Gartner VP Analyst Bettina Tratz-Ryan explores how leaders can balance digital sovereignty with cost, complexity and innovation, building resilience while retaining critical technology choices.
Sovereignty and resilience have become defining concerns for leaders and boardrooms, as governments seek strategic autonomy to steer their organisations without undue external interference. As digital technologies are embedded throughout the economy and society, digital sovereignty has emerged as a neutral focus for those leaders.
For years, digital transformation was mainly about speed, scale and efficiency. Businesses moved services to the cloud, adopted global platforms and outsourced more of their technology in order to innovate faster.
That model is now being tested. Geopolitical tensions, changing regulation, supply chain disruption and growing dependence on a small number of technology providers that manage critical layers of the technology stack have made organisations think harder about who controls their systems and data.
The problem is that digital sovereignty is often presented as a simple choice: either an organisation is in control, or it’s not. That is an attractive idea, but it’s not realistic. No organisation can remove every external dependency. Nor should it try without using optionality strategies of assessing consequences in execution of their services to customers and citizens. Digital sovereignty is not about cutting ties with global technology ecosystems. It’s about deciding which dependencies are acceptable, which are too risky and where greater control is worth the cost.
That makes sovereignty a strategy of trade-offs, not a destination.
Sovereignty has several dimensions
The first step for CIOs and IT leaders is to stop treating digital sovereignty as one large, indivisible issue. It usually involves three connected areas: technology, operations and data.
Technological sovereignty is about control over the platforms, architecture and intellectual property on which a business depends. It runs alongside the technology stack and the service outcomes. Can systems be changed, moved or replaced if circumstances require it?
Building everything independently might provide more control, but it can also be expensive and slow. A regional or local platform may give an organisation greater freedom, yet it may not match the pace of innovation available that global technology providers may provide.
Operational sovereignty is about the ability to run, maintain and recover systems. This includes having the skills, processes and infrastructure to keep essential services operating if a supplier becomes unavailable or conditions change.
Many organisations respond by adopting a multi-vendor approach with hybrid strategies. This includes the open-source solutions or localised new technology ecosystems. These can reduce dependence on one primary platform base, but it opens the door to new complexity to run and govern multiple technology products and solutions in parallel. The management of those diverse systems may need a separate control plane to stay transparent, and new expertise in open source, coding or open weight models for AI needs to be developed quickly.
At the end, organisations need to understand that autonomy and sovereignty always come with a higher cost of complexity, as efficiency of working within one deeply integrated ecosystem may be lost.
Data sovereignty concerns where information is stored, where it’s processed and which laws apply to it. Keeping data within a particular country or region can support compliance and reassure customers. But applying strict localisation rules to every piece of data can create fragmented systems, duplicate infrastructure and barriers to collaboration.
In each case, greater control comes with a trade-off and a cost.
AI is exposing the gaps
The rapid adoption of generative and agentic AI is making these choices more urgent.
AI systems depend on data, computing infrastructure and models working together. In addition, the AI technology stack is based on a fragmented supply chain. If those elements sit in different jurisdictions, operate under different controls or become unavailable the results can be detrimental to the business continuity and the sovereignty control of the organisation.
For example, consider an organisation that uses multiple large language models and AI applications to process subscriber sensitive or business-critical data. It must ensure that this information is protected, excluded from providers’ training and fine-tuning processes, and not used in ways that produce unethical or biased outcomes. The organisation may then face a difficult trade off: rely on globally available modes that offer strong performance, scalability and seamless integration, or invest in local, open weight models and sovereign infrastructure that provide greater control but require more specialised, expertise, capital and ongoing maintenance,
AI is also incurring financial consequences. Model and token usage can grow quickly as systems handle more users, longer conversations and increasingly complex tasks. Agentic applications may call several models, retrieve information from multiple systems and take a series of actions before completing a request. Throughout this process, AI data use can become opaque – effectively serving as a Trojan horse that obscures where data is processed, how it is used, and where the resulting intelligence is generated. This poses a particular sovereignty challenge for organisations that need firm control over their data and AI operations.
The complexity does not only include the AI model use, but the variances of governance structure and control mechanisms that are needed to understand, manage and audit AI use cases. Simply ringfencing AI may seem like the safest option, but isolation can also constrain the outcomes. Again, AI and digital sovereignty are full of trade-off decisions and optionality.
Replace broad mandates with specific choices
Many sovereignty programmes begin with a general instruction to “increase control”. That is unlikely to produce a useful strategy.
A better starting point is to identify the critical exposure and dependencies to the success and competitiveness of organisations. Which services are critical to the business? Which data sets are most sensitive? What disruption could the organisation tolerate? Which regulatory requirements are mandatory, and which risks can be managed through contracts, encryption or stronger operational controls?
These questions help CIOs and IT leaders decide where independence is essential and where reliance on an external provider is reasonable.
For a critical national infrastructure operator, operational independence may justify investment in dedicated platforms and in-house expertise. For a retailer experimenting with a new customer service tool, the speed and flexibility of agentic AI for customer engagement require both large scale innovation as well as data protection.
There is no single right or wrong choice: sovereignty and strategic autonomy exist along a spectrum rather than as an either-or decisionThe important thing is that decisions are made consciously.
Resilience does not mean isolation
The instinct to respond to geopolitical and regulatory uncertainty by bringing technology closer to home is understandable. But reducing one dependency can create another.Therefore, we need to understand the strategic implications of optionality.
Localising data can reduce jurisdictional risk, for example, while creating fragmented architectures and limiting workload portability. Running AI in regional environments can improve trust and compliance but may increase cost and reduce access to global scale, talent and infrastructure.
The objective should be to understand which dependencies genuinely threaten the organisation and build alternatives where they matter. Digital sovereignty is ultimately about preserving options, not eliminating every external relationship.
The mature view of sovereignty
Digital sovereignty is not about eliminating risk; it is about understanding dependencies clearly and deciding where to accept, manage or reduce them.
More importantly, it gives organisations an opportunity to move beyond reacting to external pressures and adopt a proactive approach to digital maturity. That approach includes developing internal digital skills, insourcing critical capabilities and building the expertise needed to assess and, where necessary, control the technologies on which the organisation depends.
It also creates a stronger foundation for responding to emerging developments, from advanced AI to quantum computing.
Applying optionality allows organisations not only to choose between extremes of total control versus sovereignty exposure, The path of assessing a dependency spectrum treats infrastructure, data and technology partnerships as strategic choices rather than defaults. The era of unquestioned “cloud-first” thinking may be ending, but the answer is not to retreat from global technology ecosystems. It’s to use them more selectively, retain control where it matters most and recognise that every gain in sovereignty brings corresponding trade-offs.
Gartner analysts will further explore the changing dynamics of digital sovereignty at the Gartner IT Symposium/Xpo in Barcelona (9-12 November).
About the Author
Bettina Tratz-Ryan is a VP Analyst at Gartner, specialising in digital sovereignty, business and public sector resilience, sustainability and digital transformation. She advises organisations and governments on AI readiness, data management, AI sovereignty and sustainable productivity. Bettina is a recognised technology thought leader and EU Climate Pact Ambassador.
