IBM index finds sovereignty proof gap in enterprise AI

IBM has published a global Digital Sovereignty Index, which found that only 30% of enterprises resolved their most testing sovereignty challenge without material disruption.

The study surveyed 2,003 senior decision-makers at large enterprises in the United States, United Kingdom, Germany, France, Saudi Arabia, India and Japan. It examined how organisations retain and demonstrate control across AI, technology, operations and data.

The findings point to a gap between confidence and evidence. While 82% of respondents said they were very or extremely confident they could provide evidence of sovereign control, only 26% met the report's highest standard, the Leading Digital Sovereignty tier.

It found that 94% of enterprises surveyed had faced at least one sovereignty challenge in the past three years, including AI provider failures, regulatory conflicts, vendor disruption, export controls and issues involving access to data.

Among those affected, 81% said they had been required to provide formal evidence to regulators, customers, auditors or internal stakeholders.

AI pressure

AI-related issues were the most commonly cited individual sovereignty challenge, identified by 44% of respondents. These included incorrect outputs, explainability problems, model or provider failures and governance concerns.

AI ranked ahead of formal audit or regulatory events, cited by 38% of respondents. Significant provider changes were named by 35%, data access or transfer issues by 33%, and government restrictions such as export controls, sanctions or foreign-jurisdiction issues by 30%.

The report argues that sovereignty is moving beyond a narrow technology question and becoming a resilience issue for business operations and board oversight. It assesses organisations across six areas: responsibility, trace, constraint, intervention, legitimacy and exit.

These measures are intended to test whether a business can show who was accountable, what happened, whether controls worked, how it responded, whether decisions can be justified under scrutiny, and whether it could change provider or recover operations if necessary.

Jonathan Adashek, Senior Vice President and Chief Global Affairs Officer at IBM, said the findings showed that control alone was no longer enough when organisations come under scrutiny.

"Sovereignty should expand future choices, not restrict them," said Jonathan Adashek, Senior Vice President and Chief Global Affairs Officer at IBM.

"When a business issue turns into a sovereignty risk, boards need to show real control: how they can adapt, change strategy or critical provider, and where freedom to act lies. The choices they make today matter, and the stakes are high. Getting this right can help them minimise shocks, keep their options open and stay competitive," Adashek said.

Testing gap

The ability to prove sovereignty on an ongoing basis appears less developed. Only 33% of respondents said they regularly or continuously test their ability to demonstrate sovereignty as part of governance and assurance processes.

Testing levels were markedly higher among organisations in the leading tier. Among those businesses, 63% regularly or continuously test their ability to demonstrate sovereignty, compared with 29% of those still establishing evidence and 9% at the earliest stage.

The report also linked stronger preparation with better outcomes during difficult events. Enterprises in the leading tier were more than twice as likely to resolve their most testing sovereignty challenge without material disruption, at 52%, compared with 22% for businesses still establishing evidence.

Sanofi Chief Digital Officer Emmanuel Frenehard said sovereignty questions now sit alongside broader business continuity concerns as AI use spreads across large organisations.

"Digital sovereignty is not a compliance checkbox, it's a business reality," said Emmanuel Frenehard, Chief Digital Officer at Sanofi.

"As AI becomes embedded across the enterprise, thinking through the many layers of sovereignty is a matter of business continuity in an age when technology is essential to running an enterprise and continuing to build trust," Frenehard said.

Operational barriers

The study also identified practical obstacles to producing evidence of control. Manual or time-consuming evidence collection was cited by 56% of respondents, while 53% pointed to fragmented evidence across teams and systems, dependence on third parties for records, and legacy systems or inconsistent standards.

Half of respondents also cited untested controls, recovery arrangements or exit arrangements as barriers.

IBM developed the index through a research programme that included a review of 27 sources, including legislation, standards, governance frameworks, academic research and industry material. It also drew on 25 interviews with policymakers, regulators, public-sector officials and policy experts, along with perspectives from 17 senior customer leaders across five countries.

Adashek said the next step for companies was to build evidence that governance arrangements work under pressure.

"Companies prioritising sovereignty are rightly planning for control, but leaders plan for proof too. The next step is not simply more governance or regulation. It is stronger evidence that the governance works: testing exit capabilities, understanding critical dependencies and focusing efforts where a loss of control would have the greatest impact," Adashek said.