |
| Exploring | 31% | 31% |
| Planning | 27% | 26% |
| Piloting | 46% | 23% |
| Deploying | 53% | 26% |
| Embedded in operations | 63% | 29% |
| All respondents | 41% | 24% |
Source: n=90 / 334 / 504 / 396 / 343 / 273 / 1,940 respondents
We do not have a tested Plan B if a key vendor's hosting fails. Migrating from [a US hyperscaler] to [another US hyperscaler] remains a future ambition. — CDIO, enterprise healthcare organization in EMEA
Many factors drive provider-switching speed: size, industry, and region
Moving a critical workload off a single cloud provider takes most organizations months rather than weeks — 21 weeks on average — and the ability to do it within 30 days is lowest among large organizations, long enough that a disruption reaches far beyond the IT department. The largest enterprises are also the most likely to call sovereignty a critical priority, and the reasons they move slowest compound: more systems and legacy, slower change, multiple jurisdictions, and a larger, more visible target. As a result, the organizations with the most at stake are also the ones least able to respond quickly.
21 weeks · the average time to move a critical workload off a single cloud provider.
The organization's maturity in its sovereignty rollout has surprisingly little impact, with embedded-sovereignty organizations actually performing the slowest of any maturity group in the study. This doesn't indicate the sovereignty work slowed them; it likely reflects that these organizations had particularly strong need for such programs and still have many blockers, but the result is surprising nonetheless.
Other factors also make a difference. Asia-Pacific organizations are able to migrate much faster: a median of 10 weeks, versus 17 in North America, 18 in EMEA, and 19 in Latin America. Public sector organizations are uniquely slow: 17 weeks, versus 11 in financial services; 10 in healthcare and life sciences; 11 in telecom and digital infrastructure; 12 in manufacturing, industrial, and energy; and 13 in retail, consumer, and transportation.
Moving a critical workload takes months, and the largest organizations take longest All respondents · mean 144 days
| Category | All respondents |
|---|---|
| Within 30 days | 24% |
| 1–3 months | 26% |
| 4–6 months | 28% |
| More than 6 months | 23% |
Source: n=1,940 respondents, normalized by region
Moving a critical workload takes months, and the largest organizations take longest: portability within 30 days, by company size All respondents
| Category | Could move a workload within 30 days |
|---|---|
| 500–999 | 26% |
| 1,000–4,999 | 41% |
| 5,000–9,999 | 32% |
| 10,000–24,999 | 19% |
| 25,000–49,999 | 11% |
| 50,000–99,999 | 16% |
| 100,000+ | 22% |
| All respondents | 24% |
Source: n=133 / 465 / 415 / 392 / 278 / 154 / 103 / 1,940 respondents
Moving a critical workload takes months, and the largest organizations take longest: average days to move, by company size All respondents
| Category | Average days to move |
|---|---|
| 500–999 | 131% |
| 1,000–4,999 | 97% |
| 5,000–9,999 | 107% |
| 10,000–24,999 | 139% |
| 25,000–49,999 | 195% |
| 50,000–99,999 | 196% |
| 100,000+ | 167% |
| All respondents | 144% |
Source: n=133 / 465 / 415 / 392 / 278 / 154 / 103 / 1,940 respondents
Organizations that could move a critical workload off one cloud within 30 days: 24%
Facing significant barriers, organizations procrastinate on sovereignty — waiting until external shocks force workload moves
Every leading event that would trigger moving workloads off a cloud provider is an external shock: new or stricter regulation, a security or compliance incident, a geopolitical event, and a vendor kill switch. Organizations are waiting for something to go wrong instead of building the capability in advance.
What Would Trigger Moving Off a US Hyperscaler All respondents (respondents could select more than one)
| Category | All respondents |
|---|---|
| New or stricter regulation | 36% |
| Security or compliance incident | 34% |
| Geopolitical event, sanctions, or trade restrictions | 33% |
| Vendor "kill switch" | 31% |
| Government funding incentives | 28% |
| Customer or contractual requirement | 28% |
| Price increases / cost pressure | 28% |
| Board or executive directive | 27% |
| Nothing would trigger migration | 1% |
Source: n=1,940 respondents, normalized by region
Barriers to sovereignty programs are primarily internal (in order): cost, technical complexity, legacy systems, a missing cloud and vendor inventory, and a skills gap. For organizations without sovereignty on their agenda, cost and budget is the runaway driver, named by 40% of these organizations, versus 29% overall. Small-to-midsize businesses and nonprofits name cost and technical complexity as major barriers at notably higher rates than enterprises. While those barriers still top the list for enterprises, they do report more significant barriers with legacy systems and technical debt, lack of inventory, and talent and skill gaps at higher rates.
The biggest barriers to sovereignty are inside organizations All respondents (respondents could select more than one)
| Category | All respondents |
|---|---|
| Cost / budget | 29% |
| Technical complexity | 28% |
| Legacy systems / tech debt | 25% |
| Lack of cloud & vendor inventory | 21% |
| Unclear or shifting regulations | 20% |
| Talent & skills gap | 19% |
| Integration friction* | 18% |
| Lack of mature vendor offerings | 17% |
| Internal disagreement on priorities | 15% |
Source: n=1,940 respondents, normalized by region
Although buyers may fear a government cutting them off, the disruptions practitioners actually described were commercial: a vendor acquired and then shut down, an open-source component whose new owner began charging for it, cost changes buried in a contract. Price pressure ranks alongside geopolitical events among the triggers.
The barrier is rarely conviction. It is that the work competes with everything else on the roadmap and wins only when something forces it, as one retail CIO put it:
It's hard to make time for [sovereignty] today, a project that brings no direct value and is purely about controlling risk. — CIO, enterprise retailer in EMEA
A vendor we used was acquired, then shut down with 2 years' notice. The real risk was migrating data we're required by regulation to retain for 9 years. — CTO, enterprise financial services organization in APAC
My main problem is I don't have enough people on my team, and there's no appetite to let me hire. I'm dependent on third parties, and that worries me. — CIO/CISO, midmarket energy and infrastructure company in APAC
What to Do About It
Score yourself against the four capabilities. Holding three still leaves a critical exposure; holding one or none means starting with an inventory, not a policy.