IBM Digital Sovereignty Index: In the AI Era, Control Is No Longer Enough. Enterprises Must Prove it.

Manual or time-consuming evidence collection was a barrier for 56% of respondents in IBM's digital sovereignty research.

Rhea-AI Summary

IBM (NYSE: IBM) released its Digital Sovereignty Index, examining how large enterprises demonstrate control over their technology and data. The survey covered 2,003 senior decision-makers across seven countries. Digital sovereignty means retaining and proving control over AI, technology, operations and data, including under pressure.

94% of enterprises surveyed faced at least one sovereignty challenge in the last three years; 81% of those had to provide formal evidence of control. AI-related issues were the most frequently reported individual challenge, at 44%. An average of 82% of respondents were very or extremely confident they could provide evidence of sovereign control, but only 26% of enterprises reached the Index's highest tier. Just 33% regularly or continuously tested their ability to demonstrate sovereignty.

News Explained

The report adds a group comparison: 52% of surveyed enterprises in the Leading tier resolved their most testing sovereignty challenge without material disruption, versus 22% of those still establishing evidence.

Key Figures

Enterprises reporting a sovereignty challenge: 94% Formal evidence required: 81% AI-related sovereignty challenges: 44% +5 more

Enterprises reporting a sovereignty challenge

94%

At least one challenge in the last three years

Formal evidence required

81%

Among respondents affected by a sovereignty challenge

AI-related sovereignty challenges

44%

Most frequently reported individual challenge

Confidence in providing evidence

82%

Very or extremely confident, on average

Leading Digital Sovereignty tier

26%

Share of surveyed enterprises reaching the tier

Regular sovereignty testing

33%

Respondents testing continuously or through regular governance and assurance

Challenge resolved without material disruption

52% vs. 22%

Leading-tier enterprises compared with establishing enterprises

Survey respondents

2,003 senior decision-makers

Large enterprises across seven countries

Key Terms

export control

1 terms

export control regulatory

"A government restriction, such as an export control, sanction or foreign-jurisdiction issue"

Export control are government rules that limit the sale, transfer or disclosure of certain goods, technology or services to foreign countries, organizations, or individuals. They matter to investors because they can block or restrict a company’s ability to reach markets, partner internationally or generate revenue—think of them like travel visas for products and know‑how; violations can lead to fines, lost contracts and serious legal and reputational risk.

AI-generated analysis. How Rhea-AI works. Not financial advice.

See more from StockTitan in Google Search and AI answers. Adds StockTitan as a preferred source · opens Google

Add on Google Not now

• Proof of sovereignty is now expected: Most enterprises surveyed (94%) faced at least one sovereignty challenge in the last three years, and 81% of those had to provide formal evidence of control.
• AI is the sovereignty stress test: AI-related issues such as provider or governance failures were the most common sovereignty challenge (44%) among respondents, ahead of data-access issues, government restrictions, or formal audits.
• Confidence runs ahead of proof: An average of 82% of respondents are very or extremely confident they can provide evidence of sovereign control, but only 26% of enterprises reached the Index's Leading Digital Sovereignty tier, while just 33% regularly test their capabilities.

ARMONK, N.Y., Nov. 11, 2026 /PRNewswire/ -- A new report from IBM (NYSE: IBM), Proof, Not Promises: The Digital Sovereignty Index, reveals an "overconfidence gap": leaders believe they can prove sovereign control of their technology, but the evidence often falls short of the Index's highest standards. As AI adoption accelerates, that gap is becoming a business risk.

The Index looked at an organization's ability to retain and prove control across its critical AI, technology, operations and data, including when conditions change or dependencies come under pressure. That control is being put to the test, turning digital sovereignty from a technology concern into an issue of resilience, business performance and board-level accountability. 94% of enterprises surveyed faced at least one sovereignty challenge in the last three years, including AI-provider failures, regulatory conflicts, critical vendor disruption, government restrictions such as export controls, or data-access issues. Among those affected, 81% had to provide formal evidence to regulators, customers, auditors or internal stakeholders.

Control you can't prove is becoming a business liability

As global sovereignty strategies mature, the business challenge is to identify where a business risk can turn into a sovereignty challenge and avoid disruption when scrutiny arrives. The impact of controlling and proving sovereignty can force changes to providers, architecture, AI or data practices, limiting freedom to act when it matters most.

IBM's Digital Sovereignty Index measures organizations' reported evidence of control in the case of a sovereignty event across AI, technology, operations and data, examining six areas:

• Responsibility: Can you prove who was accountable?
• Trace: Can you show exactly what happened?
• Constraint: Can you prove controls were working?
• Intervention: Can you show how you responded and recovered?
• Legitimacy: Can you explain and justify decisions under scrutiny?
• Exit: Can you prove you could change provider or recover operations if needed?

The findings suggest the problem isn't usually just control. It's that sovereignty efforts aren't built to answer these questions smoothly under pressure.

