IBM‘s first Digital Sovereignty Index has found that 94% of enterprises faced at least one digital sovereignty challenge in the past three years, with 81% of those affected required to provide formal evidence of control to regulators, customers, auditors or internal stakeholders.

The Overconfidence Gap Behind Digital Sovereignty

The report, titled Proof, Not Promises: The Digital Sovereignty Index, was released with a Singapore dateline and surveyed 2,003 senior decision-makers at large enterprises across the United States, United Kingdom, Germany, France, Saudi Arabia, India and Japan. IBM describes the gap it found between confidence and proof as an “overconfidence gap”: leaders believe they can demonstrate sovereign control of their technology, but the evidence often falls short of the Index’s highest standard. As AI adoption accelerates, IBM says that gap is turning into a business risk.

AI-related issues, including incorrect outputs, explainability problems, model or provider failures and governance concerns, were the most frequently reported individual sovereignty challenge, cited by 44% of respondents. That was ahead of formal audit or regulatory events (38%), significant provider changes (35%), data-access or transfer issues (33%) and government restrictions such as export controls, sanctions or foreign-jurisdiction issues (30%).

“Sovereignty should expand future choices, not restrict them. When a business issue turns into a sovereignty risk, boards need to show real control: how they can adapt, change strategy or critical provider — where freedom to act lies. The choices they make today matter, and the stakes are high. Getting this right can help them minimize shocks, keep their options open and stay competitive,” said Jonathan Adashek, IBM Senior Vice President and Chief Global Affairs Officer.

Confidence Runs Ahead of Proof

An average of 82% of respondents said they were very or extremely confident they could provide evidence of sovereign control, but only 26% of enterprises surveyed reached the Index’s Leading Digital Sovereignty tier, which measures more comprehensive, well-integrated evidence of control. Enterprises in that tier were more than twice as likely to resolve their most testing sovereignty challenge without material disruption — 52%, compared with 22% of enterprises still establishing their capabilities. Just 33% of respondents test their ability to demonstrate sovereignty regularly or continuously.

“Digital sovereignty is not a compliance checkbox, it’s a business reality. As AI becomes embedded across the enterprise, thinking through the many layers of sovereignty is a matter of business continuity in an age where technology is essential to run an enterprise and continue building trust,” said Emmanuel Frenehard, Chief Digital Officer at Sanofi.

Six Questions IBM Says Boards Need to Answer

The Index measures how well an organisation can demonstrate control across four pillars — AI, technology, operations and data — through six dimensions: whether it can prove who was accountable (responsibility), show exactly what happened (trace), prove its controls were working (constraint), show how it responded and recovered (intervention), explain and justify decisions under scrutiny (legitimacy), and prove it could change provider or recover operations if needed (exit). IBM says the problem usually isn’t control itself, but that sovereignty efforts aren’t built to answer these questions smoothly under pressure.

The barriers enterprises cited for building that evidence included manual or time-consuming evidence collection (56%); fragmented evidence across teams and systems, dependence on third parties for records, and legacy systems or inconsistent standards (53% each); and untested controls, recovery or exit arrangements (50%).

The Index was built on a review of 27 sources, including legislation, standards and governance frameworks, combined with the 2,003-person quantitative survey, 25 interviews with policymakers, regulators and public-sector officials, and perspectives from 17 senior customer leaders across five countries.