Why Digital Infrastructure Is Becoming a Board-Level Risk
For years, companies treated cloud platforms, telecommunications networks, software providers and data centers primarily as technology decisions.
The conversation was often about cost, performance, scalability and convenience.
That calculation is changing.
Geopolitical tensions, export controls, cyber threats and physical attacks on infrastructure have made organizations more aware that digital systems can be disrupted for reasons that have little to do with conventional IT failures.
Reuters reported on September 8, 2026, that executives are increasingly examining their dependence on critical digital infrastructure as these risks become more concrete. The Capgemini research surveyed 1,300 executives globally, while Capgemini says 93% of organizations have discussed digital sovereignty at board level. (Reuters)
From IT problem to business continuity problem
Consider a company that depends heavily on one cloud provider.
Normally, that dependency might not seem dangerous. The provider offers enormous computing capacity, sophisticated security and global availability.
But what happens if regulations change? What if an international conflict affects technology exports? What if an outage lasts longer than expected? What if the organization needs to move its workloads to another provider but discovers that migration would take months?
Suddenly, the issue is no longer simply an IT problem.
It becomes a business continuity problem.
Question: Why are boards paying more attention to digital infrastructure?
Because disruption to cloud, connectivity, software, data or AI systems can interrupt core business operations. Organizations therefore need to understand not only whether technology works today, but whether they can maintain access to it when circumstances change.
What the new survey reveals
The Capgemini research points toward a broader change in corporate thinking.
Organizations are not necessarily trying to eliminate every external technology provider. Instead, they are trying to understand where they are dependent on others and whether those dependencies can be managed.
That distinction matters.
Capgemini says 59% of organizations consider full digital sovereignty unrealistic, suggesting that businesses recognize complete technological independence is neither practical nor necessarily desirable. The emerging goal is managed interdependence: keeping access to global innovation while retaining enough control and flexibility to protect critical operations. (Capgemini)
What Is Digital Sovereignty and Why Does It Matter?
Digital sovereignty means having sufficient control over critical data, technologies and digital operations to make decisions independently and remain resilient when external conditions change.
It does not necessarily mean building everything yourself or refusing to use foreign technology.
Instead, it is about understanding dependencies and maintaining meaningful choices.
Capgemini describes digital sovereignty across areas including data, technology, operations and legal control, while its broader framework considers connectivity, cloud, data, AI, energy, hardware, software and cybersecurity. (Capgemini)
Digital sovereignty is about choice, not isolation
Imagine you use a particular software platform because it is the best product available.
There is nothing inherently wrong with that.
The problem appears when switching away from that platform becomes practically impossible.
Perhaps your data is stored in proprietary formats. Perhaps your applications depend on provider-specific services. Perhaps employees have been trained around one ecosystem. Or perhaps migrating would take so long that the business cannot realistically do it during a crisis.
This is where digital sovereignty becomes useful.
Question: Does digital sovereignty mean avoiding foreign technology?
No. Digital sovereignty is primarily about maintaining control, resilience and the ability to make choices. An organization can use international providers while still designing systems that reduce dangerous dependencies.
The importance of substitutability
One of the most important ideas highlighted in the Reuters report is substitutability.
In simple terms, substitutability asks:
Can you replace a critical technology or provider if you have to?
Charles-Pierre Astolfi, CIO of France’s National Institute of Geographic and Forest Information, described digital sovereignty fundamentally in terms of this ability to replace critical technologies when necessary, according to Reuters. (Reuters)
That is a powerful way to think about the issue.
A technology can be excellent and still represent a risk if there is no realistic alternative.
The objective is therefore not necessarily to have two identical systems running all the time. It may instead mean having the architecture, contracts, skills and data portability needed to make a switch possible.
What Can Trigger a Digital Infrastructure Shock?
Digital infrastructure shocks can come from several directions.
Some are technical. Others are geopolitical. Some are physical.
The important point is that organizations cannot assume the next disruption will look like the last one.
Geopolitical conflict and export controls
Technology increasingly sits inside international trade and national security policy.
Semiconductors, advanced computing equipment, cloud services, telecommunications technologies and AI systems can all be affected by government decisions.
Export controls can limit access to certain technologies or hardware. Sanctions can create legal complications. Conflicts can disrupt physical infrastructure or supply chains.
Reuters highlighted attacks on data centers and telecommunications infrastructure during conflicts in Ukraine and the Middle East as examples of how digital infrastructure can become exposed to geopolitical events. (Reuters)
Question: Why do geopolitical events matter to an ordinary company’s IT department?
