IBM says sovereignty confidence is running ahead of proof

IBM released its inaugural Digital Sovereignty Index on November 11, saying enterprises were more confident in their control of technology than their routine testing could substantiate.

The company said 94% of surveyed enterprises had faced at least one sovereignty challenge in the previous three years, while 33% of respondents regularly or continuously tested their ability to demonstrate control. The percentages are IBM-reported survey results, not independently audited estimates of the wider enterprise population.

Digital sovereignty, as IBM uses the term, is an organization’s ability to retain and demonstrate control over its AI, technology, operations and data, including when providers fail or legal and operational conditions change. IBM said the index assesses reported evidence across six dimensions: responsibility, trace, constraint, intervention, legitimacy and exit.

Among surveyed enterprises that had encountered a sovereignty challenge, IBM said 81% had been required to provide formal evidence of control to regulators, customers, auditors or internal stakeholders. AI-related issues were the most frequently cited individual challenge, according to IBM, selected by 44% of respondents. The company’s examples included incorrect AI outputs, explainability problems, model or provider failures and governance concerns. The AI-related result sits alongside IBM’s rollout of identity and access controls for enterprise AI agents.

IBM also reported that an average of 82% of respondents were very or extremely confident they could provide evidence of sovereign control across six evidence dimensions. By contrast, 26% of surveyed enterprises qualified for IBM’s Leading Digital Sovereignty tier, a separate maturity classification intended to reflect more comprehensive and integrated evidence. Confidence and tier placement are different measures, so the figures are not a like-for-like comparison.

The IBM report describes a 20-minute online survey of 2,003 senior decision-makers responsible for areas including data, AI, technology, operations, governance, risk and compliance. It lists samples from the United States, United Kingdom, Germany, India, Japan, France and Saudi Arabia. IBM said the research also included 25 interviews with policymakers, regulators, public-sector officials and policy experts across those seven markets, plus perspectives from 17 senior customer leaders in five countries.

The published materials do not disclose the survey’s field dates, recruitment and sampling design, weighting, response rate, question wording, fieldwork provider or uncertainty estimates. Nor do they clarify whether IBM alone sponsored, commissioned, designed, analyzed or fielded each stage of the work. IBM says participating organizations were not independently audited, and it has not published the questionnaire, raw data, cross-tabs or a reproducible formula for the index tiers. Those gaps prevent independent recalculation of the headline findings, and IBM’s materials do not establish that the combined results are globally representative.