Digital sovereignty leaves enterprises chasing their own audit trails

94% of surveyed enterprises experienced at least one digital sovereignty challenge in the past three years, according to IBM’s Digital Sovereignty Index.

Of those affected, 91% were required to demonstrate that they retained control during their most challenging event, and 81% had to provide formal evidence to regulators, auditors, customers or internal stakeholders.

The report defines digital sovereignty as an organization’s ability to retain control and provide credible evidence of that control across critical AI, technology, operations and data.

During their most challenging sovereignty incident, 33% of enterprises reported being able to demonstrate exit fully and credibly, without significant follow-up.

Continuous testing or testing through regular governance and assurance processes was reported by 63% of enterprises in the highest tier and 9% in the lowest tier.

Enterprises in the highest tier reported fewer barriers to producing evidence.

The index placed 26% of enterprises in its highest maturity tier, Leading Digital Sovereignty; fragmented records, dependence on third parties for information, and legacy systems or inconsistent standards were each cited by 53%.

Across the six dimensions, an average of 82% of respondents were very or extremely confident they could provide evidence of control.

When a business issue turns into a sovereignty risk, boards need to show real control: how they can adapt, change strategy or critical provider – where freedom to act lies.

IBM recommends keeping this evidence current and accessible as systems and dependencies change.

Restrictions imposed by an external authority or provider can also affect access to an AI model, and an enterprise may need an alternative model or provider with different performance or behavior.