Because digital services depend on global networks of hardware, software, data centers, telecom infrastructure, suppliers and legal jurisdictions. A disruption in one part of that ecosystem can affect organizations far away from the original event.
Cyberattacks and physical infrastructure damage
Cybersecurity is an obvious part of digital resilience, but digital infrastructure also has a physical side.
Data centers require electricity.
Telecommunications networks require physical equipment.
Cloud services depend on buildings, cables, networking hardware and power systems.
That means a cyber incident, physical attack, power disruption or regional disaster can potentially affect digital operations.
The growing connection between physical infrastructure and digital systems makes redundancy increasingly important.
A company may have multiple copies of its data but still face problems if those copies depend on the same underlying network or geographic region.
Vendor lock-in and concentration risk
There is another, less dramatic risk: concentration.
Suppose an organization uses one cloud provider, one identity platform, one critical database technology and one telecommunications provider.
Each individual choice might make sense.
Together, they can create a single ecosystem with significant switching costs.
Vendor lock-in is the situation where moving away from a technology provider becomes difficult or expensive because systems, data, processes or contracts are tightly tied to that provider.
The risk is not that the provider is necessarily unreliable.
The risk is that the organization loses flexibility.
Capgemini’s research notes that reliance on global suppliers across cloud, software, hardware and connectivity can expose organizations to concentration risk, limited visibility and lengthy switching timelines. (Capgemini)
Why Companies Are Focusing on Data, AI Models and Workloads
One of the most interesting shifts in the current debate is that organizations are not necessarily trying to replace every technology provider.
Instead, they are asking:
What must we continue to control even if a provider changes?
The answer often includes data, AI models, intellectual property and critical workloads.
Protecting what cannot easily be replaced
A cloud provider can potentially be replaced.
A software subscription can potentially be changed.
But an organization’s historical business data, proprietary AI models, intellectual property and operational knowledge may be much harder to recreate.
This makes them especially important assets.
Question: Why are data and AI models central to digital sovereignty?
Because they can represent irreplaceable organizational value. If access to the infrastructure hosting them is disrupted, the organization needs a realistic way to preserve, recover and operate those assets elsewhere.
For example, imagine an Indian manufacturing company has spent years developing an AI model that helps detect defects on a production line.
The model itself may be proprietary.
Its training data may be highly valuable.
Its operating environment may be built around a particular cloud platform.
If the company cannot move the model or its supporting workloads elsewhere, the technology becomes dependent on the infrastructure around it.
That is exactly the kind of dependency organizations are increasingly examining.
Portability as a resilience strategy
Data portability means being able to move data between systems or providers in a usable form.
Portability sounds technical, but the business principle is straightforward:
If you own something important, you should understand how you would retrieve and use it if your current provider became unavailable.
This principle is increasingly relevant to AI.
Organizations may need to think about the portability of:
- Training datasets
- AI models
- Model weights
- Application code
- Databases
- Backups
- Identity systems
- Configuration information
- Critical business workflows
That does not mean every organization needs a fully duplicated infrastructure stack.
It means critical assets should not become permanently trapped inside one technology ecosystem.
How Organizations Can Prepare for Digital Infrastructure Disruptions
Preparing for digital infrastructure shocks is less about predicting the next crisis and more about designing for uncertainty.
A practical strategy can begin with five steps.
1. Map critical dependencies
Organizations first need to know what they depend on.
That means going beyond the obvious list of vendors.
A dependency map can include:
- Cloud providers
- Telecom operators
- Data centers
- SaaS platforms
- AI providers
- Semiconductor suppliers
- Identity and authentication services
- Payment infrastructure
- Critical software
- Data storage systems
- External APIs
- Energy and connectivity providers
The goal is to identify which dependencies could stop essential operations if they disappeared.
Question: What should organizations identify first?
They should start with the technologies and providers whose disruption would have the greatest operational, financial, regulatory or safety impact.
2. Classify dependencies by business impact
Not every technology deserves the same level of redundancy.
An internal collaboration tool and a system controlling a critical manufacturing process should not necessarily receive identical resilience budgets.
Organizations can classify systems according to:
- Business criticality
- Time to recover
- Availability of alternatives
- Switching cost
- Data sensitivity
- Regulatory importance
- Geographic concentration
This creates a risk-based approach instead of an expensive attempt to duplicate everything.
3. Build realistic alternatives
The next step is optionality.
For some workloads, that might mean using multiple cloud providers.
For others, it might mean maintaining an alternative software platform or a secondary telecommunications route.
For critical data, it might mean maintaining independent backups.
For AI, it could mean ensuring that important models and datasets are not dependent on one inaccessible environment.
Capgemini’s broader technology research identifies multi-cloud, multi-vendor strategies and data portability as architectural principles for making infrastructure more resilient. (Capgemini)
4. Test the exit plan
A backup plan that exists only in a document is not much of a backup plan.
Organizations should periodically test whether they can actually move critical workloads.
That could reveal problems such as:
- Incompatible software
- Missing credentials
- Unusable backups
- Unexpected migration costs
- Insufficient staff expertise
- Regulatory restrictions
- Hidden dependencies
- Long recovery times
Question: How do you know whether an organization is truly resilient?
By testing its ability to continue operating when a critical dependency becomes unavailable, rather than simply checking whether backup systems exist.
5. Make resilience a board-level conversation
Technology teams cannot solve every sovereignty issue alone.
Decisions about supplier concentration, geopolitical exposure, data ownership and investment involve finance, legal, procurement, security and senior leadership.
That is why the growing board-level discussion matters.
Capgemini reports that 93% of organizations have discussed digital sovereignty at board level, indicating that the topic is increasingly becoming part of strategic governance rather than remaining an isolated IT concern. (Capgemini)
Digital Sovereignty vs Traditional IT Resilience
The two concepts overlap, but they are not identical.
Traditional IT resilience often focuses on keeping systems available and recovering them after failures.
Digital sovereignty adds another question:
Who controls the technology, and how much freedom do we have if circumstances change?
| Area | Traditional IT Resilience | Digital Sovereignty |
| Main goal | Keep systems running | Maintain control and choice |
| Main concern | Outages and failures | Dependencies and external constraints |
| Key question | Can we recover? | Can we switch or remain independent? |
| Data | Backup and recovery | Control, access and portability |
| Vendors | Reliability | Concentration and substitutability |
| Cloud | Availability | Provider and jurisdictional dependence |
| AI | Model availability | Control over models, data and infrastructure |
| Geography | Disaster recovery | Legal and geopolitical exposure |
| Strategy | Business continuity | Resilience plus strategic autonomy |
This distinction is important.
An organization could have excellent disaster recovery and still have significant sovereignty risk.
For example, imagine all backups are stored with the same provider under the same legal and technical ecosystem.
The company may have redundancy, but not necessarily meaningful independence.
What This Means for AI, Cloud and Future Technology Jobs
For students and young professionals, digital sovereignty may sound like a boardroom issue.
It isn’t.
It is likely to influence the kinds of technology skills organizations value.
Cloud engineers may increasingly need to understand portability and multi-cloud architectures.
Cybersecurity professionals may need to consider geopolitical and supply-chain risks alongside traditional threats.
AI engineers may need to think about where models and datasets are hosted, who controls them and whether they can be moved.
Data engineers may need to design systems that make information accessible without making it uncontrollably dependent on one platform.
The rise of resilience engineering
This creates opportunities for professionals who can connect technical decisions with business risk.
The most valuable question may not always be:
“Can we build this?”
It may be:
“Can we keep it working when the environment changes?”
That mindset applies to almost every part of technology.
A software developer can think about portability.
A cloud engineer can design for provider flexibility.
A cybersecurity analyst can assess third-party exposure.
A data engineer can build recoverable pipelines.
An AI engineer can design systems that preserve control over models and data.
Question: Why should students learn about digital sovereignty?
Because modern technology careers increasingly involve managing dependencies, security, data, cloud infrastructure and AI systems. Understanding how those systems fail,and how organizations recover,can become a valuable professional advantage.
What Should Boards Ask About Digital Infrastructure?
The most useful board questions are not necessarily highly technical.
They should expose weaknesses that might otherwise remain hidden inside IT architecture.
A board could ask:
“What happens if our most important technology provider becomes unavailable?”
The answer should include more than “we have a backup.”
Leadership should know how quickly the organization could recover and what services would be affected.
“How long would it take us to replace a critical provider?”
Reuters reported that nearly half of the organizations surveyed said replacing a critical provider would take three months to one year, while more than one-third said it would take longer than a year. (Reuters)
Those timelines can be manageable during normal operations.
They could be disastrous during a sudden crisis.
“Where are our critical data and AI assets?”
Organizations should know where important data, AI models and intellectual property are stored and who controls access to them.
“Can we move our most important workloads?”
This is the practical test of portability.
If the answer is no, leadership should understand why.
“Which dependencies are acceptable,and which are not?”
No organization can eliminate every dependency.
The objective is to decide consciously which dependencies are strategic, which are manageable and which represent unacceptable risk.
