Across the globe, particularly outside of the US, digital sovereignty is now a tech agenda priority item, but a wake-up call is still required because too many enterprises rely on US cloud services and AI models.

That was the message from an expert panel at Civo’s Navigate event in London, where industry experts debated the importance of sovereignty, the ability to make choices and have control of your own data, and the long-term implications for businesses.

British Lord Paul Drayson, who is also chairman at Locai Labs, referred to his former roles as a UK Government minister for both defense and science, and suggested the conversation the panel was having about digital sovereignty in 2026 was necessary because the UK had not invested sufficiently in the skills and the capability to take control over its AI stack:

If someone else can turn it off, or they can take it away, whether it's as an individual, a business, or the government, you have not got sovereignty. I think it's the single most important political issue that we're facing right now - how does a country like the United Kingdom retain and develop the sovereignty it needs in the modern world?

Evidence presented during the panel session also suggested more work is required. A recent survey of 1,000 IT leaders by Civo found that while almost three-quarters (73%) of respondents say they treat sovereignty as a strategic priority, only 15% have acutally done something to move from dependency on US hyperscalers to sovereign domestic providers. In fact, an increasing proportion of IT leaders (28%) expect to deepen their relationships with the hyperscalers, up from 12% last year.

Drayson suggested it’s encouraging that people are more aware of sovereignty. He suggested Anthropic’s decision to temporarily withdraw its Claude Fable 5 and Mythos 5 AI models worldwide in June, following an emergency export-control directive from the US Government, was a wake-up call for UK business leaders.

Yet even as awareness of sovereignty grows, many people are slow to react, as Civo’s research suggested, not least because they fear losing a competitive advantage in the AI age. Under these circumstances, Drayson said it’s easier to understand why many organizations remain wedded to US hyperscalers:

The challenges of responding to that concern are considerable, and of course, this is at a time when the potential of AI to improve productivity, and the performance of AI, is going up. So, therefore, the incentives to stay where you are to enable your business to benefit from what AI can deliver are very strong.

The panelists at the event suggested the key to unlocking sovereignty is an effective strategic response. However, shifting emphasis won’t be straightforward.

Dan Chester, global director at Vast Data, said every organization managing sovereignty faces a migration challenge. Enterprise IT departments have traditionally been expected to keep costs down, relying on cloud infrastructure maintained by US hyperscalers:

It's like an oil tanker; it's very difficult for enterprises to pivot back suddenly because they’re concerned about sovereignty. That oil tanker is on the path to a hyperscaler because that's the decision that was made: ‘We're all in on the cloud. That's the path we're taking,’ and it's hard to turn that tanker around.

Chester described the move from one form of service provision to another as a pendulum. Right now, given rising concerns about sovereignty, the pendulum appears to be swinging from relying on hyperscaler provision towards regionalized cloud services. Whichever route they take, business leaders must understand what data their business holds:

It’s very difficult for many organizations, and I think that's again behind that continued journey that a lot of organizations are on, which is that the inertia path of continuing to absorb more SaaS services and cloud services.

However, Ed Barker, founder and Managing Director of advisory firm Havishams, suggested IT professionals must consider the long-term direction of travel. Broader concerns about privacy in the AI era have helped peak interest in data storage. He encouraged digital leaders to translate everyday IT concerns about data sovereignty into business risk narratives.

For Drayson, the message is clear – a fundamental change has occurred. The political premise that has dominated the last 80 years no longer applies. The UK aligned itself with the US and relied on the technology it provides. Yet the reliability of that relationship can no longer be guaranteed, and the long-established status quo will not return:

The British political system has been and is still being slow on the uptake on this issue. It's the nature that when so much is relied upon in the core assumption of your policy, to really absorb the fact that the world has changed, and to change your policies in response to that, takes time.

The panel focused on the potential for providers to withdraw access to their models or services, as Anthropic did earlier this year. Chester said all digital leaders should be concerned by the potential for this kind of situation to happen again, especially where businesses are running key business services in production that use US models and services:

The opportunity for governments or technology providers to do that means ultimately you need to be able to substitute. So, the question then is, are you in a position where you can substitute from one model to something else?

New regulations also bring risks. Chester referred to the Remote Access Security Act (RASA), which extends US export controls to advanced technologies, such as AI chips via the cloud. Truly sovereign organizations are not beholden to one provider. These enterprises can move to other models and services, whether they are provided by Big Tech, the open-source community, or established in-house.

Richard Woodfield, Head of Solution Services at DataVita, suggested that digital leaders must think carefully about how to protect their businesses. He said they should think of this careful approach to data sovereignty as a long-term disaster recovery plan:

These things will come to bite at some point, and even if you haven't had the opportunity to make the appropriate migrations or redevelopments, what you should do, in the interim, is safeguard as much as you can. Think about contexts, vector databases, and things that can be removed, so at least you don't end up flat-footed.

The world has changed, and there’s no going back. The rise of AI hasn’t just changed business operations; it’s also changed provider relationships. Business leaders must wake up to fresh data sovereignty concerns. The time to act strategically is now.