Digital Sovereignty for Aspiring Managers

Introduction

Digital sovereignty has emerged as one of the most critical strategic issues facing organizations in the 2020s. At its core, digital sovereignty describes an organization’s fundamental ability to control its own digital destiny – the data it generates, the infrastructure it relies upon, and the technology platforms that drive its operations. For aspiring managers, understanding this concept is no longer optional. It represents a new lens through which strategic decisions about technology, vendors, compliance, and competitive positioning must be viewed.

Understanding the Foundation

The concept extends beyond simple data protection into three interconnected layers that together define an organization’s digital autonomy. The physical layer encompasses infrastructure and technology – where data centers are located, who owns the hardware, and under which jurisdiction these assets fall. The code layer involves standards, rules, and design choices – whether you use proprietary platforms that lock you in or open standards that preserve flexibility. The data layer covers ownership, flows, and usage rights – who can access your information, where it moves, and what legal frameworks govern its use. This multidimensional nature means that achieving digital sovereignty is not a single project you can complete and tick off a list. Rather, it represents an ongoing process of managing dependencies, maintaining control, and ensuring operational autonomy in an increasingly interconnected digital world. Organizations can achieve sovereignty to varying degrees across these dimensions, and the appropriate level depends on the criticality of specific business processes and data

Why Digital Sovereignty Matters Now

The strategic importance has intensified due to converging forces.

Geopolitical tensions have made reliance on foreign technology providers a tangible risk rather than a theoretical concern. In early 2025, when the Chief Prosecutor of the International Criminal Court temporarily lost access to his emails because Microsoft blocked access due to political tensions, it demonstrated that cutting off data access is not hypothetical – it can directly impact business-critical processes in emergencies. European organizations now face a stark reality: over 90% of Western data is stored or processed through cloud infrastructures owned by U.S. tech giants, with 80% of Europe’s professional cloud and software spending – amounting to €265 billion – captured by American providers. The regulatory landscape has evolved dramatically to address these concerns. The Digital Operational Resilience Act (DORA), which entered into application on January 17, 2025, requires financial institutions across Europe to demonstrate comprehensive control over their ICT risks, including third-party dependencies. The NIS2 Directive extends cybersecurity requirements to over 150,000 entities across 18 critical sectors, demanding that medium and large organizations implement appropriate risk management measures and maintain operational resilience. These regulations transform digital sovereignty from a strategic choice into a compliance imperative. Customer trust has become another powerful driver. Research from Cisco found that 76% of globally surveyed consumers wouldn’t buy products from a business they don’t trust to manage their data, and over one-third have switched to a competitor because of data privacy practices. When organizations can demonstrate sovereign control – showing customers exactly where their data is stored, how it’s managed, and who can access it – they build competitive advantage through transparency.

Practical Examples from Industry

• The automotive sector provides compelling illustrations of digital sovereignty in action. Catena-X has emerged as an open-source, collaborative data ecosystem specifically designed for the automotive industry. Nearly 200 organizations, including major manufacturers like BMW, Mercedes-Benz, and Volkswagen, have joined this initiative to securely and efficiently exchange data across the entire supply chain while maintaining control. The ecosystem addresses real-world challenges such as managing complex global supply chains, complying with strict environmental and social governance regulations, and creating connected efficiency through seamless data exchange. What makes Catena-X distinctive is its approach to sovereignty. Rather than creating a centralized data lake controlled by a single entity, it enables standardized, trusted point-to-point data exchange where companies maintain sovereignty over their information. The Automotive Solution Center for Simulation has implemented decentralized identity technology using verifiable credentials, allowing members and employees to access data spaces and services while retaining control over their digital identities. This approach aligns with the broader Gaia-X initiative, which promotes federated data infrastructure based on European values of transparency, openness, data protection, and security.
• In healthcare, organizations face particularly acute sovereignty challenges given the sensitivity of patient data and stringent regulatory requirements. Research examining how healthcare providers can maintain digital sovereignty while operating in multi-cloud environments has identified key enablers: strong data governance frameworks, well-crafted contractual agreements, regulatory alignment, and emerging technologies such as confidential computing and sovereign cloud infrastructures. The Dutch hospital ZGT achieved digital sovereignty by implementing solutions that ensure sensitive health information remains within their control and national borders, demonstrating compliance with data protection requirements while maintaining operational efficiency
• Financial services institutions are confronting similar pressures. Banks must balance the benefits of cloud infrastructure with the need to retain control over their most valuable resource: data. The strategic response involves moving toward modular IT architectures that support multi-cloud strategies, enabling banks to leverage the strengths of each cloud provider while reducing dependence on individual vendors. Users of certain banking platforms can replace their entire cloud infrastructure within 72 hours if needed, and AI models can be swapped in just 90 minutes – a level of agility required by DORA regulations. This rapid switching capability provides insurance against geopolitical disruption, regulatory changes, or vendor failures.
• In logistics, DB Schenker has engaged with data sovereignty initiatives through participation in the International Data Spaces Association, working to develop cross-company use cases that enable secure and sovereign data management across supply chains. The company has also embraced digital transformation through platforms that facilitate interactions while maintaining appropriate controls over data flows and system integrations

