How sovereign do you need to be? Start with a number

Ask a room of executives whether their organization is digitally sovereign and you’re unlikely to get a simple answer.

They will most likely discuss regulatory requirements, jurisdiction, and where data is hosted, and which cloud providers the business uses. Somebody will bring up how security, encryption and access controls are managed, and someone will ask what all of this means for AI.

Those are important conversations, but they often leave a crucial question unanswered: How sovereign does your organization actually need to be? The answer will differ from one workload, application and AI agent to the next.

Sovereignty isn’t a yes-or-no question

The language we use for digital sovereignty can be misleading. We talk about an organization being “sovereign” as though it were a state you either achieve fully or not at all.

Real technology estates don’t work that way. A bank’s core payments platform contains highly sensitive data and operates under strict regulatory requirements, but a development environment used to test a new employee application has very different requirements.

When you treat both as though they require the same level of sovereignty, you create one of two problems: Apply too little control and you expose key workloads; apply too much and sovereignty delivers little value while limiting your choice of platforms, services and AI capabilities.

This is why sovereignty needs to be determined at the workload level, not across the enterprise as a whole — and the same principle applies to AI agents. An agent that summarizes publicly available research presents a very different sovereignty profile from one that accesses customer records or initiates transactions.

Knowing where your data is stored is just the start. You also need to understand who and what can access it, who controls the technology around it, and which jurisdictions and providers are involved. And, importantly, can you change those arrangements if you need to?

• ALSO READ: What CADA really means for digital sovereignty in Europe

Control matters more than independence

There is another misconception worth clearing up: Sovereignty doesn’t mean eliminating dependency.

All organizations depend on software vendors, cloud platforms, network providers, hardware manufacturers, data centers and a complex, growing ecosystem of AI models and services. Trying to remove every dependency would be prohibitively expensive and, often, technologically self-defeating. What matters is whether those dependencies are understood and chosen.

Sovereign organizations know where their dependencies lie, what those dependencies affect, what risks they create and what they cost. They also know whether they have a realistic way out.

Think of a critical application running on a particular cloud platform. Can you move that application if, for example, your cloud provider’s commercial terms change or a new regulation affects the workload? If the answer is “not without enormous disruption, cost or risk,” that dependency deserves attention.

You cannot manage sovereignty without examining the full stack

Sovereignty, then, isn’t isolation. It’s the ability to make informed choices about control and to have suitable options when circumstances change. And this is why you can’t approach digital sovereignty through one slice of the technology estate: cloud, data residency, cybersecurity or regulatory compliance.

Sovereignty risk can be found anywhere in the stack. A workload may meet its data-residency requirements while still depending on technology or operational processes governed elsewhere. An application may run in the right jurisdiction but rely on a platform that makes portability difficult.

The NTT DATA Full-Stack Sovereignty Scan covers the full stack of infrastructure services rather than evaluating sovereignty through the lens of a single technology or provider.

The aim is not to start with a predetermined answer about where workloads or agents should run but to establish the level of sovereignty that each workload requires, measure your organization’s current position against that requirement and identify areas that need attention.

How we put a number on it

Without an established baseline, you can’t assess your organization’s sovereignty objectively. You may have policies, architectural diagrams, contracts and compliance reports but no measurement that brings those pieces together.

Our sovereignty scan changes that by giving you an evidence-based sovereignty score from zero to 100 that shows where your organization stands today and where you need to be.

When a highly regulated workload falls well short of the control it requires, that becomes a priority. Similarly, another workload might have been engineered to a much higher sovereignty standard than its risk profile warrants, meaning you’re paying for controls you don’t need. Measurement replaces guesswork in both directions.

And when you examine your position rigorously, you may even discover you’re more sovereign than you thought. Your existing controls, contractual protections, architecture and operating practices may already address risks that had previously been difficult to quantify.

The scan is just the start

There is a practical test for any sovereignty assessment: What happens the day after it is presented?

A score that sits in a board report achieves very little. If the scan identifies a portability problem, somebody has to redesign or migrate the workload. If controls are insufficient, they need to be strengthened. If you’re paying a sovereignty premium for controls you don’t need, your architecture may need to change.

Our scan doesn’t define sovereignty according to a single provider’s technology, nor does it stop at your assessment score. Once we have measured your sovereignty position, we can advise on what needs to change, then build, migrate and operate the infrastructure required to make that change.

This changes sovereignty from an abstract regulatory or technology discussion into a set of decisions, ranked by risk and backed by evidence.

When someone asks, have an answer

Questions about digital sovereignty will soon become harder to avoid. They may come from regulators scrutinizing data and technology dependencies, from customers who are evaluating suppliers, or from boards concerned about geopolitical exposure, operational resilience or AI.

They may even emerge unexpectedly when providers change their terms and you discover that an assumed exit route doesn’t really exist.

When that moment arrives, there are two possible responses. One is an opinion about how sovereign you think your organization is. The other is a number you can defend, evidence that explains it and a plan for addressing the gaps you’ve identified.

What to do next

Talk to an NTT DATA representative about our Full-Stack Sovereignty Scan to understand where your technology estate stands today.