A board level topic with almost no operational owner
Capgemini's survey of 1,300 executives across the US, UK, Europe, and APAC, covered by diginomica, puts a number on a gap that most enterprise technology leaders have sensed for a while but rarely measured: digital sovereignty has become a board level conversation almost everywhere, with 93 percent of respondents saying it comes up at that level, yet only 31 percent of organizations have put dedicated governance in place to actually manage it. That 62 point gap between discussion and ownership is the real finding here, more than any single dependency statistic.
The concern varies somewhat by geography, but it stays high everywhere surveyed. APAC respondents report the highest concern about foreign dependency at 68 percent, followed by Europe at 66 percent, the UK at 63 percent, and the US at 62 percent. The fact that US organizations, sitting inside the country that supplies most of the dependencies everyone else worries about, still report 62 percent concern suggests this is no longer purely a story about Europe pushing back against American technology platforms.
The dependency map most enterprises have never drawn
The survey's vendor concentration numbers explain why the concern is so broad. A majority of respondents rely on foreign based primary providers across every category Capgemini asked about: hardware at 62 percent, cybersecurity at 59 percent, software at 57 percent, and cloud at 51 percent. These are not niche dependencies, they sit at the center of how a modern enterprise operates, which is exactly why unwinding them is so difficult and why so few organizations have actually tried.
The exit timeline numbers make the difficulty concrete. Only 13 percent of respondents say they could switch away from a critical provider within three months, 41 percent estimate up to a year, 36 percent say it would take more than 12 months, and 10 percent say they have no viable alternative at all. That last figure, one in ten organizations with literally no fallback option for a provider they depend on, is the kind of exposure a board conversation alone does not fix.
Why this is not simply Europe versus Big Tech
Capgemini CEO Aiman Ezzat, speaking at Davos, framed the European dimension bluntly, saying the region has "a huge amount of dependency on US technology today." France's plan to move 2.5 million public sector devices to Linux by fall 2026 is the kind of visible, politically charged response that framing tends to produce. But diginomica's reporting is careful to note that most organizations, even those taking sovereignty seriously, are pursuing what the piece calls strategic autonomy rather than complete autonomy, meaning a deliberate choice about which dependencies to accept rather than an attempt to eliminate all of them.
That distinction matters because it is also how respondents themselves define the term: 69 percent describe sovereignty as the capacity to choose their own dependencies, not as full technological independence. Framed that way, sovereignty planning looks less like a geopolitical statement and more like a conventional risk management exercise, the kind any CIO already runs for single supplier dependency in procurement or supply chain. The novelty is that this exercise now has to run across cloud, software, hardware, cybersecurity, and AI simultaneously.
A new seat at the table, slowly filling in
Ten percent of surveyed organizations already have a dedicated Chief Sovereignty Officer, and another 40 percent are considering creating the role, with US organizations the most active on both counts at 9 percent already in place and 46 percent considering it. Deutsche Telekom is cited as an early and visible adopter, having named former CTO Christine Knackfuss-Nikolic to the position. For a title that barely existed two years ago, that adoption curve is fast.
Sixty five percent of respondents report a dedicated sovereignty budget, which suggests this has moved past the stage of a working group with no funding. Priorities within that spending skew toward the categories respondents see as most exposed: AI draws attention from roughly two thirds of respondents, data from 64 percent, connectivity from 58 percent, and cloud and software from 57 percent each. Energy and hardware trail at 42 and 41 percent, which tracks with how much harder physical infrastructure is to diversify quickly compared with software contracts.
The assessment gap between countries
Among the 741 organizations in the survey that describe themselves as having significant exposure, roughly two thirds regularly assess their dependency risk, but that average hides a wide national spread. Japan leads at 87 percent of exposed organizations conducting regular assessment, while the UK sits at 52 percent and the US at just 46 percent, the lowest of any market surveyed despite being the country where the Chief Sovereignty Officer role is spreading fastest.
That mismatch, high role adoption paired with low assessment discipline in the US, suggests some organizations are creating the governance title before doing the underlying risk mapping it is supposed to oversee. A sovereignty officer without a completed dependency assessment is a structure without the data it needs to make a real decision, which risks turning the role into a symbolic response to board pressure rather than the operational function the survey's own framing describes.
What this means for a CIO's own roadmap
The practical starting point this survey points to is the one most CIOs have not done formally: an honest map of which providers across cloud, software, hardware, cybersecurity, and AI the organization could not quickly replace, and how long a real replacement would actually take. That exercise does not require a new executive title or a large budget to start, it requires the same discipline procurement teams already apply to single source supplier risk, extended to technology categories that have not traditionally been treated as supply chain risk.
This becomes a genuine 2027 planning item once that map is paired with Capgemini's own framing of sovereignty as a spectrum of acceptable dependency, not a single switch to flip. Most CIOs can reasonably keep relying on dominant cloud and AI vendors for the bulk of their stack, but the 10 percent of organizations in this survey with literally no fallback option have a gap worth closing well before a vendor disruption forces the question. A minimum viable sovereignty plan, built around the smallest set of capabilities that must stay under direct or assured control, is the version of this work that fits inside an existing risk budget rather than requiring a new one.
