Seventy-five percent sounds impressive.
Until you ask the obvious question:
What about the other 25%?
According to Capgemini’s 2026 Digital Sovereignty: From Policy Ambition to Executive Imperative report, AI is now the most-prioritized technology dimension in digital sovereignty strategies. Three-quarters of organizations put AI sovereignty ahead of data, cloud, software, cybersecurity, hardware, connectivity, and energy.
That should be a wake-up call.
And a concern.
If AI is becoming embedded in how organizations make decisions, automate operations, analyze sensitive information, and create competitive advantage, then sovereignty over AI cannot be treated as optional. Not for governments. Not for regulated industries. Not for any organization whose models, data, or decisions matter.
The bigger question is not why 75% are prioritizing AI sovereignty.
It is why 100% are not.
AI sovereignty is moving to the center
Capgemini’s findings make the direction clear.
Digital sovereignty is no longer an abstract policy topic. It is a board-level strategic issue tied to resilience, competitiveness, risk, and control. Ninety-three percent of organizations have discussed digital sovereignty at board level, and half have either appointed or are considering appointing a Chief Sovereignty Officer or equivalent.
At the same time, 79% of organizations either already have a digital sovereignty strategy or are developing one.
And 65% have allocated budget to the problem.
This is not just another compliance initiative. It is becoming part of how organizations think about their operating model. And increasingly, AI sits right in the middle of that conversation.
Why 75% may actually be too low
Capgemini identifies several reasons organizations are pursuing digital sovereignty: operational resilience, autonomy over data and models, risk reduction, lower dependency on foreign technology providers, and better auditability and accountability.
Every one of those issues becomes more acute with AI.
AI creates new dependencies around models, compute, orchestration layers, APIs, cloud providers, training environments, inference infrastructure, and data pipelines. Capgemini explicitly notes that growing concern over access to frontier models, usage restrictions, export controls, and concentration among a small number of AI providers is pushing organizations to think about AI as a sovereignty issue alongside cloud, data, and cybersecurity.
That means the 25% that are not prioritizing AI sovereignty are not sitting outside the risk. They may simply not be treating it as a sovereignty problem yet.
If an organization depends on external AI infrastructure, external models, third-party orchestration, or centralized data processing, it has already made sovereignty decisions. The question is whether it was deliberate.
Sovereignty is not the same as isolation
One of the strongest points in Capgemini’s report is that full digital independence is neither realistic nor desirable.
59% of organizations say full digital sovereignty is unrealistic. And 67% define sovereignty more in terms of resilient interdependence than isolation.
That is important because too much of the sovereignty debate still defaults to a simplistic choice:
Run everything yourself, or give up control.
Capgemini’s research points to a different model.
Organizations increasingly want the ability to choose their dependencies, maintain portability, retain control over critical assets, and use global technology without becoming irreversibly dependent on it. Nearly 70% say digital sovereignty means having the capacity to choose technological dependencies.
The goal is not to eliminate external infrastructure, external models, or external partners but to ensure those dependencies do not become a loss of control.
Sovereign cloud is not the same as sovereign AI
Sovereign cloud has become the dominant language for digital sovereignty. But cloud is only one layer.
Capgemini defines digital sovereignty across the full technology stack, including cloud, data, AI, cybersecurity, hardware, software, connectivity, and operations. It specifically includes control over how data is stored, accessed, and processed, as well as control over AI models, platforms, deployment, access, monitoring, and governance.
A workload can run in a sovereign cloud and still create sovereignty risks at the data or model layer. A model can operate in-region while sensitive data is still exposed during processing. An organization can own the infrastructure while losing practical control over how data or models are used.
Infrastructure sovereignty is a critical foundation. But sovereign infrastructure does not automatically create sovereign AI.
AI sovereignty requires control to extend into the workload itself: who can access sensitive assets, where they can be used, under what conditions, and whether the underlying data or models are exposed in the process.
That is a much more granular problem. And it is the one organizations increasingly need to solve.
The real model is selective control
The most practical framing in the report is Capgemini’s concept of minimum viable digital sovereignty: defining the smallest set of capabilities, assets, and controls that must remain under direct or assured control to safeguard critical operations.
Not everything needs the same level of sovereignty. Some workloads are low risk. Others contain sensitive data, critical IP, classified information, regulated models, or operationally important decisions. And the point is to know which is which.
That is why AI sovereignty should be a workload-level strategy.
Organizations need to understand:
- Which data and models are genuinely sensitive
- Which workloads require stronger control
- Which providers or platforms create unacceptable dependencies
- Where portability and exit options matter
- What conditions must be verified before sensitive assets are released
- How policy can remain enforceable across hybrid, public, private, and distributed infrastructure
What sovereign AI looks like in practice
This is also why we have been working with Intel and Red Hat on a different model for sovereign AI.
The premise is simple: an organization should not have to own or fully trust every layer of infrastructure in order to retain sovereignty over the sensitive data and models running on it.
- Intel provides hardware-level confidential computing capabilities that isolate workloads while they are running and enable the execution environment to be verified.
- Red Hat OpenShift provides the enterprise platform and operational scale for running confidential workloads.
- Duality provides governed workflows for sensitive AI and data collaboration determining who can participate, what assets can be used, and what each party is allowed to see.
Sovereignty should not depend entirely on who owns the infrastructure. An organization may choose to run an AI workload on infrastructure operated by another party and still require that the operator cannot access the sensitive data or models involved.
It may want to collaborate with another organization without transferring ownership or control of the underlying data.
It may want to take advantage of public-cloud compute while maintaining policies that determine exactly when sensitive assets can be released to a verified workload.
That is what selective sovereignty starts to look like in practice: not trying to control every layer equally, but applying strong technical and governance controls to the assets and workloads where sovereignty actually matters.
And it reinforces the broader point in Capgemini’s research: the future of sovereignty is unlikely to be built around isolation. It will be built around controlled interdependence, using the infrastructure, technology, and partners organizations need while retaining meaningful control over the assets they cannot afford to surrender.
So where are the other 25%?
Perhaps they still see sovereignty as a cloud procurement issue or believe data residency is enough.
Perhaps AI is not yet embedded deeply enough in their operations for the risk to feel urgent. Or perhaps they are already making sovereignty decisions without calling them that.
Whatever the reason, the gap will not last.
As AI moves into more sensitive workflows, sovereignty will become inseparable from AI strategy.
The organizations that understand this early will have more options: more flexibility in where they run workloads, more freedom in which models they use, more ability to collaborate, and more control over the assets that matter most.
The ones that do not may eventually discover that sovereignty is hardest to recover after dependency has already been designed in.
75% prioritizing AI sovereignty is progress.
But given where AI is heading, it should also make us ask a harder question:
Why is it not 100%?