"Sovereignty should expand future choices, not restrict them," said Jonathan Adashek, IBM Senior Vice President and Chief Global Affairs Officer. "When a business issue turns into a sovereignty risk, boards need to show real control: how they can adapt, change strategy or critical provider – where freedom to act lies. The choices they make today matter, and the stakes are high. Getting this right can help them minimize shocks, keep their options open and stay competitive."

The ability to change course in relation to technology remains under-tested: only a third (33%) of respondents test their ability to demonstrate sovereignty continuously or as part of regular governance and assurance processes.

 AI is the sovereignty stress test

AI-related issues, including incorrect outputs, explainability problems, model or provider failures and governance concerns, were the most frequently reported individual sovereignty challenge among respondents, at 44%. These came ahead of other factors they cited including:

• Formal audit or regulatory events (38%),
• A government restriction, such as an export control, sanction or foreign-jurisdiction issue affecting access to technology, AI models, data, providers or operations (30%),
• significant provider changes (35%),
• data-access or transfer issues (33%)

"Digital sovereignty is not a compliance checkbox, it's a business reality", said Emmanuel Frenehard, Chief Digital Officer at Sanofi. "As AI becomes embedded across the enterprise, thinking through the many layers of sovereignty is a matter of business continuity in an age where technology is essential to run an enterprise and continue building trust."

"Companies prioritizing sovereignty are rightly planning for control, but the leaders plan for proof too. The next step is not simply more governance or regulation. It is stronger evidence that the governance works: testing exit capabilities, understanding critical dependencies and focusing efforts where a loss of control would have the greatest impact," Jonathan Adashek continued.

Leadership can pay off

While an average of 82% of respondents were very or extremely confident they could provide evidence of sovereign control, only 26% of surveyed enterprises reached the Index's Leading Digital Sovereignty tier, which measures more comprehensive, well-integrated evidence of sovereign control. Enterprises in that tier were more than twice as likely to resolve their most testing sovereignty challenge without material disruption (52%, compared with 22% of establishing enterprises).

Other key findings include:

• Testing sets Index leaders apart: 63% of leading enterprises regularly or continuously test their ability to demonstrate sovereignty, compared with 29% still establishing evidence and just 9% at the earliest stage.
• Proof is an operational challenge: Barriers reported included manual or time-consuming evidence collection (56%), fragmented evidence across teams and systems, dependence on third parties for records, and legacy systems or inconsistent standards (each 53%), and untested controls, recovery or exit arrangements (50%).

Research Methodology

The IBM Digital Sovereignty Index was developed through a multi-stage research program combining a review of 27 sources, including legislation, standards, governance frameworks, academic research and industry thought leadership, with qualitative interviews and an international quantitative survey.

The quantitative study surveyed 2,003 senior decision-makers within large enterprises across the United States, United Kingdom, Germany, France, Saudi Arabia, India and Japan. The research also included 25 interviews with policymakers, regulators, public-sector officials and policy experts, as well as perspectives from 17 senior customer leaders across five countries.

The Index measures how well an organization can demonstrate control across four pillars: AI, technology, operations and data. Within those pillars, it evaluates six dimensions of control: responsibility, traceability, constraint, intervention, exit and legitimacy.

To read Proof, Not Promises: The Digital Sovereignty Index, visit www.ibm.com/campaign/digital-sovereignty-index.

About IBM

IBM is a leading provider of global hybrid cloud and AI, and consulting expertise. We help clients in more than 175 countries capitalize on insights from their data, streamline business processes, reduce costs and gain the competitive edge in their industries. Thousands of governments and corporate entities in critical infrastructure areas such as financial services, telecommunications and healthcare rely on IBM's hybrid cloud platform and Red Hat OpenShift to affect their digital transformations quickly, efficiently and securely. IBM's breakthrough innovations in AI, quantum computing, industry-specific cloud solutions and consulting deliver open and flexible options to our clients. All of this is backed by IBM's long-standing commitment to trust, transparency, responsibility, inclusivity, and service. Visit www.ibm.com for more information.

Media contacts:
Lobna Hassan
lobna.hassan@ibm.com 

David Whitehead
ibmdigitalborders@edelman.com

View original content to download multimedia:https://www.prnewswire.com/news-releases/ibm-digital-sovereignty-index-in-the-ai-era-control-is-no-longer-enough-enterprises-must-prove-it-302935665.html

SOURCE IBM

FAQ

AI-generated questions and answers. How Rhea-AI works. Not financial advice.

What did IBM's Digital Sovereignty Index find about AI-related challenges?

AI-related issues were the most frequently reported individual sovereignty challenge, at 44% of respondents. These included incorrect outputs, explainability problems, model or provider failures and governance concerns.

How did IBM measure digital sovereignty in its new Index?

The Index assessed organizations' reported evidence of control across AI, technology, operations and data. It evaluated responsibility, traceability, constraint, intervention, exit and legitimacy. The research combined a review of 27 sources, qualitative interviews and a survey of 2,003 senior decision-makers at large enterprises across seven countries.