AI sovereignty is everywhere right now, from national policy agendas to multibillion-dollar investments in chips, data centers and cloud infrastructure. But what does it actually mean?
For many organizations, the answer has historically been ownership: own the infrastructure, own the models, own the stack. But as AI ecosystems become increasingly interconnected, ownership alone is no longer enough. According to new research from IBM’s Institute for Business Value (IBV), the organizations turning AI sovereignty into a competitive advantage have something more valuable: control.
“Sovereignty means having the ability to see your dependencies clearly, govern them consistently and change direction when needed without breaking the business,” writes Ana Paula de Jesus Assis, Senior Vice President at IBM, in the foreword to “The calculus of AI sovereignty” report.
As organizations scale AI, many are discovering they have less visibility into their dependencies than they thought. The IBV research found that 91% of executives don’t fully understand their AI dependencies across vendors, models and infrastructure. At the same time, 71% of executives say it would be difficult to switch AI models or vendors if they had to today.
The result is a growing dependency gap. Organizations may be accelerating AI adoption while unwittingly accumulating technical and operational constraints that limit future flexibility.
This is where the idea of selective AI sovereignty comes in, according to de Jesus Assis.
While the traditional model of sovereignty assumes sovereignty comes from controlling everything, complete control isn’t always realistic, practical or even desirable.
Selective AI sovereignty recognizes that organizations don’t need to own every layer of the stack. They should focus instead on maintaining control over the parts that matter most, like data, models and infrastructure, she said.
As de Jesus Assis also noted in a recent episode of the Smart Talks podcast, sovereignty goes beyond regulatory compliance. It starts with understanding which applications are truly mission-critical and ensuring that the organization retains the ability to govern and adapt to them. “Controlling everything is not necessarily viable,” she said.
The true test comes when something changes like a more fitting model becomes available or regulations evolve or a geopolitical event affects technology access. Can the organization adapt without disrupting operations? This challenge becomes even more important as AI expands the attack surface.
“AI is going to increase the amount of vulnerabilities that are going to be either identified or created,” de Jesus Assis cautioned. The ability to respond quickly, adjust architectures and change course becomes a core element of selective sovereignty.
Knowing where your data is stored is a necessary first step, but it doesn’t guarantee sovereignty, said Giovanni D’Aniello, Chief Information Officer at AXA, on the Smart Talks episode. Too many organizations equate data residency with sovereignty. “Many people believe, ‘I’m safe. I’m sovereign compatible.’ Well, it’s absolutely not enough,” he said.
Data location is only one piece of the puzzle. D’Aniello points to four dimensions of sovereignty: where data resides, who operates and patches the systems, who holds legal responsibility and who controls the underlying technology stack. “If you don’t know where your data are, you don’t know anything. But it’s not only that,” he said. Without visibility and control across all four dimensions, data sovereignty is incomplete.
Sovereignty is also becoming a source of competitive advantage.
IBM research found that organizations with the strongest AI control capabilities protect 55% more operating profit from AI-driven disruption than their peers.
“Our architecture must be flexible enough to evolve,” Sergio Sánchez Gallego, CTIO at Telefónica España, observed in the IBV report, “allowing us to swap components or adopt new technologies without starting from scratch.”
In a world where vendors, models, regulations and geopolitical realities can shift overnight, the ultimate competitive advantage may be the ability to pivot without starting over. That’s the promise of selective AI sovereignty: sovereignty that allows companies to stay in control of what matters most.
Join security leaders who rely on the Think Newsletter for curated news on AI, cybersecurity, data and automation. Learn fast from expert tutorials and explainers—delivered directly to your inbox twice weekly. See the IBM Privacy Statement.
Purpose-built sovereign software that empowers enterprises, governments and service providers to create, deploy and manage secure, AI-ready environments.
Maintain full autonomy over your data, infrastructure and technology, ensuring control, security and flexibility in every environment.
Transform your business and manage risk with a trusted global leader in cybersecurity, cloud and managed security services.