The Vendor Lock-In Challenge

One of the most practical manifestations of digital sovereignty concerns is vendor lock-in – the situation where an organization becomes deeply anchored in a provider’s ecosystem, making switching to another platform difficult and expensive.

This dependency limits flexibility, weakens negotiating position, and creates strategic vulnerability. Surveys confirm that avoidance of dependencies (41%) and adherence to compliance requirements (42%) are the primary drivers pushing companies toward multi-cloud strategies, ahead of technical reasons such as resilience (32%). For aspiring managers, understanding how to avoid vendor lock-in while maintaining digital sovereignty requires attention to several technological approaches. Kubernetes and containerization enable applications to run consistently across different cloud environments without being tied to proprietary services. Infrastructure-as-code tools like Terraform allow organizations to define their infrastructure in a provider-agnostic way, making migration between clouds more feasible. Open-source solutions and open standards reduce proprietary dependencies and increase flexibility in choosing or changing providers A practical example from the public sector illustrates this approach: a state authority concerned about data sovereignty opted for a multi-cloud architecture where critical citizen data remains in a national sovereign cloud while less sensitive applications run in Microsoft Azure to benefit from scalability and modern services. The infrastructure is defined as code with Terraform and rolled out consistently in both clouds, with applications running on Kubernetes clusters in both environments. This allows the authority to move workloads between clouds as required to comply with new regulatory requirements or optimize costs, without redeveloping applications.

The Business Case for Digital Sovereignty

While digital sovereignty involves investment and effort, research demonstrates substantial returns for organizations that treat it as a strategic priority. Analysis of 2,050 executives from enterprises across 13 countries revealed that only 13% of firms have achieved what researchers call sovereign AI and data capabilities – yet these organizations produce up to 5x the return on investment compared to peers. These sovereignty leaders deploy mainstream agentic and generative AI at twice the rate of other firms and achieve 2.5x greater system-wide efficiency and innovation gains. The competitive advantages extend beyond financial returns. Sovereignty-ready firms can resolve five areas of business pain with a single intelligent application, versus just one or two for other organizations. They can pivot faster against competitors, shift operational expenditure more effectively, recruit talent based on proven performance, and solve multiple business problems in parallel. Executives from sovereignty-ready firms were 2.5 times more likely to predict they would move from mainstream to industry leadership in the next three years. The benefits also include enhanced resilience against disruption. When companies achieve digital sovereignty, they reduce risks associated with business continuity, compliance, and reputation. Organizations gain greater understanding and transparency about how their data is handled, which fosters trust among customers, partners, and regulatory authorities. For example, when a German company attests that it stores information about German customers in a sovereign cloud located in Germany, those individuals feel reassured that their personal data isn’t in a facility where different laws may apply – creating value in terms of public relations and customer relationships

Major Cloud Providers’ Sovereign Offerings

Recognizing the market demand, major hyper-scalers have developed sovereignty-specific offerings for European customers. AWS announced the AWS European Sovereign Cloud, launching by the end of 2025, designed with independent European governance, local European leadership, and a dedicated Security Operations Center. The infrastructure will be entirely located within the EU, physically and logically separate from other AWS Regions, with no critical dependencies on non-EU infrastructure. Only AWS employees residing in the EU will control day-to-day operations, and the governance structure includes an independent advisory board composed of EU citizens. Microsoft has expanded its Sovereign Cloud offerings across public cloud, private digital infrastructure, and national partner clouds. The Sovereign Public Cloud, available across all European Azure regions, ensures customer data stays in Europe under European law, with operations and access controlled by European personnel. The Data Guardian capability provides transparency into operational sovereignty controls, with all remote access by Microsoft engineers routed to the EU where EU-based operators can monitor and halt activities if necessary.​ Google has updated its sovereign cloud services with disconnected, air-gapped options for customers with strict data security requirements, as well as Google Cloud Dedicated for local and regional partner deployments.

