AI Governance & Architecture

Digital & AI sovereignty: stop treating it as a procurement decision

May 12, 2026

3 min read / Stephanie Griffiths

From Shadow AI to Shadow Agents
The Hidden Cost of Autonomy
Why Traditional Governance Breaks Down
Visibility Is the Missing Primitive
Human-in-the-Loop as a Design Choice
The Real Shift: From Limiting AI to Seeing It

Everyone sells sovereignty now. That's the problem.

For data and AI leaders, the debate has narrowed to data residency, where your servers sit, and which cloud has a local flag. This is where the current debate falls short.

Digital and AI sovereignty is about independence: owning and controlling your critical data and keeping your business running when the next disruption hits — whether regulatory, geopolitical, or financial.

Why should you care? This control is only possible if you are not tied to a single vendor, which could create financial vulnerability, and if you have full visibility into the volatility of your tech stack (storage, compute, AI/LLMs, distribution). Given the multiplication of actors and the variety of use cases, that’s where things get blurry. As Virginie Lange (BNP Paribas, Chief Data Science and AI Officer) puts it, “Keeping up with tech trends is nearly geopolitical intelligence work.”

Here's the real question, not whether your AI platform is "sovereign," but whether you can move without breaking everything. That's harder. And that’s a discussion that belongs in your boardroom today.

Why now?

Three global motions converged in the last 12 months, and none of them are going away.

Legislation first. The U.S. Cloud Act and FISA together allow U.S. authorities to request data stored anywhere in the world from any U.S. company. Not a theoretical risk. What’s next? The CADA (Cloud and AI Act) from the EU, which is a much-anticipated step in Europe, has been delayed by heated debate over its definition of sovereignty.

Then geopolitics made it visceral. At the International Court of Justice in The Hague, eleven judges lost access to their digital tools after being sanctioned. A judge testifying live about what it means to be cut off from your digital life tends to focus the mind. That story was shared at a French intra-ministry meeting on sovereignty in April. The room went quiet.

Then came the bills. “SaaS subscription costs from major vendors have risen between 10% and 20%, outpacing IT budget growth projections of 2.8%,” according to Mike Tucciarone, VP Analyst at Gartner. The City of Copenhagen's software bill nearly doubled between 20218 and 2023. Sovereignty, it turns out, is also a CFO conversation.

A transformation underway across Europe

The International Criminal Court in The Hague confirmed in October 2025 that it would move towards a German open-source alternative. In the Netherlands, the Dutch central bank chose Lidl for European Cloud. In Denmark, the City of Copenhagen is moving to Scaleway. This isn't a distant policy debate; it's a live conversation at the board level.

Where most companies get it wrong

They treat sovereignty as a procurement decision. Buy a sovereign cloud, pick a European LLM, work on-prem. Tick the boxes. Done.

Not quite.

You can host everything locally, run Mistral, and still have zero operational sovereignty if someone else built your AI strategy. Infrastructure without capability transfer is just infrastructure. The dependency remains. The knowledge gap remains.
The second mistake: ignoring how quickly your stack may need to change. New models, new storage solutions, hyperscalers partnering with EU players, acquisitions that quietly move your "local" provider offshore. It’s impossible to anticipate how the market and technology solutions will shift in the next few years. You can only build for adaptability by adopting a technology-agnostic approach.

The third (and biggest) mistake: losing sight of why you're doing this at all. The goal isn't sovereignty for its own sake. It's economic sovereignty. You need to own the IP of any work done via AI. We have tough non-compete clauses for staff. We should have them for agents, too.

The questions that actually matter

Ask yourself these questions before your next board meeting:

Can you shift cloud providers without losing operational continuity?
Can you deploy in an air-gapped environment if a regulator requires it?
Can you switch the LLM behind your agents — without rebuilding your workflows from scratch?
Does the intelligence your AI builds actually belong to you?

If any of those answers are uncertain, the conversation is already overdue.

What this means in practice

The companies getting ahead of this aren't just buying sovereign clouds. They're building the orchestration layer that lets them move between models, clouds, and regulatory environments without having to start over.

That's what we focus on at Dataiku, the Platform for AI Success. We won’t tell you which cloud or which model. Dataiku is the operational layer that makes your sovereign choices real: tech-agnostic, cloud-agnostic, LLM-agnostic. Your workflows, your agents, your models move with you.

So don't ask whether your AI platform is sovereign. Ask whether you have control and flexibility when it matters most, and use those filters to engage with business, finance, and IT.

Cost. What are the trade-offs of moving versus staying?

Complexity. How do you manage a fragmented, rapidly changing tech stack?

Continuity. How do you keep the business running, whatever the next geopolitical or regulatory surprise turns out to be

According to a Dataiku/Harris Poll survey based on 600 enterprise CIOs, 74% say they regret at least one major AI vendor or platform selection made in the last 18 months. Don’t be one of them. If you're not sure where to start, welcome to our next events.