Bart Salaets, Field Chief Technology Officer, F5 outlines, the top considerations security leaders need to ask as they consider their digital sovereignty strategies in this exclusive op-ed.
As organisations expand across clouds, regions, and AI-driven services, questions about control are becoming harder to ignore.
Digital sovereignty has become much more than a niche concern limited to governments and highly regulated industries. Across finance, healthcare, public sector, and multinational organisations, security leaders are rethinking where applications run, who controls critical services, and how dependent they have become on external technology providers.
In parts of the Middle East, for example, strict data protection regulations strongly influence where these organisations store their data, often resulting in locally hosted solutions. Yet many of those same organisations still rely on cloud-based DNS and volumetric DDoS services because those services do not inspect customer payloads. The result is not a rejection of cloud computing, but a more selective and strategic approach to digital sovereignty.
That distinction matters. Digital sovereignty is not about abandoning the cloud or isolating infrastructure from the rest of the world. It is about maintaining control as regulations evolve, trust models shift, and operational risks become more difficult to predict. For multinational organisations, sovereignty requirements are becoming a moving target shaped by regional laws, procurement standards, operational resilience concerns, international relations, and the rapid rise of AI.
As a result, digital sovereignty is forcing executives to re-examine their data, operations, technology dependencies, and AI systems. As they consider their digital sovereignty strategies, here are four questions security leaders need to ask:
- Who can access my data?
Data sovereignty remains perhaps the most immediate concern for many organisations. At its core, it focuses on maintaining control over where data is stored, who can access it, and which laws govern it.
This apprehension is being driven largely by compliance requirements and jurisdictional conflicts. Regulations such as GDPR, the EU AI Act, and regional data residency mandates are raising the stakes for organisations that move sensitive data across borders. At the same time, concerns about foreign jurisdiction and third-party access continue to influence where applications and data are deployed.
In response, some organisations are slowing their migration to public cloud environments for sensitive workloads. Others are selectively bringing applications and data back into private or on-premises infrastructure, particularly in industries such as finance and government where risk thresholds are lower and compliance expectations are higher.
Importantly, not every workload requires the same level of sovereignty. Many organisations are adopting hybrid approaches that keep highly sensitive applications and data local while continuing to consume less intrusive services from cloud providers.
- Is there a “kill” switch?
Organisations are increasingly asking whether they can maintain operational continuity if access to external platforms or services is disrupted. That concern may stem from changing regulations, shifting trust relationships, or broader operational uncertainty. In some cases, enterprises worry about becoming too dependent on a single provider for critical services.
Operational sovereignty shifts the discussion from compliance to control, and this is where the idea of a “kill switch” enters the discussion. Operational sovereignty is not about shutting systems down. It is about ensuring that an external entity cannot unexpectedly disrupt or disable your critical operations.
For some organisations, this means prioritising infrastructure that can operate independently in self-managed or even air-gapped environments. Others are evaluating whether key application delivery, security, and management functions can continue operating during service interruptions or changes in regional requirements.
The larger issue is resilience. As organisations become more dependent on digital services, operational sovereignty becomes increasingly tied to business continuity. For many enterprises, that also means maintaining the flexibility to move applications and services to another environment when needed, including as part of a cloud exit strategy.
- How dependent am I on a single technology stack or provider?
Technology sovereignty focuses on long-term resilience and flexibility.
Many organisations now recognise that infrastructure decisions made today may become constraints tomorrow. Regulatory expectations may change. Procurement standards may tighten. Regional requirements may evolve. As a result, organisations are beginning to evaluate how difficult it would be to move workloads between environments or adapt applications to new operational realities.
For some, that means reducing dependence on proprietary technologies or single-provider ecosystems. For others, it means investing in open-source technologies, Kubernetes-based architectures, local or regionally developed technologies, or hybrid deployment models that provide greater portability over time.
This does not mean every organisation is abandoning hyperscalers or public cloud services. In fact, many are continuing to expand their cloud footprints. But there is growing recognition that flexibility matters. Organisations increasingly want the ability to place workloads where it makes the most sense based on compliance, performance, operational risk, and business priorities.
In many ways, technology sovereignty is less about where applications run today and more about preserving future options.
- Who controls how my AI systems access and act on sensitive data?
AI sovereignty may become the next major phase of this discussion.
As AI systems become more deeply integrated into business operations, organisations are beginning to ask new questions about where AI models run, how inference is performed, and whether sensitive data remains under organisational control.
This is especially important as enterprises build AI infrastructure around GPU-based “AI factories” and large-scale data pipelines. Organisations want to understand how AI systems connect with sensitive applications and data, how AI interactions are governed, and how operational control can be maintained at scale.
In Europe and other regions, some organisations are already exploring sovereign AI initiatives designed to reduce dependency on external AI platforms while maintaining greater control over infrastructure and data flows.
The challenge is that AI amplifies many of the concerns already associated with digital sovereignty. Data governance, operational resilience, scalability, security, and regulatory compliance all become more complex when AI systems are introduced into the environment.
Why flexibility is key
Analysts have warned that unmanaged digital sovereignty risk could expose multinational organisations to financial, legal, and reputational consequences in the years ahead. At the same time, digital sovereignty requirements themselves continue to evolve.
That is why flexibility may ultimately become the most important consideration of all.
Organisations are increasingly looking for ways to support different levels of sovereignty across applications without fragmenting operations or creating excessive complexity. Hybrid and multicloud strategies, selective use of on-premises infrastructure, consistent policy enforcement, and unified operational models are all becoming part of the discussion.
Digital sovereignty is not a fixed destination. It is an ongoing process of balancing control, resilience, flexibility, and operational simplicity in a world where regulations, technologies, and trust models continue to change.
Image Credit: F5
