98% of IT leaders call sovereignty a priority, 52% act on it

Key Takeaways

• The EU now sources over 80% of key digital products and infrastructure from outside its borders
• Only 52% of organizations have taken action on digital sovereignty despite 98% calling it a priority
• Companies that address vendor lock-in proactively spend less than those forced to act under pressure

Nearly every IT leader says digital sovereignty matters. Roughly half have done anything about it. That gap between stated priority and actual investment tells you everything about how most enterprises handle strategic risk: they wait until the pain arrives.

A recent survey by enterprise software firm SUSE found 98% of organizations call digital sovereignty a priority. Just 52% reported taking any action. The numbers land at an interesting moment. The European Commission unveiled a European Technological Sovereignty Package on June 3, 2026, treating digital dependence as a question of strategic security rather than a procurement detail.

Commission President Ursula von der Leyen was direct about the stakes. "We cannot afford to depend on others for the technologies that keep our hospitals running, our energy grids stable and our services secure," she said. "This is about protecting our citizens, defending our interests and making our own choices."

How dependent is the EU on foreign tech?

The package responds to a stark reality: the EU now relies on suppliers outside its borders for more than 80% of its key digital products, services, infrastructure, and intellectual property. That figure sits alongside another uncomfortable one. Over 90% of advanced semiconductors are manufactured in Asia.

The new measures include a Chips Act, a Cloud and AI Development Act, and a full Open Source Strategy. These build on the €43 billion already committed under the European Chips Act announced in 2022. The framing has shifted. Digital dependence is no longer treated as something procurement teams can sort out. It's positioned as a matter of self-determination.

Why do companies wait until they're forced to act?

The logic that applies to a continental-scale political union reproduces itself at company level. Any organization running on technology it does not own and cannot readily leave sits in the same position as a continent reliant on foreign suppliers. The scale differs. The vulnerability does not.

When companies do move, the principle of sovereignty rarely drives the decision. Action comes reactively, triggered by circumstances rather than strategy. This takes two forms.

Sometimes the cost surfaces internally. Financial services firms became heavy investors in open source technologies after years of steadily increasing IT bills. They had locked themselves into vendor relationships with no easy exit. The expense of staying eventually exceeded the expense of leaving.

More often, pressure arrives from outside. Regulatory requirements force movement. Or important customers set sovereignty demands that ripple across supplier chains. Either way, the company finds itself reacting on someone else's schedule.

What does reactive action cost?

Reacting under time pressure is the least effective way to solve any problem and the most expensive. The costs show up in organizational disruption as much as in money.

A company that moves early picks its own timing. It can survey the full range of options and select the ones that fit best. It negotiates from strength.

A company forced to move on someone else's schedule has less leverage, fewer choices, and higher costs. The migration happens while the business still needs to run. Technical debt accumulates. The people who know the old systems are the same people needed to build the new ones.

Freedom of this kind is never free. But it costs far less bought now than paid for under duress later.

What does enterprise sovereignty actually mean?

Sovereignty is not a product you can buy. It's the ability to walk away. An organization has sovereignty when it can leave a vendor, a platform, or an infrastructure provider without the departure threatening the business itself.

That means the answer looks different for every company. For some, it's open source infrastructure. For others, it's multi-cloud architecture that prevents any single provider from becoming a chokepoint. For many, it starts with knowing which dependencies actually exist.

The 46% gap between priority and action suggests most organizations have not done that inventory. They call sovereignty important because the word sounds important. They have not traced what would happen if a key vendor doubled prices, changed terms, or disappeared.

Frequently Asked Questions

What is digital sovereignty for enterprises?

Digital sovereignty is the ability to exit any vendor, platform, or infrastructure provider without that departure threatening business continuity. It's not a product but a structural characteristic of how technology is architected and contracted.

Why do so few companies act on digital sovereignty despite saying it's important?

Most companies address sovereignty reactively when forced by rising costs, regulatory requirements, or customer demands. The principle alone rarely drives action because the costs of inaction are not immediate or visible until lock-in becomes painful.

What is the EU European Technological Sovereignty Package?

Unveiled in June 2026, the package includes a Chips Act, Cloud and AI Development Act, and Open Source Strategy. It treats digital dependence as a strategic security issue rather than a procurement matter, responding to EU reliance on foreign suppliers for over 80% of key digital infrastructure.

How can enterprises start addressing vendor lock-in?

Begin by mapping dependencies: which vendors, platforms, and infrastructure providers could threaten operations if they changed terms or became unavailable? Then evaluate exit costs and optionality for each critical dependency.

Source: Fast Company / Faisal Hoque