IBM Digital Sovereignty Index: In the AI Era, Control Is No Longer Enough. Enterprises Must Prove It.

• Proof of sovereignty is now expected: Most enterprises surveyed (94%) faced at least one sovereignty challenge in the last three years, and 81% of those had to provide formal evidence of control.
  
  
• AI is the sovereignty stress test: AI-related issues such as provider or governance failures were the most common sovereignty challenge (44%) among respondents, ahead of data-access issues, government restrictions, or formal audits.
  
  
• Confidence runs ahead of proof: An average of 82% of respondents are very or extremely confident they can provide evidence of sovereign control, but only 26% of enterprises reached the Index’s Leading Digital Sovereignty tier, while just 33% regularly test their capabilities.

A new report from IBM (NYSE: IBM), Proof, Not Promises: The Digital Sovereignty Index, reveals an “overconfidence gap”: leaders believe they can prove sovereign control of their technology, but the evidence often falls short of the Index’s highest standards. As AI adoption accelerates, that gap is becoming a business risk.

The Index looked at an organization’s ability to retain and prove control across its critical AI, technology, operations and data, including when conditions change or dependencies come under pressure. That control is being put to the test, turning digital sovereignty from a technology concern into an issue of resilience, business performance and board-level accountability. 94% of enterprises surveyed faced at least one sovereignty challenge in the last three years, including AI-provider failures, regulatory conflicts, critical vendor disruption, government restrictions such as export controls, or data-access issues. Among those affected, 81% had to provide formal evidence to regulators, customers, auditors or internal stakeholders.

Control you can’t prove is becoming a business liability

As global sovereignty strategies mature, the business challenge is to identify where a business risk can turn into a sovereignty challenge and avoid disruption when scrutiny arrives. The impact of controlling and proving sovereignty can force changes to providers, architecture, AI or data practices, limiting freedom to act when it matters most.

IBM’s Digital Sovereignty Index measures organizations' reported evidence of control in the case of a sovereignty event across AI, technology, operations and data, examining six areas:

• Responsibility: Can you prove who was accountable?
• Trace: Can you show exactly what happened?
• Constraint: Can you prove controls were working?
• Intervention: Can you show how you responded and recovered?
• Legitimacy: Can you explain and justify decisions under scrutiny?
• Exit: Can you prove you could change provider or recover operations if needed?

The findings suggest the problem isn’t usually just control. It’s that sovereignty efforts aren’t built to answer these questions smoothly under pressure.

“Sovereignty should expand future choices, not restrict them,” said Jonathan Adashek, IBM Senior Vice President and Chief Global Affairs Officer. “When a business issue turns into a sovereignty risk, boards need to show real control: how they can adapt, change strategy or critical provider – where freedom to act lies.  The choices they make today matter, and the stakes are high. Getting this right can help them minimize shocks, keep their options open and stay competitive.”

The ability to change course in relation to technology remains under-tested: only a third (33%) of respondents test their ability to demonstrate sovereignty continuously or as part of regular governance and assurance processes.

AI is the sovereignty stress test

AI-related issues, including incorrect outputs, explainability problems, model or provider failures and governance concerns, were the most frequently reported individual sovereignty challenge among respondents, at 44%. These came ahead of other factors they cited including:

• Formal audit or regulatory events (38%),
• A government restriction, such as an export control, sanction or foreign-jurisdiction issue affecting access to technology, AI models, data, providers or operations (30%),
• significant provider changes (35%),
• data-access or transfer issues (33%)

“Digital sovereignty is not a compliance checkbox, it’s a business reality”, said Emmanuel Frenehard, Chief Digital Officer at Sanofi. “As AI becomes embedded across the enterprise, thinking through the many layers of sovereignty is a matter of business continuity in an age where technology is essential to run an enterprise and continue building trust.”

“Companies prioritizing sovereignty are rightly planning for control, but the leaders plan for proof too. The next step is not simply more governance or regulation. It is stronger evidence that the governance works: testing exit capabilities, understanding critical dependencies and focusing efforts where a loss of control would have the greatest impact,” Jonathan Adashek continued.

Leadership can pay off

While an average of 82% of respondents were very or extremely confident they could provide evidence of sovereign control, only 26% of surveyed enterprises reached the Index’s Leading Digital Sovereignty tier, which measures more comprehensive, well-integrated evidence of sovereign control. Enterprises in that tier were more than twice as likely to resolve their most testing sovereignty challenge without material disruption (52%, compared with 22% of establishing enterprises).

Other key findings include:

• Testing sets Index leaders apart: 63% of leading enterprises regularly or continuously test their ability to demonstrate sovereignty, compared with 29% still establishing evidence and just 9% at the earliest stage.

• Proof is an operational challenge: Barriers reported included manual or time-consuming evidence collection (56%), fragmented evidence across teams and systems, dependence on third parties for records, and legacy systems or inconsistent standards (each 53%), and untested controls, recovery or exit arrangements (50%).

Research Methodology

The IBM Digital Sovereignty Index was developed through a multi-stage research program combining a review of 27 sources, including legislation, standards, governance frameworks, academic research and industry thought leadership, with qualitative interviews and an international quantitative survey.

The quantitative study surveyed 2,003 senior decision-makers within large enterprises across the United States, United Kingdom, Germany, France, Saudi Arabia, India and Japan. The research also included 25 interviews with policymakers, regulators, public-sector officials and policy experts, as well as perspectives from 17 senior customer leaders across five countries.

The Index measures how well an organization can demonstrate control across four pillars: AI, technology, operations and data. Within those pillars, it evaluates six dimensions of control: responsibility, traceability, constraint, intervention, exit and legitimacy.