Digital Sovereignty

Governments across multiple jurisdictions are extending their reach into areas previously treated as purely commercial decisions. National legislation increasingly carries extraterritorial effects, creating legal conflicts that cannot be fully resolved through technical measures alone and that require deliberate architectural and contractual choices. Compliance obligations are becoming structural rather than episodic, shaping infrastructure decisions and not only reporting processes. Organisations operating across jurisdictions face overlapping requirements that must be managed proactively to avoid double exposure.

The global markets for cloud infrastructure, artificial intelligence, chip manufacturing, and critical software are heavily concentrated among a small number of providers. This creates structural dependencies that organisations cannot resolve through procurement choices alone. Technological lock-in is an architectural structure that builds up gradually, layer by layer, often without anyone consciously deciding to accept it.
Each layer of the infrastructure stack introduces a dependency. At the data layer, proprietary formats and extraction costs make migration expensive and slow. At the identity and access management layer, migrating means simultaneously migrating every application, every integration, and every access policy. At the AI platform layer, composite dependencies require significant refactoring to exit. The higher an organisation moves in the stack, the more invisible the lock-in becomes and the more expensive it is to resolve.
Workplace technology creates a parallel form of lock-in based on organisational habit rather than technical complexity. Switching collaboration and productivity tools requires comprehensive change management across every team and workflow, not only a technical migration. Hardware sovereignty is bounded by structural global dependencies at the chip and semiconductor level that cannot be resolved in the short term and must be documented and accepted consciously rather than ignored.

The cloud contractual model structurally shifts control towards providers the moment a contract is signed. Standard contracts are updated unilaterally with minimal notice; the provider manages patching, deprecations, and incident response; and telemetry may be incomplete, with audits depending on what the provider chooses to disclose. Exit economics, including data extraction costs, mandatory integration rework, re-certification, and actual migration timelines, are rarely estimated in advance.
In cloud sovereignty, sovereignty-washing is a significant market risk. Providers may present data location as equivalent to sovereignty, while control of the identity layer, cryptographic keys, and administrative access remains with the provider. The risk is that the contractual and operational model itself structurally shifts control away from the organisation, regardless of intent.