From strategy to control: measurable sovereignty

Digital sovereignty has shifted from long-term strategic consideration to an immediate business priority for organizations around the world. The race to innovate, intensified by AI, coincides with a backdrop of increased geopolitical volatility. The challenge is no longer just where data resides. Sovereignty risk now spans regulatory exposure, cloud dependencies, vendor concentration, access control, operational resilience, and continuity of service. Organizations need game-changing solutions to remain competitive, but they also face the risk that these solutions could disappear with the stroke of a pen.  

As a result, boards are increasingly demanding that transformation is married with demonstrable control over data, workloads, access, and continuity of service. Growing operational risks and tightening regulations mean that, according to Gartner®ⁱ “By 2028, more than 75% of all enterprises outside of the US will have a digital sovereignty strategy.” 

Digital sovereignty needs more than definitions 

The continuous evolution of regulations such as NIS2, DORA, and the EU AI Act prove that minimum compliance is no longer a viable approach. Doing the bare minimum might reduce short-term exposure, but it leaves an organization exposed to geopolitical and regulatory changes.  

Organizations need to be able to measure and manage sovereignty and see the bigger picture behind every workload decision. They need the ability to evaluate trade-offs between performance, agility, and risk. If sovereignty remains an abstract concept, IT and business leaders cannot make informed decisions about architecture, procurement, or operations. It must become an ongoing operating model which is why working with experienced partners who have a broader understanding of what is needed can accelerate implementing the right strategy. 

That neutrality must be reflected in how sovereignty is measured, not only in how it is delivered. A model that spans public cloud, private cloud, and hybrid estates cannot treat every dimension as an equal item on a checklist. In the assessment model we use, data sovereignty and jurisdiction carry the heaviest weight, ahead of supply chain transparency, vendor lock-in risk, and operational independence. Such weighting matters: two organizations can hold an identical overall score while facing entirely different risk profiles, and it is the weighting that makes the difference visible. 

Frameworks provide structure, not strategy

Established models, such as the Gartner’s®ⁱⁱ definition of sovereignty, are excellent for establishing a taxonomy. They break the concept down into clear dimensions:

• Data sovereignty: Control over where data is stored, who has access, and how it is encrypted.
• Operational sovereignty: The ability to maintain visibility and control over operations, even if a vendor changes its service terms.
• Technological sovereignty: The freedom to avoid lock-in, ensuring portability and interoperability.

However, these frameworks do not dictate an organization's individual priorities. Every business has a different risk appetite, budget, and operational needs.

This is why a workable model borrows from more than one source. The approach we apply combines three: the European Commission's Cloud Sovereignty Framework for data and AI requirements, the Munich IT Department's digital sovereignty framework for the dimensional structure and weighting, and the DICTU operational sovereignty criteria for legal hard gates and procurement clauses. No single one of them is sufficient on its own.

To move from regulatory principles to practical implementation, organizations need a governance framework that translates sovereignty objectives into day-to-day decision-making. While the EU framework defines what needs to be protected, effective cloud governance determines how those protections are applied across financial management, security, compliance, and cloud operations. By embedding sovereignty considerations into operational processes, organizations can balance regulatory requirements with business priorities and risk tolerance. 

From framework to decision model 

To turn digital sovereignty into an actionable operating model, organizations should adopt a sequential, measurable approach. 

1. Align with business outcomes. 

Begin with the organization's business and IT strategy. Assess regulatory obligations, workload sensitivity, and geopolitical exposure. A global logistics company will have different constraints than a regional healthcare provider. Identify which systems require maximum isolation and which prioritize global interoperability. 

2. Baseline the score, then set a realistic target. 

Sovereignty is not a race to 100 percent. A first assessment commonly returns a score in the low forties, which sits firmly in the insufficiently sovereign band and calls for action. But the right destination is rarely the top of the scale. For a commercial organization with global operations, a defensible ambition is 65% to 75%: adequate to strong sovereignty, with documented mitigations where full independence is not economically rational. A public sector body handling citizen data, or a regulated institution running critical national infrastructure, will set 80% to 90%. The value is not the number itself. It is the explicit, board-level decision about how much control you are choosing to buy, and what you are consciously accepting in return. 

