A new IBM study finds that enterprises are struggling to demonstrate control over their AI, data and technology dependencies, despite widespread confidence in their ability to do so, according to the company’s November 11 Digital Sovereignty Index. 

The research found that 94% of surveyed organizations had faced at least one digital sovereignty challenge in the previous three years. Among those affected, 81% had been required to provide formal evidence of control to regulators, customers, auditors or internal stakeholders.

The study surveyed 2,003 senior decision-makers at large enterprises across the United States, United Kingdom, Germany, France, Saudi Arabia, India and Japan. 

AI-related problems, including incorrect outputs, explainability issues, model or provider failures and AI governance concerns, emerged as the most frequently reported individual sovereignty challenge, cited by 44% of respondents.

Confidence in Digital Control Outpaces Demonstrable Evidence

IBM’s research identified a gap between how confident organizations are about their sovereignty capabilities and what they can actually demonstrate. On average, 82% of respondents said they were very or extremely confident in their ability to provide evidence of sovereign control. However, only 26% of surveyed enterprises reached the Index’s highest category, called Leading Digital Sovereignty.

Just 33% of respondents said they regularly or continuously test their ability to demonstrate sovereignty through governance and assurance processes. The gap suggests that organizations may have policies and controls in place without consistently testing whether those measures would hold up under scrutiny or disruption.

The Index assesses sovereignty across four areas: AI, technology, operations and data. It evaluates six dimensions of control: responsibility, traceability, constraint, intervention, legitimacy and exit. These measure whether organizations can establish accountability, reconstruct what happened, demonstrate that safeguards worked, explain their decisions and recover operations or change providers when necessary.

AI Failures Are Becoming a Sovereignty Risk

AI-related issues ranked ahead of several other sovereignty challenges in the survey. Respondents also cited formal audits or regulatory events (38%), significant provider changes (35%), data-access or transfer issues (33%) and government restrictions affecting technology, models, data or operations (30%).

The findings underline how dependence on external AI models and providers can create risks that extend beyond the performance of an individual system. Incorrect outputs, limited explainability or provider failures can affect an organization’s ability to maintain control over its data, operations and business processes.

Emmanuel Frenehard, chief digital officer at Sanofi, said digital sovereignty was increasingly a business-continuity concern as AI becomes embedded across enterprises. He emphasized the importance of understanding the different layers of sovereignty to maintain trust and keep essential technology operations running.

Proving Control Requires Regular Testing

The findings highlight a growing accountability issue for chief data officers (CDOs) and other technology leaders. Organizations must be able to demonstrate who is responsible for AI systems, what data and technology dependencies they rely on, whether controls are working and how they can respond when a provider or system fails. These responsibilities increasingly intersect with enterprise AI governance.

The study also identifies practical obstacles to demonstrating sovereignty. More than half of respondents cited manual or time-consuming evidence collection (56%), fragmented evidence across teams and systems (53%), dependence on third parties for records (53%) and legacy systems or inconsistent standards (53%). Half also reported untested controls, recovery arrangements or exit plans as a barrier.

For CDOs, these findings point to the importance of connecting data governance with evidence collection and operational assurance. Data lineage, access records, ownership responsibilities and audit trails can help organizations establish what information an AI system used, who authorized its access and how its outputs or actions were reviewed.

IBM’s findings also suggest that governance needs to be tested regularly. Organizations that reached the Leading Digital Sovereignty tier were more likely to test their capabilities continuously or on a regular basis. They were also more than twice as likely to resolve their most challenging sovereignty event without material disruption, compared with organizations still establishing their capabilities.