Digital Sovereignty Is Becoming a Board-Level Resilience Priority

Critical digital infrastructure is increasingly being managed as an operational dependency rather than a back-office IT service. A Capgemini survey of 1,300 executives at large organizations and public bodies in 11 countries found that geopolitical tensions, export controls, and cyber threats are pushing leaders to scrutinize reliance on technology providers that can be difficult to replace. 5

From IT dependency to business-continuity risk

Cloud platforms, data centers, telecommunications networks, and specialist technology vendors underpin day-to-day operations. If access to a critical provider is disrupted, restricted, or compromised, the consequences can extend well beyond an IT outage.

That is why boards are increasingly approaching digital infrastructure in the same way they approach energy and physical supply chains: with governance, contingency planning, and resilience investment. The survey reporting points to greater board-level attention as organizations reassess dependencies that had previously been taken for granted. 5

The key question is practical: could the business keep operating if a critical provider became unavailable?

Digital sovereignty means retaining choices

Digital sovereignty is often framed as a debate over national or regional technology. For organizations, the more useful definition is the ability to exercise choice, control, and governance across data, operational, technical, and legal layers while still using global technology partners. 8

In operational terms, that means substitutability:

• maintaining the option to move a critical workload;
• avoiding technology designs that make migration prohibitively difficult;
• understanding who controls access to data and systems; and
• being able to rebuild or redeploy services if a particular environment fails.

Capgemini describes sovereignty by design as portability, optionality, and the ability to switch solutions or rapidly rebuild a technology stack when needed. 37

This is not necessarily a call to replace every international provider. It is a call to avoid a position where a company has no workable alternative.

What organizations are trying to keep under control

The highest-stakes dependencies tend to involve assets that are difficult to recover, recreate, or transfer. These can include proprietary and sensitive data, AI models, intellectual property, and business-critical workloads.

Control has several dimensions. It includes where data resides, who can access it, who operates the environment, what architecture supports it, and which legal regimes apply. 31 A resilience plan that addresses only data location, but not operational or technical portability, may leave a major dependency unresolved.

Airbus shows the diversification approach

Airbus offers an example of how a company can reduce concentration risk for sensitive workloads without treating sovereignty as total isolation. The aerospace company signed a multi-year agreement with Iliad-owned Scaleway to provide cloud infrastructure for sensitive industrial and defense applications, including AI tools developed with Mistral. The infrastructure is intended to host critical applications across aircraft design, engineering, industrial production, and corporate operations. 18

Airbus has also described its strategy around operational continuity, control of data access, mitigation of vendor lock-in, and technological capability. 24 The underlying approach is diversification: identify systems where dependency creates unacceptable risk and establish an alternative that meets the required technical, security, and legal conditions.

A useful board agenda for digital resilience

For leadership teams, the priority is not a broad declaration of sovereignty. It is a testable resilience program:

1. Map critical dependencies. Identify the providers, services, data flows, and workloads whose disruption would stop or materially impair operations.
2. Classify the assets at risk. Separate routine systems from sensitive data, intellectual property, AI assets, and mission-critical processes.
3. Assess substitutability. Determine whether each critical workload can be moved, restored, or rebuilt—and under what conditions.
4. Create credible exit and continuity plans. A contract clause alone is not an exit plan; organizations need workable technical, operational, and legal arrangements.
5. Test the plan. Portability matters only if migration and recovery procedures can be executed within an acceptable business timeframe.

The central lesson is straightforward: digital sovereignty is becoming a resilience capability. Organizations that preserve control and credible alternatives are better positioned to withstand provider outages, cyber incidents, legal constraints, and geopolitical shocks. 58