3.  Define concrete KPIs. 

Translate those strategic priorities into measurable KPIs using the EU Framework dimensions. Instead of a vague goal like "improve data privacy," set a metric such as "One hundred percent of tier-one customer data must use customer-managed encryption keys." 

4. Integrate into daily operations. 

Embed these KPIs into your existing cloud governance model. Distribute accountability across security, financial management (FinOps), and operational monitoring. This ensures sovereignty is treated as an active, continuously measured state rather than a one-time audit requirement. 

Practical example: a European financial services firm

Consider a fictional European financial institution expanding its services globally. The organization wants to use a major hyperscaler to accelerate its AI capabilities, but it must strictly adhere to DORA regulations regarding operational resilience and vendor concentration risk.

Instead of rejecting hyperscalers outright, or accepting risk blindly, the organization defines a measurable sovereignty strategy that can span hybrid or multicloud environments, aligned to EU sovereignty metrics.

This means some workloads may remain in highly controlled environments, while others can run on public cloud services with stronger access controls, encryption, monitoring, and exit planning.

In a case like this, what we would propose is a target sovereignty score in the range of 70-75%, rather than an attempt to reach the top of the scale. That band represents adequate to strong sovereignty with documented mitigations where full independence is not economically rational, and it turns an open-ended ambition into a position the board can approve, fund, and review.

Alongside the score, three legal questions would be treated as hard gates rather than footnotes in a procurement form: whether the ultimate parent company is established within the EU, whether the provider is free from direct or indirect non-EU control, and whether it is structurally protected against extraterritorial legislation such as the US CLOUD Act. For critical systems under DORA, a negative answer to any of the three becomes a mandatory decision point for legal and compliance, not a minor note.

Where this starts: one workshop, one score 

Getting to a measurable position does not require a six-month audit. A structured discovery assessment, built around preparation, one facilitated workshop day, and a consolidated report, delivers a current-state maturity view, an initial target vision, and a sovereignty score in four to six weeks. Every topic is evaluated through three lenses: control, meaning who stays in charge; compliance, meaning whether you are probably aligned; and continuity, meaning whether you can keep running. The output is not a slide deck of principles. It is a number, a gap list, and a first roadmap that can be taken to the board.

Digital sovereignty is only actionable when it is measurable, governed, and continuously managed. By starting with business context, defining clear KPIs, and embedding sovereignty into cloud governance and operations, organizations can reduce risk without slowing innovation.

With SoftwareOne, digital sovereignty becomes more than a compliance response. It becomes a practical operating model for maintaining control, improving resilience, and adopting cloud and AI with confidence.

SoftwareOne is an independent partner that helps organizations navigate these complex decisions. Our vendor-neutral approach and global expertise across cloud, software, and managed services allow us to help you design an architecture and operating model that balances control, cost, and innovation.

While the first two can usually be answered internally, the third is often less clear. Our Digital Sovereignty Strategy Workshop helps organizations assess their current position and define the right next steps. Ready to assess your sovereignty posture and define a practical path forward? Get in touch with our experts to schedule a workshop and start turning strategy into action.

ⁱ Gartner ®. Forecast Analysis: Sovereign Cloud IaaS, Worldwide. Published December 11, 2025. By Rene Buest, Fernando Pereiro, Gregor Petri, Hardeep Singh.

ⁱⁱ Gartner, “Digital Sovereignty: Protecting Data & Operations,” Gartner, accessed 10 September 2026.

Disclaimer: GARTNER is a registered trademark and service mark of Gartner, Inc. and/or its affiliates in the U.S. and internationally and is used herein with permission. All rights reserved.