IBM Digital Sovereignty Index: UK Organisations Are Strong on Control, but AI Is Exposing New Risks

• UK in top three of seven global countries surveyed for demonstrating high controls are in place across critical AI, technology, operations and data
• Accountability needs stronger evidence as only 32% of UK respondents had strong evidence to prove existing governance works
• 35% of UK respondents resolved their most challenging sovereignty event without material disruption, compared with 30% of respondents globally
• Four in ten (41%) UK respondents reported an AI-related sovereignty issue in the last three years

LONDON, Nov. 11, 2026 /PRNewswire/ -- A new report from IBM (NYSE: IBM) reveals the UK's AI ambitions could be outpacing its digital control, exposing a growing gap between AI adoption and operational readiness. Proof, Not Promises: The IBM Digital Sovereignty Index indicates that the UK is among the top three of seven markets globally with high controls in place across critical technology. However, fewer than one in three (32%) can provide the strongest evidence that their governance works under pressure and that AI is where they are most exposed. 

As UK boards shape their companies' digital sovereignty strategies, the challenge is no longer whether digital control matters. Organisations need tested safeguards, recovery plans and exit strategies before a disruption exposes the gaps. The report looked at an organisation's ability to retain and prove control across their critical AI, technology, operations and data, especially when under pressure. The findings show confidence is currently running ahead of proof. AI is a clear example, with 84% of UK respondents confident they can show accountability for their AI systems yet, only 27% have demonstrated that accountability through audit, regulatory review, assurance activities or operational testing. 

The findings come as digital sovereignty rises up the agenda in the UK with the Government emphasising the importance of control, sovereignty and interoperability. At the same time scrutiny is growing from regulators, customers and investors with businesses being challenged to demonstrate greater control and accountability over their technology environments. This has turned digital sovereignty from a technology concern into an issue of business performance and board-level responsibility.

AI Putting Digital Control Under Pressure

The report surveyed senior business leaders across the United Kingdom, United States, Germany, France, Saudi Arabia, India and Japan, scoring how well organisations can evidence control of critical AI, technology, operations and data. The UK scores 77 out of 100 overall, among the top three markets alongside India (79) and the United States (78), above the global average of 74. While the UK was among the top three countries, 35% of UK respondents were able to resolve their most challenging sovereignty event without material disruption (30% globally).

"For business leaders shaping their digital sovereignty strategies, the focus must be on stronger evidence," said Leon Butler, Chief Executive, IBM UK and Ireland. "Real digital sovereignty means having the freedom to adapt, respond and change course without losing control. Organisations across the UK should focus on building sovereign-by-design strategies that embed openness, interoperability and flexibility from the outset. That way they can demonstrate resilience and accountability, even when under pressure."

Further findings reveal only 32% of UK respondents already meet the Index's 'Leading' evidence standard, compared with 26% of respondents globally. Organisations at this level typically have the strongest evidence, for example, a complete audit trail of AI-supported decisions, controls that are routinely tested and independently reviewed, and exit plans that have been tested or used in practice. AI has emerged as the UK's weakest area of control at 70 out of 100, behind data (81), operations (80) and technology (79).

"As organisations embed AI more deeply into their operations, data sovereignty must be more than a matter of confidence," said Debbie Lawrence, Group Head of Data Strategy and Management at LSEG. "Organisations need to be able to demonstrate where their data comes from, how it can be used, and what controls are in place. Trusted, well-governed data from established providers enables businesses to continue innovating securely and responsibly." 

The findings discovered:

• 93% of UK respondents faced at least one sovereignty challenge in the last three years: from AI failures and cyber incidents to significant provider changes and government restrictions. Among those affected, 83% of respondents had to provide formal evidence of control: 34% to an external party such as a regulator, auditor or customer and 49% through a formal internal review by the board, executives, internal audit, risk or compliance team.
• AI is a major trigger of sovereignty incidents: four in ten (41%) UK respondents reported an AI-related sovereignty issue in the last three years. AI came ahead of cybersecurity incidents (40%), significant provider changes (38%), formal audit or regulatory events (36%), data-access or transfer issues (32%) and government restrictions such as export controls or sanctions (30%).
• Testing has become a clear differentiator: UK respondents were more likely to regularly test their ability to demonstrate sovereignty than global peers (39% of UK respondents versus 33% of respondents globally). That discipline is paying off with 35% of UK respondents who faced a sovereignty challenge resolving their most testing situation without material disruption, compared with 30% of respondents globally.
• Producing evidence remains difficult: more than half (53%) of UK respondents who faced a sovereignty challenge said manual or time-consuming evidence collection made it difficult to provide evidence. Other barriers included fragmented evidence across teams and systems and untested controls, recovery or exit plans (each 47%), and dependence on third parties for records (46%).

Research Methodology 

The IBM Digital Sovereignty Index was developed by IBM in partnership with Edelman Intelligence through a multi-stage research programme, conducted between 17 July and 11 August 2026, combining a review of 27 sources, including legislation and governance frameworks, with qualitative interviews and an international quantitative survey. 

The survey covered 2,003 senior decision-makers at large enterprises in the United States, United Kingdom (250 respondents, at organisations with 500+ employees), Germany, France, Saudi Arabia, India and Japan. The research also included 25 interviews with policymakers, regulators, public-sector officials and policy experts, and perspectives from 17 senior customer leaders across five countries. 

The survey defined digital sovereignty as an organisation's ability to retain control and provide credible evidence of that control across critical AI, technology, operations and data. A "sovereignty challenge" is any of nine situations respondents were asked about for the last three years: infrastructure outages, vendor disruption, cyber incidents, regulatory conflicts, data-access issues, AI-related issues, government restrictions, provider changes and formal audits or reviews. 

Global figures refer to respondents across all seven markets. 

The Index was developed to measure how well an organisation can demonstrate control across four pillars (AI, technology, operations and data) and six dimensions of control: responsibility, traceability, constraint, intervention, exit and legitimacy.

To read Proof, Not Promises: The Digital Sovereignty Index, visit: https://www.ibm.com/campaign/digital-sovereignty-index. 

About IBM

IBM is a leading global hybrid cloud and AI, and business services provider, helping clients in more than 175 countries capitalize on insights from their data, streamline business processes, reduce costs and gain the competitive edge in their industries. Thousands of governments and corporate entities in critical infrastructure areas such as financial services, telecommunications and healthcare rely on IBM's hybrid cloud platform and Red Hat OpenShift to affect their digital transformations quickly, efficiently and securely. IBM's breakthrough innovations in AI, quantum computing, industry-specific cloud solutions and business services deliver open and flexible options to our clients. All of this is backed by IBM's legendary commitment to trust, transparency, responsibility, inclusivity and service.

Media contacts:

Imtiaz Mufti

IBM External Communications UKI

imtiaz.mufti@ibm.com