“Are we optimizing only for today’s cost?”
The cheapest technology option may not always be the most resilient.
A slightly more expensive architecture could provide dramatically greater flexibility during a disruption.
That does not mean companies should spend without limits.
It means resilience should be treated as an economic decision, not simply an IT expense.
Why Digital Sovereignty Does Not Mean Building Everything Yourself
There is a tempting but unrealistic interpretation of digital sovereignty: own every server, write every application and eliminate all external providers.
That is not the direction suggested by the Capgemini research.
The report emphasizes managed interdependence rather than complete independence. Capgemini says organizations are trying to balance control, resilience and innovation rather than retreating into technological isolation. (Capgemini)
This is especially important because modern digital ecosystems are interconnected.
A company may depend on international cloud providers, open-source software, telecom networks, hardware manufacturers and AI platforms while still maintaining strong control over its critical assets.
The smarter strategy is often:
Use external innovation where it makes sense. Avoid becoming helplessly dependent on it.
That is the central idea behind modern digital sovereignty.
What the Survey Says About the Future of Digital Infrastructure
The Capgemini findings point toward a broader shift in how organizations think about technology.
For years, digital transformation was strongly associated with speed, scalability and innovation.
Those priorities are not disappearing.
But resilience is joining them.
Capgemini’s research says 54% of organizations believe they can strengthen digital sovereignty without sacrificing competitiveness. That suggests many businesses no longer see resilience and innovation as mutually exclusive goals. (Capgemini)
Instead, the challenge is designing technology architectures that support both.
This could mean greater use of interoperable systems.
It could mean multiple suppliers for strategically important services.
It could mean stronger data portability.
It could mean sovereign cloud or AI infrastructure for particularly sensitive workloads.
And it could mean more scrutiny of technology providers before organizations become deeply dependent on them.
Question: What is the biggest lesson from the survey?
The biggest lesson is that digital infrastructure can no longer be treated as invisible background plumbing. Organizations increasingly see control, substitutability and resilience as strategic capabilities.
Frequently Asked Questions About Digital Sovereignty
What is digital sovereignty?
Digital sovereignty is an organization’s ability to maintain meaningful control over its data, technology and digital operations while reducing dangerous dependence on external providers, jurisdictions or infrastructure.
It does not require complete technological independence. Instead, it focuses on resilience, control, portability and the ability to make strategic choices when circumstances change.
Why is digital sovereignty becoming important in 2026?
Digital sovereignty is becoming more important because geopolitical tensions, export controls, cyber threats, regulations and attacks on physical infrastructure can affect access to digital technologies.
The Capgemini survey of 1,300 executives shows that organizations are increasingly discussing these risks at senior leadership and board level. (Capgemini)
How is digital sovereignty different from cybersecurity?
Cybersecurity focuses primarily on protecting systems, networks and information from unauthorized access, attacks and other threats.
Digital sovereignty is broader. It also considers who controls technology, where data resides, how dependent an organization is on particular suppliers, whether workloads can be moved and whether geopolitical or legal changes could restrict access.
Does digital sovereignty mean companies should stop using cloud providers?
No. Digital sovereignty does not require organizations to abandon cloud computing.
Instead, companies can evaluate cloud dependencies, improve data portability, use multi-cloud or hybrid architectures where justified, and ensure critical workloads can remain operational if a particular provider becomes unavailable.
Why does AI make digital sovereignty more important?
AI systems can depend on large datasets, specialized computing infrastructure, model providers, cloud platforms and proprietary software.
If an organization’s important AI workloads become tightly tied to one provider, disruption could affect both its technology and competitive advantage. Maintaining control over critical models, datasets and workloads can therefore become an important part of technology resilience.
What can students learn from the digital sovereignty trend?
Students can build skills in cloud computing, cybersecurity, data engineering, AI infrastructure, distributed systems and technology risk.
More importantly, they can learn to think beyond whether a system works today and ask whether it can remain secure, portable and operational when conditions change.
The Bottom Line
The new Capgemini survey signals a significant change in how organizations view technology dependence. Digital infrastructure is increasingly being treated as a strategic asset,and a potential point of failure,rather than simply an IT utility. (Reuters)
The organizations best prepared for future shocks may not be those that eliminate every external dependency. They may be the ones that know exactly where their dependencies are, protect their most valuable digital assets and maintain enough flexibility to change course when the world does.
For students and technology professionals, that creates a useful lesson: the future of technology isn’t only about building smarter systems. It’s also about building systems that can survive uncertainty. keep exploring kalinga.ai for more.