What does a Capgemini survey of 1,300 executives from large organizations and public bodies across 11 countries reveal about their growing exposure to digital sovereignty risks from geopolitical tensions, export controls, cyberattacks, and disruptions to data center and telecommu

The survey indicates that dependence on cloud, data-centre, telecoms, and other critical digital providers is now viewed as a concrete operational-resilience risk—not merely an IT concern. Geopolitical tension, export controls, cyberattacks, and attacks or disruption affecting data-centre and telecommunications infrastructure have made the potential loss of a provider materially more salient. 1

What boards are doing

• Boards are treating digital infrastructure more like energy and physical supply chains because its failure can interrupt core operations and may not be quickly reversible. That is driving greater board oversight, contingency planning, risk mapping, and investment in resilience. 1
• The objective is not necessarily to replace every foreign or large technology provider. It is to avoid being locked in: retain credible alternatives, portable architectures, and practical exit plans. 1

Exposure and budgets

• The supplied evidence does not state the percentage of organizations reporting “significant exposure,” nor the percentage that have set aside a dedicated sovereignty budget. Insufficient evidence to give those figures reliably.

Airbus and reducing dependency

• Airbus is an example of a company reducing concentration risk by using alternative infrastructure for sensitive work: it signed a multi-year agreement with Scaleway for cloud infrastructure supporting sensitive industrial and defence applications and AI tools. 2
• More broadly, this approach means diversifying providers and ensuring critical technologies or workloads can be moved if a supplier becomes unavailable, restricted, or compromised. 1

Meaning of digital sovereignty

• In this context, digital sovereignty means “substitutability”: an organization’s capacity to replace a critical technology or provider when necessary. It is not inherently a nationalist policy or an opposition between countries. 1
• The practical test is whether the organization can switch providers while preserving business continuity, legal control, security, and access to essential assets. 1

Assets organizations want to control

Executives are particularly concerned with retaining control over:

• Proprietary and sensitive data;
• AI models;
• Intellectual property; and
• Other critical workloads whose loss of access, migration, or reconstruction would be difficult. 1

How long a replacement could take

• Nearly half of surveyed organizations estimated that replacing a critical provider would take between three months and one year. 1
• More than one-third expected replacement to take longer than a year, illustrating why portability and contingency arrangements are becoming board-level priorities. 1