Klaudia Zaika is the CEO of Apriorit, a software development company that provides engineering services globally to tech companies.
getty
For global software companies and the engineering teams supporting them, digital sovereignty has moved from a policy discussion to an operational one. The question is no longer whether to pursue it but how to approach it realistically and strike the right balance between isolation and collaboration.
At my company, we work with software vendors and enterprises that operate across multiple regions and also want to maximize control over their data and cybersecurity. So today, I want to share our approach to assessing a business's digital sovereignty feasibility and discuss where the most impactful gaps often appear.
More and more businesses are building digital sovereignty into their technology strategy. While some do it in response to regulatory changes, others want to mitigate potential risks.
I see this in requests from my company's clients, too: rather than defaulting to whatever products or services rule the market, they are actively investigating ways to maximize their digital sovereignty through custom solutions.
Their reasoning usually comes down to several objectives:
• Establishing full ownership over their data, so that they know where it lives, who can access it and under what legal framework
• Reducing exposure to foreign jurisdictions, including when a court order in one country may compel a provider to disclose data stored in another one
• Minimizing dependency on global hyperscalers and the concentration risks that come with them
• Taking a proactive approach to meeting regional compliance requirements
Community leaders at the 2026 Microsoft Digital Sovereignty Summit present digital sovereignty as a risk-mitigation measure. But most importantly, they highlight that every organization—and every workload—has a different risk profile, legal exposure and criticality. Thus, there can be no universal solution that every company can rely on.
When my clients want to pursue digital sovereignty across their products or infrastructure, I first ask them four fundamental questions. Answering these helps them map out the right implementation strategy and prevent unnecessary costs.
Start by analyzing whether relevant regulations exist or are being developed for every location or industry your business operates in. Then look where their requirements overlap, where they conflict and where they simply don't apply to you.
The more regulatory divergence you have to manage across your operating regions, the higher your implementation and ongoing maintenance costs will be. This can be a significant architectural constraint, especially for global software vendors and transnational enterprises.
Sovereign infrastructure only protects you if it can run your product at the quality level your end users expect.
In some regions, the available ecosystem is mature enough to support complex, security-critical workloads. But if your target region lacks a robust digital ecosystem, operating there will put pressure on both your cybersecurity posture and service quality.
For example, with distributed SaaS or AI platforms, complete digital sovereignty may look feasible in theory, but rarely works as expected in practice.
Data residency requirements may demand certain workloads to run locally. For example, the EU AI Act's obligations for high-risk systems and GDPR's data transfer restrictions often lead organizations to prefer EU-based or sovereign-controlled infrastructures.
However, local infrastructure may not have the compute capacity or network reliability to support these workloads at the required production scale.
Most of the projects I encountered this constraint in used AI-heavy architectures, though it can be a real challenge for any project requiring complex, near-real-time processing of large data volumes.
Some regions have talent restrictions for specific projects or industries. For example, under ITAR, any access to defense-related technical data in the US is restricted to US persons only.
Keeping things in-house can be manageable across most locations and markets, at least when we talk about general engineering roles. Yet for niche expertise like malware research, kernel development or quantum computing, the talent pool is limited even on a global scale. Meaning that for some markets or projects, finding the right people locally may not even be an option.
Digital sovereignty is all about managing risks, so you should pursue it only where the risk justifies it.
Full digital sovereignty across every region you operate in is rarely the right goal and often not realistic. A more practical approach is to be deliberate about where full sovereignty actually matters.
You can start by identifying which workloads carry your most sensitive data, pose your highest regulatory exposure or involve your most critical infrastructure. These will be the main candidates for maximizing your data and access controls.
For everything else, maintaining efficient, globalized operations and collaborating with the right ecosystem of both local and global partners is often the stronger business decision.
Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。