These developments reflect the broader reality that by 2025, approximately 50% of European organizations plan to adopt sovereign cloud solutions to enhance cybersecurity, expand cloud adoption, and meet compliance needs.

Implementation Framework for Managers

For aspiring managers tasked with implementing digital sovereignty strategies, a structured approach is essential.

The journey begins with classification and assessment – conducting a review of current security and compliance processes, tools, platforms, and skill sets, then classifying data and applications according to sovereign requirements. Not all workloads need migration to sovereign infrastructure; only those deemed to include sensitive data classified as top secret or highly confidential require such treatment. The analysis should follow a clear procedural model that starts with business-critical processes or products. Managers must ask which services are essential for the business model, then evaluate digital dependency step by step along the dimensions of infrastructure, software, data, and expertise. This systematic approach identifies particularly sensitive or dependent areas as well as concentrations of dependencies, enabling specific fields of action to emerge. Defining and delimiting responsibilities forms the next critical step. Organizations should divide business processes into clearly defined domains, with each domain assigned to accountable units responsible for digital sovereignty within that scope. When delegating responsibilities to internal teams or external partners, interfaces and service-level agreements must be precisely defined, especially for aspects like data storage, access rights, auditability, and exit strategies. Vendor management requires explicit consideration of sovereignty factors. Beyond evaluating functionality and cost, managers should implement vendor classification schemes that account for strategic relevance – how essential is this vendor’s product or service to core business and future innovation. The more strategic the role, the more control and scrutiny are required. Clear contractual frameworks should define where data can be stored, who can access it, under which jurisdictions it falls, and what happens if the relationship must end. Technical architecture choices should prioritize resilience, portability, and autonomy from the ground up. Multi-cloud or hybrid strategies diversify across providers to mitigate dependency risks. Currently, around 60% of typical use cases in enterprises can be implemented with European cloud offerings such as StackIT or OVH, and through targeted use of open-source tools, this rate rises to up to 75%.

Navigating the Challenges

Implementation of digital sovereignty faces several urgent challenges that managers must navigate. The complexity of achieving true sovereignty while maintaining innovation velocity requires careful balance. Organizations must avoid the extremes of either complete dependence on foreign providers or inefficient technological isolation. The goal is conscious controllability – the ability to recognize, critically evaluate, and actively shape technological dependencies while securing switching options and enabling multi-vendor strategies The cultural dimension cannot be overlooked. Implementing a sovereignty-conscious strategy involves cultural, organizational, and structural transformation beyond technical changes. Organizations benefit from establishing a sovereignty board—an interdisciplinary team spanning IT, legal, procurement, and business units—to oversee sovereignty requirements and guide strategic decisions. Domain teams need empowerment and accountability to make sovereignty-conscious decisions within their areas. Internal capabilities must be built through investment in technical, legal, and operational expertise to reduce external dependencies. Regulatory complexity adds another layer of challenge. The overlay of GDPR, DORA, NIS2, and sector-specific regulations creates a demanding compliance landscape that varies by jurisdiction. Member States may adopt additional national localization requirements beyond EU-level directives, requiring organizations to build flexibility into contracts and architectures.

Managers must track these evolving requirements continuously and ensure their sovereignty strategies remain aligned.

Looking Forward

The trajectory is clear: digital sovereignty is transitioning from a theoretical debate to a business imperative. Governments worldwide have committed over $1 trillion collectively to national sovereignty programs, signaling the strategic importance at the highest levels. European initiatives such as Gaia-X, the Digital Markets Act, the Data Act, the Chips Act, and national programs like France 2030 aim to regulate dominant players and foster European alternatives. Yet public policies alone won’t be sufficient – reclaiming technological autonomy requires large-scale, coordinated commitment from the private sector. For aspiring managers, the message is unambiguous: organizations that embed digital sovereignty into their strategic decision-making now will be better positioned to weather future disruptions and seize emerging opportunities. The companies that proactively build sovereign digital strategies will be equipped to thrive during geopolitical uncertainty, regulatory evolution, and technological transformation. Those who delay will find themselves at a structural disadvantage – slower, less secure, less innovative, and less attractive to both customers and talent. Digital sovereignty does not mean developing everything in-house or acting completely independently of third parties. Rather, it represents conscious control – the freedom to make technological decisions autonomously, maintain capacity for action, and shape one’s own digital future. In a world where data has become perhaps the most valuable strategic asset, sovereignty over that data and the systems that process it increasingly determines which organizations will lead and which will follow

References: